Klasifikasi Serangan DDOS Pada Arsitektur Software-Defined Network Menggunakan Stacked Ensemble Learning Berbasis Deep Neural Network

Abstract

Software-Defined Networking (SDN) architecture offers a flexible network management paradigm through the centralization of the control plane. However, this centralization creates a single point of failure that is highly vulnerable to Distributed Denial of Service (DDoS) attacks, particularly those originating from Internet of Things (IoT) botnets. Traditional intrusion detection systems are no longer sufficient to recognize modern attack tactics, while the implementation of Machine Learning and Deep Learning is often hampered by high rates of false positives that degrade the Quality of Service (QoS) for legitimate users. This research proposes the development of a two-tier stacked ensemble learning-based DDoS detection framework to classify traffic with precision. The preprocessing stage drastically reduces data dimensions by extracting the top five features using the Gini Importance metric (covering 71.9% of the information variance). The classification architecture then integrates Random Forest (RF) and Support Vector Machine (SVM) as base learners, along with a Deep Neural Network (DNN) as a meta-learner tasked with synthesizing probability distributions. Experimental results demonstrate superior model performance with Accuracy, Precision, Recall, and F1-Score of 99.97%, as well as an ROC-AUC value of 0.99999976. This architecture successfully achieved zero false negatives and generated only five false alarms out of 19,750 test samples. The main contributions of this research lie in the proposal of a multi-level Stacked Ensemble architecture to distribute the detection load, the application of feature dimension reduction to optimize computation while reducing the False Positive Rate, and empirical evidence of the model’s robustness in maintaining the stability of the SDN network controller without degrading QoS.