Hardware-Constrained Feature-Slicing Ensemble for Explainable DDoS Detection in Software-Defined Networks

Abstract

Software-Defined Networking (SDN) provides centralised network management but introduces a critical structural vulnerability because the controller is highly susceptible to Distributed Denial of Service (DDoS) attacks. While Machine Learning is widely utilised for Intrusion Detection Systems, traditional monolithic models often operate as opaque black boxes, rely on easily spoofed categorical features, and ignore the severe computational latency limits of centralised controllers. This paper proposes a novel, hardware-constrained Feature-Slicing Ensemble architecture for DDoS detection. We partition network data into two domain-specific subsets, namely Header Features and Flow Statistics, while deliberately excluding evasion-prone identifiers to prevent data leakage. Specialised, depth-constrained Random Forest base learners are trained on each subset to simulate controller CPU limitations, with predictions aggregated using a soft-voting mechanism. Evaluated on the InSDN dataset using 5-fold stratified cross-validation, our proposed model achieved an F1-Score of 0.9954. While maintaining strict statistical parity with unconstrained monolithic baselines, the decoupled architecture provides critical explainability, allowing network administrators to isolate structural anomalies from volumetric floods. This demonstrates that logical feature partitioning improves model modularity and real-world evasion resilience without sacrificing predictive precision.