FL-NDR: A Federated Unlearning-Driven Network Detection and Response System for DDoS Defence in Software-Defined Networks

Software Defined Networking (SDN) gives us a programmable network where a controller makes all the forwarding decisions. This is powerful for automation, but it also
means one point in the network becomes a target. If someone takes the controller offline with a Distributed Denial of Service (DDoS) attack, the entire network could go down.
Machine learning classifiers can detect these attacks from edge devices, but training a centralised model means sharing raw traffic from all domains-which often leads to
capacity and privacy problems. Federated Learning (FL) technique solves this issue: each domain trains locally and sends only model updates to a server, which combines them into a global model. No raw traffic leaves any domain. The problem is that a compromised domain can send manipulated updates to quietly reduce the model's ability to detect
attacks. Even after we discover the bad client and remove it, its past updates are already mixed into the model. This is called model poisoning, and federated unlearning is the
process of removing that influence. This paper introduces Federated Unlearning NetworkDetection and Response (FL-NDR). It treats every OpenFlow switch in the network as a
sensor. Together, all the switches in the fabric form a distributed sensor layer that feeds
data into a federated DDoS detection system. When a poisoned client is found, FL-NDR
does two things at once: it rolls back the global model to a clean checkpoint, and it tells
the SDN controller to block the compromised domain using OpenFlow flow rules. We
validate this through an SDN simulation and through six experimental scenarios (S1-S6)
on the Mendeley SDN DDoS dataset. The best configuration-rapid retraining from a pre-
poisoning checkpoint with client quarantine (S6)-recovers detection accuracy to 98.81%, matching the clean baseline. The results show that network-level isolation and model-
level unlearning must be used together. Neither works on its own.