A Comparative Study of DDoS Attack Detection in Traditional Networks and SDN Using Time and Frequency Domain Features

Distributed Denial-of-Service (DDoS) attacks remain a critical threat to network security, with evolving patterns that often bypass traditional intrusion detection systems (IDS). While many studies have focused on time-domain analysis in conventional networks, limited attention has been given to comparative evaluations across different network architectures using frequency-based feature extraction. This study addresses this gap by evaluating the effectiveness of time-domain statistics and two frequency-domain techniques, Discrete Wavelet Transform (DWT) and Hilbert-Huang Transform (HHT), in both traditional and Software-Defined Networking (SDN) environments Various machine learning models are trained on each transformation type. Experimental results show that DWT-based features achieve superior performance, reaching F1-scores above 99% in SDN datasets, whereas HHT performs less effectively due to its sensitivity to noise and unstable decomposition. The findings suggest that selecting transformation techniques aligned with network characteristics improves the accuracy and robustness of DDoS detection.