Enhancing SDN Security and Availability with Blockchain and Dual-Layer Isolation Forest–Driven DDoS Detection

Abstract

Software-Defined Networking (SDN) improves network programmability and centralized control, yet it remains vulnerable to Distributed Denial-of-Service (DDoS) attacks, particularly those targeting SDN controllers and flow-table management. This paper proposes a double-layer DDoS defense framework that integrates consortium blockchain and machine learning to enhance security and reliability in SDN environments. The architecture deploys a Financial Blockchain Shenzhen Consortium (FISCO)-BCOS consortium blockchain at the controller's northbound interface to securely store and validate flow-table information through smart contracts. To strengthen control-plane resilience, a primary–secondary controller configuration (CM/MS) is introduced, where controllers synchronize validated flow rules via blockchain consensus and support seamless failover. DDoS mitigation is performed using a two-tier strategy: (i) a time-window frequency analysis of blockchain-recorded flow data combined with a token bucket mechanism to detect and limit high-rate flooding sources, and (ii) a composite feature selection process coupled with an Isolation Forest model to detect stealthy low-rate attacks. Experiments conducted on a Mininet-based SDN testbed using the CIC-DDoS2019 dataset demonstrate that the proposed framework achieves 92.29% detection accuracy while preserving stable network transmission behavior. Results indicate that blockchain-based flow validation and controller redundancy improve SDN security and reliability without measurable degradation in Round-Trip Time (RTT) performance.