A Self-Organizing Map with Temporal Aggregation for DDoS Detection in SDN

This paper proposes "SOM-TAD", a DDoS detection and mitigation framework for Software-Defined Networking (SDN) based on unsupervised learning and temporal anomaly modeling. The architecture extends SDN with Management and Knowledge Planes, decoupling data processing, inference, and control. Self-Organizing Maps (SOM), trained on benign traffic, model normal behavior using statistically normalized quantization error. A multi-resolution ensemble and temporal evidence aggregation improve robustness against distributed and low-rate attacks. The system operates consistently in offline and real-time modes and integrates with an event-driven SDN controller for autonomous mitigation. Experimental results demonstrate high separability and effective detection of multi-vector DDoS attacks.