Intelligent Detection and Mitigation of Carpet-Bombing DDoS Attacks in SDN Using Retrieval-Augmented Generation and Large Language Models

Technical Summary: Intelligent Detection and Mitigation of Carpet-Bombing DDoS Attacks in SDN Using Retrieval-Augmented Generation and Large Language Models

Problem Statement
Software-Defined Networking (SDN) offers flexible network management but remains vulnerable to Distributed Denial-of-Service (DDoS) attacks due to its centralized control architecture. A specific and challenging variant, the "Carpet-Bombing" DDoS attack, distributes malicious traffic across multiple targets simultaneously using diverse protocols. Unlike traditional attacks that overwhelm a single victim, Carpet-Bombing attacks cause individual traffic flows to appear legitimate or low-volume when analyzed in isolation, evading conventional detection mechanisms that rely on high-volume anomalies or specific signatures. Existing solutions often depend on supervised machine learning or deep learning models requiring extensive labeled datasets, periodic retraining, and fine-tuning, which limits adaptability in dynamic SDN environments. Furthermore, few studies address the specific interaction between control and data planes in SDN during Carpet-Bombing scenarios or provide real-time mitigation at the source interface.

Methodology
The paper proposes a Retrieval-Augmented Generation (RAG)-based framework designed for real-time detection and mitigation of Carpet-Bombing DDoS attacks without conventional supervised model training. The methodology operates through the following stages:

1. Feature Extraction and Representation: The SDN controller periodically queries OpenFlow switches (every 10 seconds) to collect interface-level traffic statistics (e.g., packets/bytes received/sent, rates, and average sizes). Two traffic representation strategies are investigated:
   • Structured JSON-based: Organizes features into standardized key-value pairs to preserve structural relationships.
   • Natural Language-based (NLR): Converts statistics into descriptive text sentences for semantic interpretation.
2. RAG Architecture:
   • Retrieval Dataset: The dataset is split into 80% retrieval (contextual knowledge) and 20% testing. Samples are indexed separately for benign and attack classes.
   • Embedding and Indexing: Traffic representations are converted into dense vector embeddings using the paraphrase-MiniLM-L6-v2 model. These vectors are indexed using the FAISS (Facebook AI Similarity Search) framework for efficient similarity search.
   • Inference Process: For a new traffic query, the system retrieves the top three semantically similar benign samples and top three attack samples from the FAISS indices.
   • LLM Classification: The retrieved context and the target query are combined into a structured prompt and fed to a Large Language Model (LLM). The LLM performs contextual inference to classify the traffic as benign (0) or attack (1) without prior fine-tuning.
3. Real-Time Mitigation: Upon detecting an attack, the SDN controller immediately installs OpenFlow drop rules at the source interface to block malicious traffic. A recovery mechanism re-enables the interface after a 40-second inactivity period to prevent permanent blocking.

Key Contributions
The authors identify five primary contributions:

1. Proposal of a novel RAG-based framework for real-time Carpet-Bombing DDoS detection in SDN that eliminates the need for conventional supervised training or retraining.
2. Utilization of interface-level traffic features to identify distributed attack patterns at the source, enabling early detection before traffic spreads across the infrastructure.
3. Investigation and comparison of two traffic representation strategies (Structured JSON vs. Natural Language) to determine their impact on detection performance.
4. Extensive experimental evaluation using multiple state-of-the-art LLMs under realistic Carpet-Bombing scenarios with varying attack intensities.
5. Demonstration of the framework's ability to achieve high detection accuracy while effectively mitigating attacks and maintaining stable SDN operations in real-time.

Results
Experiments were conducted using a Mininet-based SDN topology with the Ryu controller, utilizing the Gemma-4-31B-IT model as the primary inference engine.

• Detection Performance: The framework achieved exceptional accuracy. Using the structured JSON representation, the Gemma-4-31B-IT model attained 99.94% accuracy, 99.92% precision, 99.93% recall, and a 99.93% F1-score. The Natural Language representation yielded similar results (99.93% accuracy).
• Model Comparison: Among various tested LLMs (including Grok-4.1-fast, DeepSeek-v3.2, Llama-3.1-70B, and GPT-4o-mini), the Gemma-4-31B-IT configuration consistently delivered the strongest overall detection performance.
• Real-Time Mitigation: Real-time experiments across four attack intensity scenarios (ranging from 20,000 to 100,000 packets per second) demonstrated that the framework rapidly reduced SDN controller CPU utilization, Packet-In message rates, and network congestion upon activation. The system successfully stabilized network operations within seconds of attack detection.
• Representation Analysis: The structured JSON-based representation generally provided more stable and consistent classification results compared to the Natural Language-based approach, likely due to reduced semantic ambiguity.

Significance and Claims
The paper claims that the proposed framework addresses critical gaps in current SDN security by offering an adaptive, training-free solution specifically tailored for the stealthy, distributed nature of Carpet-Bombing attacks. By integrating RAG mechanisms with LLMs, the system leverages semantic retrieval to understand traffic behavior without relying on static signatures or computationally expensive retraining. The authors highlight that their approach is distinct from existing literature as it combines interface-level monitoring, retrieval-augmented analysis, and real-time source mitigation within an SDN-specific environment. The results suggest that this architecture provides a highly effective, intelligent, and scalable method for defending against sophisticated DDoS threats in modern network infrastructures.