AMCS: Adaptive Multi-Controller SDN Security with Stateful Traffic Intelligence for Fast and Accurate Multi-Vector Attack Detection

Abstract: The rapid proliferation of Software-Defined Networking (SDN) in large-scale Internet of Things (IoT) ecosystems has amplified exposure to sophisticated, multi-vector cyberattacks that simultaneously exploit control- and data-plane asymmetries. Existing single-controller statistical detectors, while effective under high-volume anomalies, fail to sustain precision and responsiveness under dynamic, distributed, or low-rate attack conditions. Addressing this critical gap, we propose AMCS—an Adaptive Multi-Controller SDN Security framework that fuses stateful traffic intelligence with cooperative inter-controller decision-making to enable resilient, context-aware detection across complex IoT traffic. AMCS embeds lightweight, P4-based stateful processing directly in the data plane and augments it with adaptive entropy-driven anomaly evaluation and consensus-based coordination among distributed controllers. Extensive experiments on an SDN–IoT testbed demonstrate that AMCS achieves up to 99.7% detection accuracy for high-volume floods, 96.8% for low-rate anomalies, and 94.1% under mixed traffic, while maintaining false-positive rates below 5% and detection latencies as low as 1.24 s. The cooperative consensus protocol enhances cross-controller reliability to 98.4% with only 0.83 s synchronization delay, while reducing control overhead by 34.7% compared to the single-controller baseline. Moreover, the distributed mitigation layer reacts within 1.6 s on average, neutralizing over 97% of attack flows with negligible collateral impact. Collectively, these results confirm that integrating stateful in-switch analytics, adaptive thresholding, and multi-controller cooperation establishes a scalable, self-adaptive SDN security fabric—achieving both fast detection and stable defense against evolving multi-vector threats in IoT-driven networks.

Ameer El-Sayed, Mohamed Nosseir Hemdan, Noha Abdelkarim, Ehab Rushdy and Hanaa M. Hamza. “AMCS: Adaptive Multi-Controller SDN Security with Stateful Traffic Intelligence for Fast and Accurate Multi-Vector Attack Detection”. International Journal of Advanced Computer Science and Applications (IJACSA) 17.2 (2026). http://dx.doi.org/10.14569/IJACSA.2026.0170255

@article{El-Sayed2026,
title = {AMCS: Adaptive Multi-Controller SDN Security with Stateful Traffic Intelligence for Fast and Accurate Multi-Vector Attack Detection},
journal = {International Journal of Advanced Computer Science and Applications},
doi = {10.14569/IJACSA.2026.0170255},
url = {http://dx.doi.org/10.14569/IJACSA.2026.0170255},
year = {2026},
publisher = {The Science and Information Organization},
volume = {17},
number = {2},
author = {Ameer El-Sayed and Mohamed Nosseir Hemdan and Noha Abdelkarim and Ehab Rushdy and Hanaa M. Hamza}
}