Fast Entropy Quantile Forest for Federated Distributed Denial of Service Detection in Software-Defined Networking Environments

Distributed Denial of Service (DDoS) detection in Software-Defined Networking (SDN) faces challenges related to scalability, privacy, and the bursty traffic patterns typical in these environments. This paper proposes the Fast Entropy Quantile Forest (FEQF), a novel federated tree construction model designed to enhance the detection of DDoS
attacks. By replacing traditional impurity measures with a fast entropy metric and utilizing quantile-based feature splitting, the FEQF improves resilience and performance under
challenging conditions. The model was evaluated using the Mendeley DDoS attack SDN
dataset in a federated learning framework. Compared to federated Random Forest (RF)
and Extra Trees Classifier (ETC), the FEQF outperforms them with a global accuracy of
97%, significantly lower aggregation risk, and an F1-score exceeding 0.95 under a severe
class imbalance (1:100). Furthermore, in bursty client simulations, FEQF maintained
stability, with the weakest client achieving an F1-score of 0.93. These results demonstrate
the robustness of the FEQF in dynamic SDN environments and its potential as a scalable
solution for DDoS detection.