Analisis Kinerja dan Interpretabilitas Multilayer Perceptron untuk Deteksi Serangan DDoS pada Software-Defined Networking

David Suharjanto, Muhammad Taufiq Nuruzzaman

Abstract

Abstrak : 

Penelitian ini menganalisis kinerja dan interpretabilitas model Multilayer Perceptron (MLP) untuk mendeteksi serangan Distributed Denial of Service (DDoS) pada arsitektur Software-Defined Networking (SDN). Analisis kinerja dilakukan dengan mengevaluasi berbagai kedalaman lapisan dan jumlah neuron pada arsitektur MLP menggunakan dataset publik DDos attack SDN, sementara metode SHapley Additive exPlanations (SHAP) digunakan untuk mengidentifikasi fitur dominan yang memengaruhi keputusan model. Hasil eksperimen menunjukkan bahwa arsitektur MLP tiga lapisan dengan konfigurasi funneling (256–128–32) memberikan kinerja terbaik, mencapai akurasi 99,84% dan F1-score 99,80%, serta menunjukkan bahwa efektivitas optimasi jumlah layer dan neuron dalam meningkatkan performa deteksi dibandingkan penelitian terdahulu. Analisis SHAP mengungkapkan bahwa pktcount, pktrate, dan pktperflow merupakan fitur paling dominan dalam mendeteksi serangan DDoS.  Penelitian ini mengombinasikan analisis arsitektur dan interpretabilitas berbasis SHAP untuk meningkatkan transparansi keputusan model pada keamanan jaringan SDN

=============================================

Abstract : 

This study investigates the performance and interpretability of Multilayer Perceptron (MLP) models for Distributed Denial of Service (DDoS) attack detection in Software-Defined Networking (SDN) environments. Performance analysis was conducted by comprehensively evaluating variations in layer depth and neuron count across MLP architectures using a public DDoS attack SDN dataset, while SHapley Additive exPlanations (SHAP) were applied to identify dominant features influencing the model's decision-making process. The results show that a three-layer MLP architecture with a funneling configuration (256–128–32) achieves the best performance, with an accuracy of 99.84% and an F1-score of 99.80%, demonstrating the effectiveness of optimizing the number of layers and neurons in improving detection performance compared to previous studies. SHAP analysis further reveals that pktcount, pktrate, and pktperflow are the most dominant features in DDoS attack detection. This study combines architectural analysis and SHAP-based interpretability to enhance the transparency of model decision-making in SDN network security.

Keywords

DDoS; SDN; Multilayer Perceptron; Analisis Performa; Interpretabilitas Model

Full Text:

PDF

References

[1] U. B. Clinton, N. Hoque, and K. Robindro Singh, “Classification of DDoS attack traffic on SDN network environment using deep learning,” Cybersecurity, vol. 7, no. 1, 2024, doi: 10.1186/s42400-024-00219-7.

[2] L. Tan, Y. Pan, J. Wu, J. Zhou, H. Jiang, and Y. Deng, “A New Framework for DDoS Attack Detection and Defense in SDN Environment,” IEEE Access, vol. 8, pp. 161908–161919, 2020, doi: 10.1109/ACCESS.2020.3021435.

[3] N. S. Shaji and R. Muthalagu, “Survey on security aspects of distributed software-defined networking controllers in an enterprise SD-WLAN,” Digital Communications and Networks, vol. 10, no. 6, pp. 1716–1731, 2024, doi: https://doi.org/10.1016/j.dcan.2023.09.004.

[4] N. M. Kaliyamurthy, S. Taterh, S. Shanmugasundaram, A. Saxena, O. Cheikhrouhou, and H. Ben Elhadj, “Software-Defined Networking: An Evolving Network Architecture - Programmability and Security Perspective,” Security and Communication Networks, vol. 2021, 2021, doi: 10.1155/2021/9971705.

[5] W. Hill et al., “DDoS in SDN: a review of open datasets, attack vectors and mitigation strategies,” Discover Applied Sciences, vol. 6, no. 9, p. 472, 2024, doi: 10.1007/s42452-024-06172-x.

[6] J. Ye, X. Cheng, J. Zhu, L. Feng, and L. Song, “A DDoS Attack Detection Method Based on SVM in Software Defined Network,” Security and Communication Networks, vol. 2018, no. 1, p. 9804061, 2018, doi: https://doi.org/10.1155/2018/9804061.

[7] V. Deepa, K. M. Sudar, and P. Deepalakshmi, “Detection of DDoS Attack on SDN Control plane using Hybrid Machine Learning Techniques,” in 2018 International Conference on Smart Systems and Inventive Technology (ICSSIT), 2018, pp. 299–303. doi: 10.1109/ICSSIT.2018.8748836.

[8] M. Myint Oo, S. Kamolphiwong, T. Kamolphiwong, and S. Vasupongayya, “Advanced Support Vector Machine- (ASVM-) Based Detection for Distributed Denial of Service (DDoS) Attack on Software Defined Networking (SDN),” Journal of Computer Networks and Communications, vol. 2019, no. 1, p. 8012568, 2019, doi: https://doi.org/10.1155/2019/8012568.

