Search papers, labs, and topics across Lattice.
This paper introduces a RAG-based framework leveraging interface-level traffic features, semantic embeddings, and LLM-driven inference for real-time detection and mitigation of Carpet-Bombing DDoS attacks in SDN environments, eliminating the need for supervised training. The framework uses FAISS for similarity retrieval and explores both structured JSON and natural language representations of traffic data. Experiments demonstrate high accuracy and stable attack detection, with the Gemma-4-31B-IT model achieving the best performance, showcasing the potential of RAG+LLM for adaptive SDN security.
Forget retraining supervised models: RAG and LLMs can now detect and mitigate sophisticated Carpet-Bombing DDoS attacks in real-time within SDN environments.
Software-Defined Networking (SDN) provides flexible and programmable network management; however, its centralized control architecture remains highly vulnerable to Distributed Denial-of-Service (DDoS) attacks, particularly Carpet-Bombing DDoS attacks that distribute malicious traffic across multiple targets to evade conventional detection mechanisms. In this paper, a Retrieval-Augmented Generation (RAG)-based framework is proposed for real-time detection and mitigation of Carpet-Bombing DDoS attacks in SDN environments. The proposed framework combines interface-level traffic features representation, semantic embedding generation, FAISS-based similarity retrieval, and Large Language Model (LLM)-driven contextual inference to classify traffic behavior without requiring conventional supervised model training or retraining. To evaluate the effectiveness of the proposed framework, extensive experiments were conducted under multiple Carpet-Bombing DDoS attack scenarios with different attack intensities. In addition, two traffic representation strategies, namely structured JSON-based representation and natural language-based representation (NLR), were investigated using multiple state-of-the-art LLMs. The experimental results demonstrate that the proposed framework achieved highly accurate and stable attack detection performance, while the framework configuration utilizing the Gemma-4-31B-IT model achieved the strongest overall detection results. Furthermore, real-time experiments confirmed the capability of the proposed framework to rapidly detect and mitigate Carpet-Bombing DDoS attacks while maintaining stable SDN network operation. The obtained results highlight the effectiveness of integrating RAG mechanisms with LLM for intelligent and adaptive SDN security analysis.
