A SYSTEMATIC TERTIARY STUDY OF DEEP LEARNING FOR INTRUSION DETECTION IN SOFTWARE-DEFINED NETWORKS
DOI:
https://doi.org/10.33003/fjs-2025-0912-4261Keywords:
Software-Defined Networking, Intrusion Detection Systems, Deep Learning, Tertiary Review, DDoS Attacks, Machine Learning, Network SecurityAbstract
Deep learning (DL) has emerged as a transformative approach to enhancing Intrusion Detection Systems (IDS) in Software-Defined Networking (SDN), enabling advanced detection of evolving and sophisticated cyber threats. Over the past few years, numerous secondary studies have reviewed the application of DL and other machine learning techniques for SDN security; however, no comprehensive tertiary study has systematically synthesized these reviews to identify overarching patterns, methodological gaps, and future research priorities. This paper addresses this gap by conducting a structured review of reviews published between 2019 and 2025, focusing exclusively on DL-based IDS within SDN environments. A total of 39 review and survey papers were analyzed across major scholarly databases, including IEEE Xplore, SpringerLink, ScienceDirect, and MDPI. The study consolidates insights on SDN security challenges, datasets, evaluation metrics, and prevalent DL models while critically highlighting persistent issues such as reliance on outdated datasets, lack of real-world validation, and limited exploration of low-rate and cross-domain attack scenarios. By mapping trends and identifying underexplored directions such as federated learning, adaptive multi-controller architectures, and SDN-IoT integrations, this work serves as a roadmap for researchers and practitioners seeking to design robust, scalable, and context-aware IDS solutions for next-generation SDN environments.
References
Ahmed, A. A., Aliyu, A. A., Ibrahim, M., Abdulkadir, S., Ahmad, M. A., Tanko, S. A., & Umaru, I. A. (2024). Enhancing Network Security Through Integrated Deep Learning Architectures And Attention Mechanisms. Fudma Journal Of Sciences, 8(6), 407–415. https://doi.org/10.33003/fjs-2024-0806-3010
Ahmed, N., Ngadi, A. Bin, Sharif, J. M., Hussain, S., Uddin, M., Rathore, M. S., Iqbal, J., Abdelhaq, M., Alsaqour, R., Ullah, S. S., & Zuhra, F. T. (2022). Network Threat Detection Using Machine/Deep Learning in SDN-Based Platforms: A Comprehensive Analysis of State-of-the-Art Solutions, Discussion, Challenges, and Future Research Direction. In Sensors (Basel, Switzerland) (Vol. 22, Issue 20). NLM (Medline). https://doi.org/10.3390/s22207896
Ajiya Ahmad, A., Boukari, S., Musa Bello, A., & Aliyu Muhammad, M. (2021). A Survey of Intrusion Detection Techniques on Software Defined Networking (SDN). International Journal of Innovative Science and Research Technology, 6(8), 521–533. www.ijisrt.com
ALASALI, T., & DAKKAK, O. (2023). EXPLORING THE LANDSCAPE OF SDN-BASED DDOS DEFENSE: A HOLISTIC EXAMINATION OF DETECTION AND MITIGATION APPROACHES, RESEARCH GAPS AND PROMISING AVENUES FOR FUTURE EXPLORATION. International Journal of Advanced Natural Sciences and Engineering Researches, 7(4), 327–349. https://doi.org/10.59287/ijanser.726
Alashhab, A. A., Zahid, M. S. M., Azim, M. A., Daha, M. Y., Isyaku, B., & Ali, S. (2022). A Survey of Low Rate DDoS Detection Techniques Based on Machine Learning in Software-Defined Networks. In Symmetry (Vol. 14, Issue 8). MDPI. https://doi.org/10.3390/sym14081563
