Open Access

ARTICLE

SDN-Enabled IoT Based Transport Layer DDoS Attacks Detection Using RNNs

Mohammad Nowsin Amin Sheikh^1,2,*, Muhammad Saibtain Raza¹, I-Shyan Hwang^1,*, Md. Alamgir Hossain³, Ihsan Ullah¹, Tahmid Hasan⁴, Mohammad Syuhaimi Ab-Rahman⁵

1 Department of Computer Science and Engineering, Yuan Ze University, Taoyuan, 32003, Taiwan
2 Department of Computer Science and Engineering, Jashore University of Science and Technology, Jashore, 7408, Bangladesh
3 Department of Computer Science and Engineering, State University of Bangladesh, South Purbachal, Kanchan, Dhaka, 1461, Bangladesh
4 Department of Computer Science and Engineering, Prime University, Dhaka, 1216, Bangladesh
5 Electrical and Electronic Engineering Department, Universiti Kebangsaan Malaysia, Bangi, 43600, Malaysia

* Corresponding Authors: Mohammad Nowsin Amin Sheikh. Email: ; I-Shyan Hwang. Email:

Computers, Materials & Continua 2025, 85(2), 4043-4066. https://doi.org/10.32604/cmc.2025.065850

Received 23 March 2025; Accepted 14 August 2025; Issue published 23 September 2025

Abstract

The rapid advancement of the Internet of Things (IoT) has heightened the importance of security, with a notable increase in Distributed Denial-of-Service (DDoS) attacks targeting IoT devices. Network security specialists face the challenge of producing systems to identify and offset these attacks. This research manages IoT security through the emerging Software-Defined Networking (SDN) standard by developing a unified framework (RNN-RYU). We thoroughly assess multiple deep learning frameworks, including Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), Feed-Forward Convolutional Neural Network (FFCNN), and Recurrent Neural Network (RNN), and present the novel usage of Synthetic Minority Over-Sampling Technique (SMOTE) tailored for IoT-SDN contexts to manage class imbalance during training and enhance performance metrics. Our research has significant practical implications as we authenticate the approache using both the self-generated SD_IoT_Smart_City dataset and the publicly available CICIoT23 dataset. The system utilizes only eleven features to identify DDoS attacks efficiently. Results indicate that the RNN can reliably and precisely differentiate between DDoS traffic and benign traffic by easily identifying temporal relationships and sequences in the data.

---

Keywords

---