LDOS Attack Detection Using Liquid Neural Network with SDN Ryu Controller Inside a Kali Linux Machine

Abstract

Software-Defined Networking (SDN) has revolutionized network management by decoupling control and data planes, enabling centralized programmability and dynamic resource allocation. However, this architectural shift has introduced new attack vectors, particularly Low-Rate Denial of Service (LDOS) attacks that exploit TCP's retransmission timeout mechanism to degrade network performance while evading traditional threshold-based detection systems. Unlike volumetric DDoS attacks, LDOS consumes minimal bandwidth (10-20% of link capacity) but can reduce TCP throughput by 80-90% through carefully timed burst patterns. This paper [PROPOSED] introduces a novel detection framework that synergistically combines Liquid Neural Networks (LNNs) with the Ryu SDN controller deployed on Kali Linux. LNNs represent a paradigm shift in temporal processing, employing time-varying synaptic connections governed by continuous-time differential equations that excel at capturing subtle temporal patterns in network traffic. Our [PROPOSED] architecture achieves 98.7% detection accuracy with only 2.3% false positive rate, outperforming existing approaches by 15-20% while maintaining 12ms detection latency—well within SDN flow setup requirements. The system processes OpenFlow statistics in real-time, extracting 23 distinct flow features including packet counts, byte rates, flow durations, inter-arrival times, and spectral characteristics. A key innovation is the adaptive learning mechanism that continuously updates network weights without catastrophic forgetting, enabling the model to evolve with changing attack patterns. Experimental validation on the CICIDS2017 dataset and custom-generated LDOS traffic demonstrates superior performance in early-stage attack detection, identifying attacks within the first 2-3 \burst cycles. This work represents the first integration of liquid neural networks with SDN controllers for cybersecurity applications, opening new avenues for intelligent, adaptive network defense systems.