Aldweesh, A., Derhab, A., & Emam, A. Z. (2020). Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues. Knowledge-Based Systems, 189, 105124. https://doi.org/10.1016/j.knosys.2019.105124
Ali, T. E., Chong, Y. W., & Manickam, S. (2023a). Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN. Applied Sciences (Switzerland), 13(5). https://doi.org/10.3390/app13053033
Ali, T. E., Chong, Y. W., & Manickam, S. (2023b). Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review. Applied Sciences (Switzerland), 13(5). https://doi.org/10.3390/app13053183
Al-Mi’ani, N., Anbar, M., Sanjalawe, Y., & Karuppayah, S. (2021). Securing Software Defined Networking Using Intrusion Detection System - A Review. Communications in Computer and Information Science, 1487 CCIS, 417–446. https://doi.org/10.1007/978-981-16-8059-5_26
Al-Selwi, S. M., Hassan, M. F., Abdulkadir, S. J., Muneer, A., Sumiea, E. H., Alqushaibi, A., & Ragab, M. G. (2024). RNN-LSTM: From applications to modeling techniques and beyond—Systematic review. Journal of King Saud University - Computer and Information Sciences, 36(5), 102068. https://doi.org/https://doi.org/10.1016/j.jksuci.2024.102068
Arevalo Herrera, J., & Camargo, J. E. (2019). A Survey on Machine Learning Applications for Software Defined Network Security. In International Conference on Applied Cryptography and Network Security (pp. 70–93). Springer. https://doi.org/10.1007/978-3-030-29729-9_4
Arevalo Herrera Juliana and Camargo, J. E. (2019). A Survey on Machine Learning Applications for Software Defined Network Security. In R. and L. Z. and M. S. and M. W. and W. L. and Z. K. Zhou Jianying and Deng (Ed.), Applied Cryptography and Network Security Workshops (pp. 70–93). Springer International Publishing.
Aslam, N., Srivastava, S., & Gore, M. M. (2024). A Comprehensive Analysis of Machine Learning- and Deep Learning-Based Solutions for DDoS Attack Detection in SDN. Arabian Journal for Science and Engineering, 49(3), 3533–3573. https://doi.org/10.1007/s13369-023-08075-2
Babayigit, B., Ulu, B., & Abubaker, M. (2023). Survey Studies of Software-Defined Networking: A Systematic Review and Meta-analysis. In Engineering Journal (Vol. 27, Issue 10, pp. 33–66). Chulalongkorn University, Faculty of Fine and Applied Arts. https://doi.org/10.4186/ej.2023.27.10.33
Bahashwan, A. A., Anbar, M., Manickam, S., Al-Amiedy, T. A., Aladaileh, M. A., & Hasbullah, I. H. (2023). A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking. In Sensors (Vol. 23, Issue 9). MDPI. https://doi.org/10.3390/s23094441
Benzekki, K., El Fergougui, A., & Elbelrhiti Elalaoui, A. (2016). Software‐defined networking (SDN): a survey. Security and Communication Networks, 9(18), 5803–5833. https://doi.org/10.1002/sec.1737
Bhuiyan, Z. A., Islam, S., Islam, Md. M., Ullah, A. B. M. A., Naz, F., & Rahman, M. S. (2023). On the (in)Security of the Control Plane of SDN Architecture: A Survey. IEEE Access, 11, 91550–91582. https://doi.org/10.1109/ACCESS.2023.3307467
Boruah, M. S., & Sarmah, S. (2025). A Review on Detection and Mitigation Strategies of DDoS Attack in SDN Environment using Machine Learning and Deep Learning. Proceedings of 2025 3rd International Conference on Intelligent Systems, Advanced Computing, and Communication, ISACC 2025, 754–761. https://doi.org/10.1109/ISACC65211.2025.10969352
Chetouane, A., & Karoui, K. (2022). A Survey of Machine Learning Methods for DDoS Threats Detection Against SDN (I. Jemili & M. Mosbah, Eds.; Vol. 1564, pp. 99–127). Springer International Publishing. https://doi.org/10.1007/978-3-030-99004-6_6
