Federated Learning Driven DDoS Detection in SDN Environment using Contrastive Learning

Abstract: Distributed Denial of Service (DDoS) attacks pose a significant threat to modern Software Defined Networking (SDN) environments due to their ability to overwhelm network resources and disrupt services. This paper proposes a hybrid, privacy-preserving DDoS detection framework that integrates deep learning and machine learning techniques within a federated learning architecture. The model combines Long Short-Term Memory (LSTM) networks with Support Vector Machines (SVM) for initial temporal pattern detection, followed by a Convolutional Neural Network with Bidirectional Gated Recurrent Units (CNN–BiGRU) for refined spatial–temporal feature extraction and classification. To further enhance detection accuracy, a contrastive learning mechanism is incorporated to improve feature discrimination between normal and malicious traffic. The system operates in an SDN environment, where the controller facilitates real-time traffic monitoring and mitigation by dynamically enforcing flow rules. Federated learning ensures data privacy by enabling decentralized training without sharing raw data across nodes. Experimental results demonstrate that the proposed framework achieves high detection accuracy, reduced false positives, and efficient real-time response, making it suitable for scalable and secure next-generation network infrastructures.