Capacity‐Scalable Attention‐Fused Hybrid Deep Network With Selective SHAP for DDoS Detection in Software‐Defined Networks

Software‐defined networking (SDN) requires distributed denial‐of‐service (DDoS) detectors that combine high predictive performance with efficient inference, cross‐dataset generalization, robustness, and transparent decision support. This study introduces HybridAttentionNet , a capacity‐scalable architecture that integrates statistical MLP, local CNN‐1D, and temporal BiLSTM encoders through a sample‐specific attention gate. Two capacity profiles demonstrate the versatility of the same multiview fusion principle. The full‐capacity configuration uses 77 harmonized traffic features and 1,249,028 parameters, achieving 99.4% accuracy, 99.4% F1‐score, and 0.995 ROC–AUC on the untouched CICDDoS2019 test partition, followed by 96.7% accuracy and 0.969 ROC–AUC in direct zero‐shot evaluation on InSDN. The compact configuration uses nine deployment‐oriented features and 220,164 parameters. Across five matched seeds, it achieves balanced accuracy of 0.9341 ± 0.0161 on CICDDoS2019 and 0.8377 ± 0.0108 on InSDN. Against the principal modern comparator, a compact SequenceTransformer, HybridAttentionNet reduces both parameter count and artifact size by 59%, while limiting the balanced‐accuracy differences to 3.42 percentage points on CICDDoS2019 and 1.56 points on InSDN. On the challenging purged temporal Ahuja holdout, it achieves 0.7578 ± 0.0046 balanced accuracy, remains within only 1.52 points of the transformer, and surpasses Random Forest and XGBoost by 10.06 and 10.82 points, respectively. Validation balanced accuracy remains between 0.9862 and 0.9896 across five threshold‐calibrated runs; the frozen‐threshold test evaluation yields 0.7612 ± 0.0089 balanced accuracy and 0.9316 ± 0.0447 attack recall under temporal distribution shift. The compact model occupies 0.892 MB and averages 1.418 ms on a Tesla T4 and 0.866 ms through ONNX CPUExecutionProvider. Selective SHAP delivers 47.94 explanations/s, and semantics‐aware adversarial evaluation preserves at least 99.96% attack detection. These results establish HybridAttentionNet as a highly competitive accuracy–efficiency–auditability solution for SDN DDoS detection.