Cui, Y., Qian, Q., Guo, C., Shen, G., Tian, Y., Xing, H., & Yan, L. (2021). Towards DDoS detection mechanisms in Software-Defined Networking. In Journal of Network and Computer Applications (Vol. 190). Academic Press. https://doi.org/10.1016/j.jnca.2021.103156
da Silva Ruffo, V. G., Brandão Lent, D. M., Komarchesqui, M., Schiavon, V. F., de Assis, M. V. O., Carvalho, L. F., & Proença, M. L. (2024). Anomaly and intrusion detection using deep learning for software-defined networks: A survey. Expert Systems with Applications, 256. https://doi.org/10.1016/j.eswa.2024.124982
Dabbagh, M., Hamdaoui, B., Guizani, M., & Rayes, A. (2015). Software-defined networking security: pros and cons. IEEE Communications Magazine, 53(6), 73–79. https://doi.org/10.1109/MCOM.2015.7120048
Dahiya, S., Sehrawat, H., Kharb, S., & Siwach, V. (2024). A comprehensive analysis of threat vectors in software-defined networking. Multimedia Tools and Applications. https://doi.org/10.1007/s11042-024-19679-7
Etxezarreta, X., Garitano, I., Iturbe, M., & Zurutuza, U. (2023). Software-Defined Networking approaches for intrusion response in Industrial Control Systems: A survey. International Journal of Critical Infrastructure Protection, 42, 100615. https://doi.org/10.1016/j.ijcip.2023.100615
Gupta, S., & Grover, D. (2021). A Comprehensive Review on Detection of DDoS Attacks using ML in SDN Environment. Proceedings - International Conference on Artificial Intelligence and Smart Systems, ICAIS 2021, 1158–1163. https://doi.org/10.1109/ICAIS50930.2021.9395987
Hirsi Abdi, A., Salh, A., Alhartomi, M. A., Rasheed, H., Ahmed, S., & Tahir, A. (n.d.). Date of publication xxxx 00, 0000, date of current version xxxx 00, 0000. Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI and MTD Approaches to Security Solutions. https://doi.org/10.1109/ACCESS.2023.0322000
Jain, A. K., Shukla, H., & Goel, D. (2024). A comprehensive survey on DDoS detection, mitigation, and defense strategies in software-defined networks. Cluster Computing. https://doi.org/10.1007/s10586-024-04596-z
Janabi, A. H., Kanakis, T., & Johnson, M. (2024). Survey: Intrusion Detection System in Software-Defined Networking. IEEE Access. https://doi.org/10.1109/ACCESS.2024.3493384
Kreutz, D., Ramos, F. M. V., & Verissimo, P. (2013). Towards secure and dependable software-defined networks. Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 55–60. https://doi.org/10.1145/2491185.2491199
Kreutz, D., Ramos, F. M. V., Esteves Verissimo, P., Esteve Rothenberg, C., Azodolmolky, S., & Uhlig, S. (2015). Software-Defined Networking: A Comprehensive Survey. Proceedings of the IEEE, 103(1), 14–76. https://doi.org/10.1109/JPROC.2014.2371999
Kumar, G., & Alqahtani, H. (2023). Machine Learning Techniques for Intrusion Detection Systems in SDN-Recent Advances, Challenges and Future Directions. In CMES - Computer Modeling in Engineering and Sciences (Vol. 134, Issue 1, pp. 89–119). Tech Science Press. https://doi.org/10.32604/cmes.2022.020724
Lansky, J., Ali, S., Mohammadi, M., Majeed, M. K., Karim, S. H. T., Rashidi, S., Hosseinzadeh, M., & Rahmani, A. M. (2021). Deep Learning-Based Intrusion Detection Systems: A Systematic Review. IEEE Access, 9, 101574–101599. https://doi.org/10.1109/ACCESS.2021.3097247
Latif Yaser, A., Hussein, M., & Mousa, H. M. (n.d.). International Journal of Computers and Information (IJCI) Techniques for DDoS Attack Detection in SDNs: A Comparative Study. https://ijci.journals.ekb.eg/64
