Risk‐Bounded Temporal Graph Decision Learning for DDoS Mitigation in Software‐Defined Internet of Things Networks

Distributed denial‐of‐service (DDoS) attacks remain a major availability threat in software‐defined Internet of Things (SDN‐IoT) networks because the controller must both recognize abnormal traffic and choose a mitigation action without causing unnecessary service disruption. This paper presents a risk‐bounded temporal graph decision framework that converts controller‐visible telemetry into a history‐aware graph state, scores four candidate actions (ALLOW, RATE_LIMIT, BLOCK, and ISOLATE_SUBNET), filters candidates through predicted benign‐loss, controller‐cost, and risk constraints, and records decision provenance in a permissioned hash‐linked audit log. The archived temporal‐transition dataset contains 1282 one‐step transitions with an eight‐window history and a contiguous source‐time split of 910/196/176 train/validation/test samples. The original action‐selection replay contains 130 decision steps: the temporal model with the risk selector reaches 0.5077 accuracy and 0.6667 F1‐score, compared with 0.9385 accuracy and 0.9344 F1‐score for the strongest observable baselines, and it collapses toward RATE_LIMIT in 128/130 decisions. These negative results are analyzed rather than hidden. Inspection of the archived transition pipeline also shows incomplete factual support for the four‐action space because the source stress logs record operational status rather than an explicit four‐action treatment label. Consequently, the learned temporal policy is retained as shadow‐mode feasibility evidence rather than an autonomous controller. Supporting controlled validation adds a timestamped temporal detector split, topology‐scale tests, five repeated live/stress runs at a common threshold, benign flash‐crowd testing, and audit‐overhead measurements. Zero unsafe‐action and controller‐overload events in the 130‐step replay are, therefore, reported only as empirical constraint satisfaction under the evaluated conditions, not as a safety guarantee. The contribution is an auditable, nonleaky, constraint‐filtered research architecture and a transparent diagnosis of the remaining adaptive‐policy learning problem.