PaperlayerView exact revision on arXiv

Source-linked AI summary

XAI-SDN: An Explainable Entropy-Guided Machine Learning Framework for Real-Time DDoS Detection in Software Defined Networks

Adeel Ahmad, Ali Akarma, Ahmad Ali, Hammad Muneer, Toqeer Ali Syed

arXiv:2609.05701v1cs.CRcs.AIcs.NI

TL;DR

DDoS attacks can make centralized SDN networks inoperable, and opaque ML predictions create operational audit concerns. XAI-SDN combines rolling entropy features, Random Forest, and SHAP; on the CIC-DDoS2019 SYN benchmark it reports high detection metrics and throughput with explanations.

  • Problem

    DDoS attacks targeting an SDN controller or saturating its control channel can render the network inoperable, while opaque ML predictions complicate auditing and validation of mitigation decisions.

    Source: §I · p. 1

  • Method

    XAI-SDN augments CICFlowMeter features with eight O(1) rolling Shannon-entropy metrics and uses Random Forest with SHAP TreeExplainer for per-prediction explanations.

    Source: §I · p. 1, A. Entropy Feature Extraction · p. 2, §III · p. 2

  • Results

    On 3.59 million CIC-DDoS2019 SYN flows, XAI-SDN reports 99.9987% accuracy, 99.9621% macro F1-score, 1.0000 AUC-ROC, and 1,953 flows/s with SHAP.

    Source: B. Latency and Throughput · p. 4, §VIII · p. 5

  • Takeaways & Limitations

    Full SHAP support runs at 1,953 flows/s versus 60,606 flows/s without SHAP under 99.14% DDoS prevalence in the benchmark conditions.

    Source: B. Latency and Throughput · p. 4

    Evaluation covers the CIC-DDoS2019 SYN benchmark; broader evaluation across all attack vectors is identified as future work.

    Source: §VIII · p. 5

Abstract

from arXiv · show

One of the biggest risks faced by Software Defined Networks (SDN) is the Distributed Denial of Service (DDoS) attack in which a compromised controller can make an entire network unusable. To address these challenges, we suggest an entropy-guided machine learning framework, called XAI-SDN, for real-time DDoS detection in SDN environments which is lightweight and explainable. The framework extends the flow features extracted by CICFlowMeter with eight Shannon entropy metrics obtained by an $\mathcal{O}(1)$ rolling algorithm and uses a Random Forest classifier with SHAP TreeExplainer for providing transparency at the prediction level. On a fixed temporal split, XAI-SDN achieves an accuracy of 99.9987\%, a macro F1-score of 99.9621\%, and an AUC-ROC of 1.0000 on the full 3.59 million flows of the CIC-DDoS2019 SYN benchmark. The pipeline sustains 0.0165~ms per flow (60{,}606 flows/s) without the use of SHAP and 0.5122~ms per flow (1{,}953 flows/s) with full support of SHAP under the 99.14\% prevalence of DDoS traffic, which is a step towards achieving a balance between the detection performance and operational transparency in next-generation SDN security.

I. INTRODUCTION

SDN centralization makes a controller or control-channel DDoS attack capable of rendering the network inoperable, while opaque ML predictions raise concerns for operational auditing. XAI-SDN combines entropy-guided features and per-prediction explanations, extending prior work on streaming entropy and explainability.

I. INTRODUCTION

  • A successful DDoS attack on the centralized controller or control channel can render an SDN network inoperable.Operators also need to audit and validate mitigation decisions before disrupting active services.Source: §I · p. 1
  • Opaque ML predictions create operational risks because network operators must audit and validate mitigation decisions before disrupting services.Transparency, explainability, and verifiable decision trails are described as governance requirements for autonomous AI in critical infrastructure.Source: §I · p. 1
  • XAI-SDN combines eight interpretable Shannon entropy metrics computed by an O(1) rolling algorithm with Random Forest and SHAP TreeExplainer.The paper evaluates 3.59 million CIC-DDoS2019 SYN flows, studies ablations with 10 seeds and Wilcoxon tests, and analyzes SHAP latency under realistic DDoS prevalence.Source: §I · p. 1