Liu, X., Yu, W., Liang, F., Griffith, D., & Golmie, N. (2021). On deep reinforcement learning security for Industrial Internet of Things. Computer Communications, 168, 20–32. https://doi.org/10.1016/j.comcom.2020.12.013
Md. Rayhan Ahmed, Salekul Islam, Swakkhar Shatabda, A. K. M. Muzahidul Islam, & Md. Towhidul Islam Robin. (2021). Intrusion Detection System in Software-Defined Networks Intrusion Detection System in Software-Defined Networks Using Machine Learning and Deep Learning Techniques-A Using Machine Learning and Deep Learning Techniques-A Comprehensive Survey Comprehensive Survey. Tech. https://doi.org/10.36227/techrxiv.17153213.v1
Mittal, M., Kumar, K., & Behal, S. (2023). Deep learning approaches for detecting DDoS attacks: a systematic review. In Soft Computing (Vol. 27, Issue 18, pp. 13039–13075). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/s00500-021-06608-1
Mostafa, N., Metwally, K., & Badran, K. (2024). Survey on SDN-based Intrusion Detection Systems. ICEENG 2024 - 14th IEEE International Conference on Electrical Engineering, 317–322. https://doi.org/10.1109/ICEENG58856.2024.10566429
Musa, N. S., Mirza, N. M., Rafique, S. H., Abdallah, A. M., & Murugan, T. (2024). Machine Learning and Deep Learning Techniques for Distributed Denial of Service Anomaly Detection in Software Defined Networks - Current Research Solutions. IEEE Access, 12, 17982–18011. https://doi.org/10.1109/ACCESS.2024.3360868
Mustafa, Z., Amin, R., Aldabbas, H., & Ahmed, N. (2024). Intrusion detection systems for software-defined networks: a comprehensive study on machine learning-based techniques. Cluster Computing. https://doi.org/10.1007/s10586-024-04430-6
Mwanza, N. P., & Kalita, J. (2023). Detecting DDoS Attacks in Software Defined Networks Using Deep Learning Techniques: A Survey. International Journal of Network Security, 25(2), 360. https://doi.org/10.6633/IJNS.202303
Nadeem, M. W., Goh, H. G., Aun, Y., & Ponnusamy, V. (2023). Detecting and Mitigating Botnet Attacks in Software-Defined Networks Using Deep Learning Techniques. IEEE Access, 11, 49153–49171. https://doi.org/10.1109/ACCESS.2023.3277397
Naskath, J., Sivakamasundari, G., & Begum, A. A. S. (2023). A Study on Different Deep Learning Algorithms Used in Deep Neural Nets: MLP SOM and DBN. Wireless Personal Communications, 128(4), 2913–2936. https://doi.org/10.1007/s11277-022-10079-4
Negera, W. G., Schwenker, F., Debelee, T. G., Melaku, H. M., & Ayano, Y. M. (2022). Review of Botnet Attack Detection in SDN-Enabled IoT Using Machine Learning. In Sensors (Vol. 22, Issue 24). MDPI. https://doi.org/10.3390/s22249837
Nunes, B. A. A., Mendonca, M., Nguyen, X.-N., Obraczka, K., & Turletti, T. (2014). A Survey of Software-Defined Networking: Past, Present, and Future of Programmable Networks. IEEE Communications Surveys & Tutorials, 16(3), 1617–1634. https://doi.org/10.1109/SURV.2014.012214.00180
Sarker, I. H. (2021). Deep Learning: A Comprehensive Overview on Techniques, Taxonomy, Applications and Research Directions. SN Computer Science, 2(6), 420. https://doi.org/10.1007/s42979-021-00815-1
Shaghaghi Arash and Kaafar, M. A. and B. R. and J. S. (2020). Software-Defined Network (SDN) Data Plane Security: Issues, Solutions, and Future Directions. In G. M. and A. D. P. and G. D. Gupta Brij B. and Perez (Ed.), Handbook of Computer Networks and Cyber Security: Principles and Paradigms (pp. 341–387). Springer International Publishing. https://doi.org/10.1007/978-3-030-22277-2_14
