SAE-CNN-LSTM-based anomaly detection and mitigation framework for cloud-centric SDN environments

Abstract

The advent of Software-Defined Networking (SDN) has transformed the landscape of cloud network management by decoupling the control and data planes, enabling centralized programmability and dynamic policy enforcement. However, this paradigm shift introduces new challenges for real-time anomaly detection and DDoS mitigation. This paper proposes an intelligent anomaly mitigation framework that leverages deep learning techniques—specifically Sparse Autoencoders (SAE) for feature extraction and a hybrid CNN-LSTM model for capturing both spatial and temporal traffic anomalies. The system is implemented and evaluated using Python 3.9 with TensorFlow 2.x on a Ryu SDN controller integrated with OpenFlow-based switches in Mininet. Experiments are conducted across various SDN topologies including Star, Mesh, Tree, and Random configurations. Benchmark datasets CIC-DDoS2019 and UNSW-NB15 are used for model training and validation. The proposed framework achieves 99.1% detection accuracy, a 30% improvement in false positive rate over traditional methods, and reduces mitigation time by up to 40%, confirming its suitability for real-time deployment in dynamic SDN environments.