Collaborative P4-SDN DDoS Detection and Mitigation with Early-Exit Neural Networks
It addresses the need for timely and scalable DDoS defense in programmable networks, but the approach is incremental as it combines existing techniques (early-exit, P4, SDN).
The paper proposes a collaborative P4-SDN architecture using a split early-exit neural network (quantized CNN in data plane, GRU in control plane) for real-time DDoS detection and mitigation, achieving high accuracy with reduced latency and control plane overhead.
Distributed Denial of Service (DDoS) attacks pose a persistent threat to network security, requiring timely and scalable mitigation strategies. In this paper, we propose a novel collaborative architecture that integrates a P4-programmable data plane with an SDN control plane to enable real-time DDoS detection and response. At the core of our approach is a split early-exit neural network that performs partial inference in the data plane using a quantized Convolutional Neural Network (CNN), while deferring uncertain cases to a Gated Recurrent Unit (GRU) module in the control plane. This design enables high-speed classification at line rate with the ability to escalate more complex flows for deeper analysis. Experimental evaluation using real-world DDoS datasets demonstrates that our approach achieves high detection accuracy with significantly reduced inference latency and control plane overhead. These results highlight the potential of tightly coupled ML-P4-SDN systems for efficient, adaptive, and low-latency DDoS defense.