# FedDB: A Federated Learning Approach Using DBSCAN for DDoS Attack Detection
## 1 Introduction  
With the rapid development and widespread adoption of the Internet of Things (IoT), IoT has not only introduced unprecedented innovations and smart solutions but has also significantly enhanced the quality of life and work efficiency. These innovations have led to the rapid expansion of IoT across various domains. The broad application of IoT has resulted in a dramatic increase in the number of devices and communication entities within networks, making network management face unprecedented challenges. As the number and complexity of devices grow, traditional network management methods become increasingly inadequate, necessitating the adoption of more advanced technologies to maintain network stability and efficiency [1]. In this context, Software-Defined Networking (SDN) [2] has emerged and gradually become a mainstream technology in modern network management. SDN separates the network control layer from the data-forwarding layer, enabling centralized and flexiblenetwork management. This centralized control logic makes network resource allocation and management more efficient and capable of quickly adapting to changes in network traffic and demands. However, the centralized nature of SDN's control introduces new challenges, particularly in terms of security. Because SDN's control layer is centralized in a central controller, the entire network's management and control rely on this controller. While this centralized architecture offers management convenience, it also makes it vulnerable to attacks. In particular, DDoS attacks pose a serious threat to SDN systems. DDoS attacks overwhelm the target network with a flood of fake requests, consuming network bandwidth and processing resources, which prevents legitimate traffic from passing through and leads to network service interruptions or performance degradation. In SDN, attackers might target the central controller with DDoS attacks, impacting the stability and availability of the entire network. Therefore, despite the significant advantages of SDN in enhancing network flexibility and management efficiency, the security issues associated with its centralized control architecture need to be addressed carefully. DDoS attacks [3] are both common and extremely dangerous forms of network attacks. Their core strategy involves sending a massive volume of small and nearly invisible data packets to the target network. These attacks are executed in a distributed, collaborative, and large-scale manner, aiming to block legitimate users from accessing the target resources or services. Specifically, attackers utilize a large number of infected devices (such as botnets) to generate enormous traffic, thereby consuming the target system's bandwidth and processing capacity, leading to system resource exhaustion or overload. This type of attack can cause not only server damage, system crashes, and file corruption, but also complete service interruption. Due to the destructive nature and potential long-term impacts of DDoS attacks, the timely and effective detection and mitigation of these attacks are crucial challenges in the field of network security. A system for detecting and mitigating DDoS attacks in SDN typically involves two key steps: detecting attack types and mitigating attacks. Once identified, mitigation strategies such as rate limiting, traffic filtering, and dynamic reconfiguration are applied to reduce the impact of the attack. The system may also implement a feedback mechanism to continuously learn from the traffic patterns and improve detection accuracy over time. The entire process focuses on maintaining network integrity and performance [4]. In this paper, we focus on the detection aspect because it is the core of DDoS attack defense. Only by accurately and promptly identifying abnormal traffic can subsequent classification and mitigation measures be effectively carried out. As attack methods become increasingly sophisticated, traditional approaches may not respond quickly enough.