Abstract:
Software-defined networking (SDN), due to its centralized architecture, is vulnerable to distributed denial of service (DDoS) attacks. Many detection methods prioritize model performance while neglecting the impact of feature dimensions, resulting in models being disturbed by noise. To address the issue of redundant feature dimensions in high-dimensional network traffic data degrading model detection performance, this study proposes a dynamic feature selection mechanism based on sequential attention (SA), and integrates it with gated recurrent units (GRU) to construct a collaborative detection model. The SA mechanism performs feature selection on preprocessed datasets by dynamically adjusting feature weights, effectively filtering irrelevant noise to achieve dimensionality reduction. The GRU module captures short- and long-term temporal dependencies in network traffic, models state transition patterns in data streams, and enhances the model's sensitivity to attack traffic. Compared with traditional models and recently proposed DDoS attack detection methods, the proposed model in this paper achieves detection F1 scores of 99.84% and 99.91% on CICIDS2017 and CICDDoS2019 datasets, significantly outperforming existing methods. It also demonstrates high efficiency in testing, meeting the requirements for both accuracy and real-time response in DDoS attack detection.