APATCP: programmable multi-controller framework for real-time detection and mitigation of complex TCP flooding attacks in SD-IoT networks.

The exponential growth of the Internet of Things (IoT) has magnified vulnerability to Distributed Denial-of-Service (DDoS) threats, particularly advanced TCP flooding attacks that exploit protocol weaknesses to disrupt services and overwhelm constrained devices. Existing Software-Defined Networking (SDN) defenses often suffer from scalability bottlenecks, high controller overhead, and limited adaptability to evolving traffic dynamics. To overcome these challenges, this paper proposes APATCP, a P4-enabled, multi-controller SD-IoT framework for real-time adaptive detection and mitigation of TCP flooding. APATCP integrates four coordinated modules: Adaptive Collaborative Intrusion Defense (ACID) for decentralized intelligence sharing; Dynamic Traffic Anomaly Mitigation (DTAM) for adaptive thresholding and flow isolation; Dynamic Threat-Adaptive Classifier (DTAC), which leverages 24 P4-extracted features and an adaptive weighted ensemble classifier for complex multi-type attack classification; and FlowGuard-AP, a context-aware mitigation engine with dynamic response strategies. Evaluation across three IoT-centric datasets-CICIoT2024, Edge-IIoTset, and ToN_IoT-demonstrates superior performance, with APATCP achieving 99.3-99.98% accuracy, 98.2-99.5% recall, F1-scores up to 99.2%, and false positive rates as low as 0.4%. In binary classification, it consistently outperformed baselines such as LightGBM (97.5-97.8%) and XGBoost (96.7-97.1%). In multi-class evaluations spanning eight adversarial scenarios-including burst floods, hybrid multi-vector campaigns, and stealthy microbursts-the framework maintained > 98% accuracy while remaining operationally stable. Live emulations confirmed resilience under > 100k packets/s attack rates, keeping CPU load below 30%, packet loss under 2%, and end-to-end latency below 100 ms, while restoring throughput to over 95% of baseline within seconds. These results establish APATCP as a scalable, adaptive, and resource-efficient framework that delivers high detection accuracy, low overhead, and robust mitigation, ensuring reliable defense for next-generation SD-IoT infrastructures against increasingly sophisticated TCP flooding threats.