In-Network Security Framework for Detecting and Classifying DDoS Attacks

H. Ahmed, Azza, Rukh, Mah ORCID: https://orcid.org/0000-0001-7660-1150 and Arsalaan, Ameer Shakayb (2026) In-Network Security Framework for Detecting and Classifying DDoS Attacks. IEEE Access. p. 1. doi:10.1109/ACCESS.2026.3745922 (In Press)

Preview

Text (Published version (Early view)) 16601 Rukh (2026) In-network security framework for detecting.pdf - Published Version Available under License Creative Commons Attribution 4.0. Download (1MB) | Preview

Abstract

The rapid proliferation of resource-constrained Internet of Things (IoT) devices has significantly expanded the network attack surface, increasing vulnerability to Distributed Denial of Service (DDoS) attacks. Existing programmable data-plane defenses either detect malicious flows without attributing the specific attack type, or achieve fine-grained attribution only through control-plane processing that reintroduces the latency in-network defenses aim to avoid. This paper introduces SecFlow, a dual-stage defense framework that performs real-time DDoS detection directly in the P4 data plane and attributes the specific attack type at a backend server, covering nine subtypes spanning volumetric, protocol-based, and application-layer attacks, enabling rapid, precise updates to switch-level mitigation rules. Evaluated on the CICIoT2023 dataset, the recommended TCP- and UDP-specific decision-tree detectors achieve flow-level accuracy of up to 99% for TCP and a perfect flow-level true-negative rate with 86% true-positive rate for UDP. A lightweight ResNet-based backend classifier attributes nine attack types with macro-F1 0.88 (weighted accuracy 95%). Performance is weakest for application-layer attacks (HTTP Flood F1 = 0.43; Slowloris F1 = 0.86), which overlap in feature space; volumetric and protocol-based F1 range 0.95–1.00 and 0.82–0.99. In a separate, harmonized comparison against four representative in-network and hybrid DDoS detectors on a common Docker-based P4 testbed – using a coarser traffic grouping needed for fair cross-system evaluation – SecFlow is the only system that sustains strong flow accuracy (≥0.86) on both benign and malicious traffic across every evaluated category, while operating at the second-lowest memory footprint and among the lowest CPU usage of the five systems tested; every comparative system exhibits a severe accuracy collapse on at least one category, including benign traffic in one case. Implemented on Mininet with software P4 switches, SecFlow avoids the 3.72 ms median round-trip delay a controller-based baseline requires for every packet, reducing detection latency by one to two orders of magnitude, while cutting controller-bound link load by up to 67% relative to that baseline at a modest resource cost on the classifying switch itself. Together, these results show that fine-grained, per-attack-type DDoS defense is achievable at the data plane without sacrificing the responsiveness that motivates in-network detection in the first place.

Item Type:	Article
Article Type:	Article
Subjects:	Q Science > Q Science (General) > Q336 Artificial intelligence Q Science > QA Mathematics > QA76 Computer software > QA76.758 Software engineering
Divisions:	Schools and Research Institutes > School of Business, Computing and Social Sciences
Depositing User:	Mah Rukh
Date Deposited:	28 Oct 2026 09:28
Last Modified:	28 Oct 2026 09:45
URI:	https://eprints.glos.ac.uk/id/eprint/16601

University Staff: Request a correction | Repository Editors: Update this record