Sharma, A., & Saxena, P. (2022). Comparative Analysis of DDoS Attacks Detection Systems in Software defined Networks. In Artificial Intelligence and Communication Technologies (pp. 283–296). Soft Computing Research Society. https://doi.org/10.52458/978-81-955020-5-9-29
Shinan, K., Alsubhi, K., Alzahrani, A., & Ashraf, M. U. (2021). Machine learning-based botnet detection in software-defined network: A systematic review. Symmetry, 13(5). https://doi.org/10.3390/sym13050866
Sifa, R., Paurat, D., Trabold, D., & Bauckhage, C. (2018). Simple Recurrent Neural Networks for Support Vector Machine Training (pp. 13–22). https://doi.org/10.1007/978-3-030-01424-7_2
Singh, C., & Jain, A. K. (2024). A comprehensive survey on DDoS attacks detection & mitigation in SDN-IoT network. E-Prime - Advances in Electrical Engineering, Electronics and Energy, 8. https://doi.org/10.1016/j.prime.2024.100543
Singh, J., & Behal, S. (2020). Detection and mitigation of DDoS attacks in SDN: A comprehensive review, research challenges and future directions. In Computer Science Review (Vol. 37). Elsevier Ireland Ltd. https://doi.org/10.1016/j.cosrev.2020.100279
Su, Y., Xiong, D., Qian, K., & Wang, Y. (2024). A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network. In Electronics (Switzerland) (Vol. 13, Issue 4). Multidisciplinary Digital Publishing Institute (MDPI). https://doi.org/10.3390/electronics13040807
Sultana, N., Chilamkurti, N., Peng, W., & Alhadad, R. (2019). Survey on SDN based network intrusion detection system using machine learning approaches. Peer-to-Peer Networking and Applications, 12(2), 493–501. https://doi.org/10.1007/s12083-017-0630-0
Taheri, R., Ahmed, H., & Arslan, E. (2023). Deep learning for the security of software-defined networks: a review. In Cluster Computing (Vol. 26, Issue 5, pp. 3089–3112). Springer. https://doi.org/10.1007/s10586-023-04069-9
Valdovinos, I. A., Pérez-Díaz, J. A., Choo, K. K. R., & Botero, J. F. (2021). Emerging DDoS attack detection and mitigation strategies in software-defined networks: Taxonomy, challenges and future directions. In Journal of Network and Computer Applications (Vol. 187). Academic Press. https://doi.org/10.1016/j.jnca.2021.103093
Vijayan, A., & Anitha, A. (2025). A Review of Intrusion Detection Systems in Software Defined Networks. 3rd International Conference on Electronics and Renewable Systems, ICEARS 2025 - Proceedings, 859–864. https://doi.org/10.1109/ICEARS64219.2025.10940260
Wang, H., & Li, Y. (2024). Overview of DDoS Attack Detection in Software-Defined Networks. IEEE Access, 12, 38351–38381. https://doi.org/10.1109/ACCESS.2024.3375395
Yusra Sh. Ajaj, Bilal R. Al-Kaseem, & Yousif Al-Dunainawi. (2023). Cyber Attacks in SDN-Based IoT Environment: A Review. Al-Iraqia Journal of Scientific Engineering Research, 2(3). https://doi.org/10.58564/ijser.2.3.2023.89
Yzzogh, H., & Benaboud, H. (2025). A comprehensive overview of machine learning for intrusion detection in software-defined networking. In Innovations in Systems and Software Engineering. Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/s11334-025-00604-6
Downloads
Published
Issue
Section
Categories
License
Copyright (c) 2025 Maryam Yamin Ahman, Saleh El-Yakub Abdullahi, Steve Adeshina Adetunji
This work is licensed under a Creative Commons Attribution 4.0 International License.
