How b1rh0ut/sdn-ml-ddos-mitigation works
This is an SDN-based DDoS detection and mitigation system: a Ryu controller polls switch flow statistics, applies a threshold fast path and ML classification, then installs network-wide blocking rules. The repository also supports topology provisioning, training/evaluation from real or synthetic datasets, and operational monitoring. Runtime controller details are only partially sampled; major additional capabilities and their broad module paths are retained from the README and tree, with uncertain call wiring omitted.
Main entry points: ddos_controller.py Ryu controller · train.py Model training · topology.py Spine-leaf topology · api_auth.py Bearer authentication
Components 23
Network fabric
- OpenFlow switches
- Spine-leaf topology
src/sdn_ddos_detector/topology/topology.py - Normal traffic generator
src/sdn_ddos_detector/traffic/generate_normal.py - Attack traffic
src/sdn_ddos_detector/traffic/attack_generator.sh
Detection and control
- Ryu controller
src/sdn_ddos_detector/controller/ddos_controller.py - Bearer authentication
src/sdn_ddos_detector/controller/api_auth.py - Flow features
src/sdn_ddos_detector/ml/feature_engineering.py - Threshold fast path
src/sdn_ddos_detector/controller/ddos_controller.py - RF inference
src/sdn_ddos_detector/controller/ddos_controller.py - Circuit breaker
src/sdn_ddos_detector/ml/circuit_breaker.py - Drift detection
src/sdn_ddos_detector/ml/drift_detector.py - Network mitigation
src/sdn_ddos_detector/controller/ddos_controller.py
ML data lifecycle
- Dataset sources
src/sdn_ddos_detector/datasets - Dataset adapters
src/sdn_ddos_detector/ml/dataset_adapters - Synthetic data
src/sdn_ddos_detector/ml/generate_synthetic_dataset.py - Model training
src/sdn_ddos_detector/ml/train.py - Model evaluation
src/sdn_ddos_detector/ml/evaluation.py - Flow data collection
src/sdn_ddos_detector/utils/dataset_collector.py
Operations
- Performance monitor
src/sdn_ddos_detector/utils/performance_monitor.py - Controller configuration
src/sdn_ddos_detector/config/ryu.conf
Other components
- Network operator
- Network traffic
- REST API client
Connections 27
- Network operator → Spine-leaf topology: starts network
- Spine-leaf topology → OpenFlow switches: creates fabric
- Network traffic → OpenFlow switches: sends traffic
- Normal traffic generator → OpenFlow switches: generates traffic
- Attack traffic → OpenFlow switches: generates attacks
- OpenFlow switches → Ryu controller: flow statistics
- Ryu controller → OpenFlow switches: polls statistics
- Ryu controller → Flow features: extracts features
- Ryu controller → Threshold fast path: checks rates
- Ryu controller → RF inference: classifies batches
- Ryu controller → Circuit breaker: guards inference
- Ryu controller → Drift detection: monitors drift
- Ryu controller → Network mitigation: dispatches blocks
- Network mitigation → OpenFlow switches: installs DROP rules
- Ryu controller → Flow data collection: records flows
- REST API client → Bearer authentication: sends requests
- Bearer authentication → Ryu controller: authorizes access
- Network operator → Dataset sources: obtains datasets
- Dataset sources → Dataset adapters: provides files
- Dataset adapters → Model training: maps features
- Synthetic data → Model training: provides samples
- Model training → RF inference: produces model
- Model training → Model evaluation: supplies model
- Flow features → Model training: defines schema
- Network operator → Performance monitor: runs monitoring
- Performance monitor → OpenFlow switches: queries flow state
- Controller configuration → Ryu controller: configures behavior