Liquid neural networks for adaptive DDoS detection in IoT and SDN environments.

DDoS attacks continue to threaten Internet of Things (IoT) and Software Defined Networking (SDN) systems, where network traffic is highly dynamic and changes rapidly over time. Most machine learning and deep learning-based detection models assume stable traffic distributions and therefore struggle when attackers vary packet rates, flow intervals, and traffic intensities to avoid detection. Liquid Neural Networks (LNNs) offer a more suitable approach because they operate in continuous time and can adjust their internal states in response to time varying inputs. This study explores the use of LNNs for adaptive DDoS detection in IoT and SDN environments and evaluates their ability to model evolving and adversarial traffic patterns. The proposed framework uses three stacked liquid time constant layers combined with a multi head attention mechanism to learn both short term and long-term temporal dependencies in network flows. Three recent datasets, CICIoT2023, SNT SDN2025, and IoT23, were preprocessed through cleaning, normalization, and consistent feature scaling. The model was trained with the Adam optimizer and evaluated using accuracy, precision, recall, false positive rate, and false negative rate. Robustness was assessed using a multiple input multiple output adversarial testing approach based on the Momentum Iterative Method, which generates subtle perturbations to simulate real evasion attempts. The results show that the LNN based model achieves high performance on all datasets, with a maximum accuracy of 99.96% and significantly lower false positive and false negative rates compared with all baseline models including multilayer perceptron (MLP), LSTM, GRU, and CNN-LSTM. Under adversarial conditions, the LNN model retains more than 90% accuracy, while the strongest baseline CNN-LSTM drops to a maximum of 84.95%. These findings indicate that LNNs effectively capture the temporal variability present in DDoS traffic and generalize well across diverse attack scenarios. Overall, the results demonstrate that continuous time adaptive computation enables LNNs to provide robust, efficient, and temporally aware DDoS detection suitable for practical deployment in IoT and SDN environments.