Adaptive Mitigation of Amplification-Based DDoS Attacks in Programmable Data Planes

Distributed Denial-of-Service (DDoS) attacks, particularly amplification-based variants, continue to threaten Internet availability by generating massive traffic volumes through protocol asymmetries. Conventional mitigation approaches based on static filtering or control-plane inspection are increasingly inadequate against dynamic attack behaviors. In response, this work investigates whether online learning-based mitigation can be executed directly in the programmable data plane using P4. We design an in-switch Q-learning agent that performs amplification-aware mitigation by updating its policy online from bidirectional flow telemetry, using traffic asymmetry features and a switch-level quality-of-service degradation metric, without external retraining or offline datasets. We implement the approach in P4 and evaluate it in an emulated environment with programmable software switches under synthetic amplification attack and legitimate traffic scenarios. Results indicate that the proposed system adapts to changing traffic conditions and reduces malicious amplification traffic while preserving legitimate service performance, demonstrating the potential of programmable data planes for autonomous DDoS mitigation.