A Survey of Supervised, Unsupervised, and Ensemble Learning Approaches for DDoS Detection in SDN

Software-Defined Networking (SDN) offers significant advantages in network management and scalability, but is vulnerable to security threats, particularly distributed denial-of-service (DDoS) attacks. These attacks can manipulate SDN flow tables and disrupt the network operations. This paper presents a comprehensive survey of supervised, unsupervised, and ensemble machine-learning techniques for DDoS detection in SDN. To the best of our knowledge, no previous study has provided such a detailed analysis within a single work. This study evaluates the effectiveness of various machine-learning models, focusing on their applications, benefits, and limitations in securing SDN environments. It reviews state-of-the-art methods and discusses performance metrics such as accuracy and computational complexity. The paper also identifies key research challenges and future directions for DDoS detection in SDN. The structure includes a review of related studies, a taxonomy of machine learning techniques, and a conclusion summarizing the findings and implications. © 2025 IEEE.