II. RELATED WORK

  • Prior work spans entropy-based early detection, streaming entropy estimation, and SHAP or attention for intrusion detection, while deep-model inference latency can conflict with SDN line-rate requirements.The paper presents statistical entropy as a practical alternative for high-speed programmable environments.Source: §II · pp. 1–2
  • XAI-SDN embeds O(1) rolling entropy in early feature extraction, supplying statistics to both the Random Forest classifier and SHAP explainer.The related-work discussion identifies this combination of rolling entropy, Random Forest, and exact SHAP attribution under realistic traffic prevalence as not previously demonstrated.Source: §II · p. 2

III. XAI-SDN FRAMEWORK AND ARCHITECTURE

XAI-SDN processes OpenFlow flow statistics through entropy-augmented feature extraction, Random Forest classification, and conditional SHAP explanations. Its controller sends alerts for operator triage and supports an auditable southbound policy-feedback loop.

III. XAI-SDN FRAMEWORK AND ARCHITECTURE

  • OpenFlow flow statistics pass through aggregation, entropy-augmented feature extraction, Random Forest classification, SHAP explanation generation, and alert dispatch.The architecture collects statistics at a configurable 500 ms polling interval and produces an 88-dimensional input from 80 statistical features plus eight entropy metrics.Source: §III · p. 2
  • A circular buffer and hash-map tracker maintain flow frequencies and entropy values in constant time as packets enter and leave the window.The paper states that this design delivers sub-millisecond processing latency.Source: §III · p. 2
  • SHAP TreeExplainer runs when a flow is classified as DDoS with probability above threshold τ, adding feature attributions to structured alert payloads.The payload supports operator triage and policy refinement on the Security Operations Center dashboard.Source: §III · p. 2
  • The southbound feedback loop lets human operators or automated agents use auditable alert telemetry to install OpenFlow flow-mod drop rules.Detected DDoS events trigger alerts and policy updates in the architecture.Source: §III · p. 2

IV. MATHEMATICAL FOUNDATION

XAI-SDN uses sliding-window Shannon entropy to characterize traffic distributions and appends eight entropy metrics to CICFlowMeter statistics. A hash-map rolling update maintains the features in O(1) time.

A. Entropy Feature Extraction

  • High entropy characterizes distributional uniformity associated with benign traffic diversity, while low entropy indicates concentrated distributions characteristic of volumetric flooding.The source-IP metric is computed over a sliding window of recent flows.Source: A. Entropy Feature Extraction · p. 2
  • The 88-dimensional vector combines 80 CICFlowMeter statistical features with eight entropy metrics, including source and destination IPs, destination ports, protocols, packet lengths, inter-arrival times, TCP flags, and IP TTL.The entropy values are maintained in O(1) time via a hash-map rolling update.Source: A. Entropy Feature Extraction · p. 2
  • For source-IP entropy, I denotes distinct source IPs in the window and n_i is the flow count for address i.The architecture uses O(1) entropy-augmented feature extraction.Source: A. Entropy Feature Extraction · p. 2, Figure 1 · p. 3

B. Random Forest Classification

The Random Forest classifier aggregates decision-tree votes to assign a benign or DDoS label, with Gini impurity used for node splits.

B. Random Forest Classification

C. SHAP Explainability

SHAP assigns each feature a contribution to a specific prediction relative to expected model output. TreeSHAP computes exact values for tree ensembles in polynomial time, supporting per-flow explanations.

  • SHAP computes each feature’s contribution to a prediction relative to the expected model output.The feature contributions satisfy the efficiency property: the prediction equals the baseline plus the sum of SHAP values.Source: C. SHAP Explainability · p. 3
  • TreeSHAP computes exact SHAP values for tree ensembles in O(TLD^2) time, enabling real-time per-flow explanations.Source: C. SHAP Explainability · p. 3

V. EXPERIMENTAL SETUP

The evaluation uses the CIC-DDoS2019 SYN flood partition and a temporal train-test split intended to prevent data leakage. It also addresses the severe class imbalance through balanced Random Forest class weights.

