A Simulation-Based SDN Framework for Cyberattack Detection and Traffic Management

Received: 12 September 2025 | Revised: 12 October 2025 and 25 October 2025 | Accepted: 29 October 2025 | Online: 8 December 2025
Corresponding author: Aboubakr Bajenaid

Abstract

Software-Defined Networking (SDN) enables centralized control and programmability, providing a promising foundation for intelligent traffic management and enhanced security. This paper proposes a simulation-based SDN framework that integrates multiple Machine Learning (ML) models to evaluate the effectiveness of cyberattack detection and to manage packet resilience through the analysis of metrics such as throughput, switch delay, controller response time, and security performance indicators. Experimental results demonstrate that the Decision Tree (DT) and Extreme Gradient Boosting (XGBoost) classifiers achieved higher throughput, whereas the Deep Neural Network (DNN) and Transformer models imposed greater computational overhead. In addition, the DT and Random Forest (RF) models showed an accuracy–responsiveness trade-off, with better throughput and less processing time. Experimental results demonstrate high classification accuracy, with DT, RF, and XGBoost achieving near-perfect detection rates, whereas DNN and Transformer models maintained competitive performance despite certain class-specific limitations. The F1-scores validate the robustness of these classifiers. Complementary SDN simulations assessed packet management efficiency, yielding a consistent packet drop rate of approximately 31–32%, throughput ranging from 7.55 to 9.79 packets/s, and average switch delays around 12 ms across models. The findings confirm that the suggested hybrid approach not only detects cyberattacks effectively but also maintains acceptable SDN performance under diverse traffic conditions.