A Hybrid Z-Isomorphic GNN Framework for Robust DDoS Attack Detection in Software-Defined Networks

Abstract

Although SDN provides a programmable, centrally managed framework for modern networks, that same centralization leaves it exposed to attacks such as Distributed Denial of Service (DDoS). This paper proposes an intrusion detection framework that couples Z-Isomorphic Sigmoid Graph Neural Networks (ZIS-GNN) with Bonobo-Optimization-based (EKPC-BOA) feature selection. The sigmoid-based activation strengthens the graph representation relative to conventional GNNs, capturing complex traffic patterns more faithfully, while the hybrid selector – combining the Bonobo Optimization Algorithm with an entropy score and Pearson correlation – distils the most informative features from the traffic data and thereby improves both efficiency and accuracy. Experiments demonstrate that the proposed ZIS-GNN+EKPC-BOA model attains an accuracy of 97.36%, a precision of 97.37%, and an F1-score of 97.58%, outperforming baseline models such as DNN (89.60%), LSTM (91.68%), BiLSTM (93.77%), and GNN (95.86%), as well as the standard graph baselines GCN (96.18%) and the attention-based GAT (96.58%). The results show the effectiveness of combining graph-based learning with hybrid feature selection for intrusion detection in SDN.