  • 2,514,862 samples form the training set after missing values and duplicate records are removed from the CIC-DDoS2019 SYN partition.Source: §V · p. 3
  • A 70% temporal training and 30% temporal testing split is used to prevent data leakage.Source: §V · p. 3
  • Class_weight='balanced' counteracts the severe class imbalance, with benign flows at 0.86%.Table I presents the test-set class distribution, and Table II lists the Random Forest hyperparameter configuration.Source: §V · p. 3, Table I · p. 3, Table II · p. 3

A. Implementation and Hyperparameters

The implementation uses scikit-learn for Random Forest and SHAP for explanations, with experiments run on a CPU-based setup. Hyperparameters were selected using five-fold cross-validation, and detection performance is reported for a fixed temporal split.

VI. RESULTS AND DISCUSSION

On the fixed temporal split, XAI-SDN reports near-perfect detection metrics, while its 10-seed results show a higher and more representative FPR. SHAP explanations add substantial latency, and the global feature rankings include entropy metrics alongside traffic and port features.

A. Detection Performance

  • 99.9987% accuracy, 99.9621% macro F1-score, and 1.0000 AUC-ROC are reported on the fixed temporal split.There are 14 misclassifications across 1,077,798 held-out flows: 5 false positives and 9 false negatives.Source: A. Detection Performance · p. 4
  • 5.77% ± 5.23% FPR on 10-seed stratified random splits contrasts with the 0.0537% fixed-temporal-split FPR.The paper attributes the difference to benign samples being concentrated and well separated in the temporal split, and calls the 10-seed mean more representative of an operational error bound.Source: A. Detection Performance · p. 4

B. Latency and Throughput

  • 0.0165 ms per flow (60,606 flows/s) without SHAP rises to 0.5122 ms per flow (1,953 flows/s) with full SHAP support at 99.14% DDoS prevalence.The reported SHAP TreeExplainer contribution is 0.5000 ms per DDoS flow.Source: B. Latency and Throughput · p. 4, Table IV · p. 4

C. SHAP Feature Attribution

  • Flow_Bytes/s (0.0585), Destination_Port (0.0550), and FIN_Flag_Count (0.0495) are the top global SHAP factors.They correspond to elevated bandwidth, targeted ports, and suppressed FIN flags, which the paper describes as canonical SYN-flooding hallmarks.Source: C. SHAP Feature Attribution · p. 4
  • Four entropy features rank among the top eight global SHAP features, while Httl is excluded as a degenerate constant in this partition.Source: Figure 2 · p. 4
  • Hsrc ranks fourth overall among entropy metrics with attribution 0.0288, while Httl is constant at 0.0 in the offline SYN partition.The paper says Httl remains an active feature in operational deployments where packet TTL varies across routing paths.Source: C. SHAP Feature Attribution · p. 4

D. ROC Curve Analysis

XAI-SDN outperforms all baselines across the ROC range, with AUC = 1.0000. The controlled-subset comparison also reports high accuracy, micro F1, and sub-millisecond inference latency among the top-performing models.

VII. COMPARATIVE ANALYSIS

  • In the controlled 10,000-training/3,000-testing comparison, joint-highest accuracy (99.867%) coincides with best micro F1 (95.966%) and sub-millisecond inference latency.Class_weight='balanced' was applied uniformly across five baselines.Source: §VII · p. 4

D. ROC Curve Analysis

VII. COMPARATIVE ANALYSIS

  • The full 88-dimensional feature set significantly outperforms entropy-only classification and SVM, while its incremental improvement over entropy alone is not significant.The reported p-values are 0.0020 versus entropy-only classification, 0.0078 versus SVM, and 0.2500 for the incremental improvement over entropy.Source: §VII · p. 5

VIII. CONCLUSION

On the full 3.59 million-flow CIC-DDoS2019 SYN benchmark, XAI-SDN reports near-perfect detection metrics while sustaining line-rate throughput and providing per-flow SHAP attributions. The authors propose extending evaluation to other attack vectors and adversarial evasion, and exploring multi-domain SDN topologies.

VIII. CONCLUSION

  • On 3.59 million CIC-DDoS2019 SYN flows, XAI-SDN achieves 99.9987% accuracy, 99.9621% macro F1-score, and 1.0000 AUC-ROC, with line-rate throughput and per-flow SHAP attributions.The authors identify evaluation across all CIC-DDoS2019 attack vectors, entropy-aware adversarial evasion, and multi-domain SDN topologies as future work.Source: §VIII · p. 5

Related papers

Loading 2609.05701v1…