Rapidly growing diversity of heterogeneous Software-Defined Internet of Things (SD-IoT) devices has created an increased vulnerability to high-rate volumetric distributed attacks, application-layer probing and bandwidth exhaustion. Traditional security architectures rely on centralized cloud-based Intrusion Detection Systems (IDS) causing considerable delays in processing, control-plane congestion and core-link bandwidth constraints. In order to solve those key issues, this paper proposes CoDPA (Cognitive Data-Plane Architecture), which presents a novel network architecture to mitigate network threats with built-in intelligence, sliding-window aggregation and adaptive policy enforcement using P4-programmable switches. One of the core elements of CoDPA is a novel approach called Confidence-Aware Decision Engine that converts behavioral metrics to policy enforcement decisions at line-rate without executing computational complex loop or floating point neural inference computations in hardware ALUs. CoDPA utilizes four customized modules for processing traffic, such as: Header Parser, Atomic SRAM register-based Feature Extractor, Sliding-Window Temporal Aggregator, and Confidence-Calibrated Match Action Evaluator. Based on the results of computing confidence scores mapped against calibrated thresholds stored in fast lookup tables, CoDPA performs dynamic orchestration of fine-grained actions such as: packet dropping for high-confidence threats; bandwidth throttling using token bucket for medium confidence anomalies; inspection tagging for out-of-line controller decision making; and line-rate forwarding for legitimated packets. Empirical experiments performed in hybrid emulated Mininet-WiFi and programmable testbeds have shown that CoDPA decreases end-to-end latency up to 90% during high-traffic peaks (up to 20,000 packets/second); saves up to 85.1% of core-link bandwidth; provides True Positive Rate (TPR) of 98.4% with False Positive Rate (FPR) of 1.8%; and mitigates attacks with latency of 1.2 milliseconds. Besides, CoDPA uses a light-weight hardware design (≤14% ALU utilization and 0.92 µs per-packet processing); provides 78.2% less carbon footprint and energy consumption than traditional IDS.
The exponential growth of the Internet of Things (IoT) has magnified vulnerability to Distributed Denial-of-Service (DDoS) threats, particularly advanced TCP flooding attacks that exploit protocol weaknesses to disrupt services and overwhelm constrained devices. Existing Software-Defined Networking (SDN) defenses often suffer from scalability bottlenecks, high controller overhead, and limited adaptability to evolving traffic dynamics. To overcome these challenges, this paper proposes APATCP, a P4-enabled, multi-controller SD-IoT framework for real-time adaptive detection and mitigation of TCP flooding. APATCP integrates four coordinated modules: Adaptive Collaborative Intrusion Defense (ACID) for decentralized intelligence sharing; Dynamic Traffic Anomaly Mitigation (DTAM) for adaptive thresholding and flow isolation; Dynamic Threat-Adaptive Classifier (DTAC), which leverages 24 P4-extracted features and an adaptive weighted ensemble classifier for complex multi-type attack classification; and FlowGuard-AP, a context-aware mitigation engine with dynamic response strategies. Evaluation across three IoT-centric datasets—CICIoT2024, Edge-IIoTset, and ToN_IoT—demonstrates superior performance, with APATCP achieving 99.3–99.98% accuracy, 98.2–99.5% recall, F1-scores up to 99.2%, and false positive rates as low as 0.4%. In binary classification, it consistently outperformed baselines such as LightGBM (97.5–97.8%) and XGBoost (96.7–97.1%). In multi-class evaluations spanning eight adversarial scenarios—including burst floods, hybrid multi-vector campaigns, and stealthy microbursts—the framework maintained > 98% accuracy while remaining operationally stable. Live emulations confirmed resilience under > 100k packets/s attack rates, keeping CPU load below 30%, packet loss under 2%, and end-to-end latency below 100 ms, while restoring throughput to over 95% of baseline within seconds. These results establish APATCP as a scalable, adaptive, and resource-efficient framework that delivers high detection accuracy, low overhead, and robust mitigation, ensuring reliable defense for next-generation SD-IoT infrastructures against increasingly sophisticated TCP flooding threats.
Ashraf Alyanbaawi, A. Hassan, Marwa M. Khashaba et al.· Scientific Reports· 0 citations