Early Detection of Abnormal Attacks in Software-Defined Networking Using Machine Learning Approaches

Abstract

Recent developments have made software-defined networking (SDN) a popular technology for solving the inherent problems of conventional distributed networks. The key benefit of SDN is the decoupling between the control plane and the data plane, which makes the network more flexible and easier to manage. SDN is a new generation network architecture; however, its configuration settings are centralized, making it vulnerable to hackers. Our study investigated the feasibility of applying artificial intelligence technology to detect abnormal attacks in an SDN environment based on the current unit network architecture; therefore, the concept of symmetry includes the sustainability of SDN applications and robust performance of machine learning (ML) models in the case of various malicious attacks. In this study, we focus on the early detection of abnormal attacks in an SDN environment. On detection of malicious traffic in SDN topology, the AI module in the topology is applied to detect and act against the attack source through machine learning algorithms, making the network architecture more flexible. Under multiple abnormal attacks, we propose a hierarchical multi-class (HMC) architecture to effectively address the imbalanced dataset problem and improve the performance of minority classes. The experimental results show that the decision tree, random forest, bagging, AdaBoost, and deep learning models exhibit the best performance for distributed denial-of-service (DDoS) attacks. In addition, for the imbalanced dataset problem of multiclass classification, our proposed HMC architecture performs better than previous single classifiers. We also simulated the SDN topology and scenario verification. In summary, we concatenated the AI module to enhance the security and effectiveness of SDN networks in a practical manner.

A Survey on the Latest Intrusion Detection Datasets for Software Defined Networking Environments

“…The effect of class imbalance becomes unavoidable when performing multi-attack classification. Some studies simply neglect minority class attacks, while others use oversampling and undersampling techniques to resolve this issue [10]. Another solution is to use multi-class hierarchical binary classification [10,15].…”

“…Nevertheless, their topology was the same as that of the creator of the dataset [21]. Authors in [10] supported the fact that using many features could be useful in detection accuracy, but it could lead to issues, such as increased model complexity and training costs. Focus is given on various attacks and the Hierarchical Multi-Class (HMC) architecture is proposed to address the imbalance problem in the InSDN dataset and improve the performance of minority classes, like BFA, botnet, and web attacks.…”

“…Three of these attacks are specific to SDN networks [4,[7][8][9]. Authors in [10] argue that SDN networks may be more susceptible to malicious traffic than traditional environments due to the decoupling of the control plane and data plane. A security breach in conventional networks causes only minor damage to a small portion of the network, whereas an attack on the SDN controller might have catastrophic consequences for the entire network [7][8][9][10][11].…”

Detection of attacks on software defined networks using machine learning techniques and imbalanced data handling methods

“…Chuang et al 13 UNSW-NB15 Using a synthetic minority over-sampling technique (SMOTE) to address the class imbalance problem, and improve the classification model accuracy. This may be done by first monitoring the system functions.…”

Dynamic Ransomware Detection for Windows Platform Using Machine Learning Classifiers

“…It is becoming more difficult to establish a solid overcoming method to deal with ransomware attacks since ransomware creators are constantly upgrading their products to avoid any new detection methods. To overcome this, researchers employed Software-Defined Networking (SDN) for ransomware detection using deep packet tracing with POST and GET requests [19], [20]. Once the ransomware is detected, the IP addresses of the servers will be blacklisted by the determined servers in charge of controlling the addresses.…”