[9] S. Dong and M. Sarem, “DDoS Attack Detection Method Based on Improved KNN With the Degree of DDoS Attack in Software-Defined Networks,” IEEE Access, vol. 8, pp. 5039–5048, 2020, doi: 10.1109/ACCESS.2019.2963077.

[10] K. M. Sudar, M. Beulah, P. Deepalakshmi, P. Nagaraj, and P. Chinnasamy, “Detection of Distributed Denial of Service Attacks in SDN using Machine learning techniques,” in 2021 International Conference on Computer Communication and Informatics (ICCCI), 2021, pp. 1–5. doi: 10.1109/ICCCI50826.2021.9402517.

[11] N. Ahuja, G. Singal, D. Mukhopadhyay, and N. Kumar, “Automated DDOS attack detection in software defined networking,” Journal of Network and Computer Applications, vol. 187, p. 103108, 2021, doi: https://doi.org/10.1016/j.jnca.2021.103108.

[12] H. Rahman and T. Sutabri, “Analysis DDoS Attack Using Machine Learning On Software-Defined Network Architectures,” Jurnal Sistem dan Informatika (JSAI), vol. 7, no. 3, Nov. 2024, doi: 10.36085/jsai.v7i3.7301.

[13] S. Ahmed et al., “Effective and Efficient DDoS Attack Detection Using Deep Learning Algorithm, Multi-Layer Perceptron,” Future Internet, vol. 15, no. 2, 2023, doi: 10.3390/fi15020076.

[14] W.-W. Tay, S.-C. Chong, and L.-Y. Chong, “DDoS Attack Detection with Machine Learning,” Journal of Informatics and Web Engineering, vol. 3, no. 3, pp. 190–207, 2024, doi: 10.33093/jiwe.2024.3.3.12.

[15] A. Sanmorino, L. Marnisah, and H. D. Kesuma, “Detection of DDoS Attacks using Fine-Tuned Multi-Layer Perceptron Models,” Engineering, Technology & Applied Science Research, vol. 14, no. 5, pp. 16444–16449, 2024, doi: 10.48084/etasr.8362.

[16] M. Wang, Y. Lu, and J. Qin, “A dynamic MLP-based DDoS attack detection method using feature selection and feedback,” Comput. Secur., vol. 88, p. 101645, 2020, doi: https://doi.org/10.1016/j.cose.2019.101645.

[17] P. Prasad, M. Tahir, and J. Isoaho, “Enhancing Explainability of Artificial Intelligence for Threat Detection in SDN-based Multicast Systems,” Procedia Comput. Sci., vol. 257, pp. 569–574, 2025, doi: https://doi.org/10.1016/j.procs.2025.03.073.

[18] M. A. Setitra, M. Fan, B. L. Y. Agbley, and Z. E. A. Bensalem, “Optimized MLP-CNN Model to Enhance Detecting DDoS Attacks in SDN Environment,” Network, vol. 3, no. 4, pp. 538–562, 2023, doi: 10.3390/network3040024.

[19] N. Ahuja, G. Singal, and D. Mukhopadhyay, “DDOS attack SDN Dataset,” 2020, Mendeley Data. doi: 10.17632/jxpfjc64kr.1.

[20] S. Alam, M. S. Ayub, S. Arora, and M. A. Khan, “An investigation of the imputation techniques for missing values in ordinal data enhancing clustering and classification analysis validity,” Decision Analytics Journal, vol. 9, p. 100341, 2023, doi: https://doi.org/10.1016/j.dajour.2023.100341.

[21] Q. Zhao, F. Wang, W. Wang, T. Zhang, H. Wu, and W. Ning, “Research on intrusion detection model based on improved MLP algorithm,” Sci. Rep., vol. 15, no. 1, p. 5159, 2025, doi: 10.1038/s41598-025-89798-0.

[22] V. Borisov, T. Leemann, K. Seßler, J. Haug, M. Pawelczyk, and G. Kasneci, “Deep Neural Networks and Tabular Data: A Survey,” IEEE Trans. Neural Netw. Learn. Syst., vol. 35, no. 6, pp. 7499–7519, 2024, doi: 10.1109/TNNLS.2022.3229161.

[23] A. Sanmorino, L. Marnisah, and H. Di Kesuma, “Detection of DDoS Attacks using Fine-Tuned Multi-Layer Perceptron Models,” Engineering, Technology & Applied Science Research, vol. 14, no. 5, pp. 16444–16449, Oct. 2024, doi: 10.48084/etasr.8362.

[24] S. Wang et al., “Detecting flooding DDoS attacks in software defined networks using supervised learning techniques,” Engineering Science and Technology, an International Journal, vol. 35, p. 101176, 2022, doi: https://doi.org/10.1016/j.jestch.2022.101176.

DOI: https://doi.org/10.20961/ijai.v10i2.117099

Refbacks

  • There are currently no refbacks.