Effects of Machine Learning Approach in Flow-Based Anomaly Detection on Software-Defined Networking

Abstract

Recent advancements in software-defined networking (SDN) make it possible to overcome the management challenges of traditional networks by logically centralizing the control plane and decoupling it from the forwarding plane. Through a symmetric and centralized controller, SDN can prevent security breaches, but it can also bring in new threats and vulnerabilities. The central controller can be a single point of failure. Hence, flow-based anomaly detection system in OpenFlow Controller can secure SDN to a great extent. In this research, we investigated two different approaches of flow-based intrusion detection system in OpenFlow Controller. The first of which is based on machine-learning algorithm where NSL-KDD dataset with feature selection ensures the accuracy of 82% with random forest classifier using the gain ratio feature selection evaluator. In the later phase, the second approach is combined with a deep neural network (DNN)-based intrusion detection system based on gated recurrent unit-long short-term memory (GRU-LSTM) where we used a suitable ANOVA F-Test and recursive feature elimination selection method to boost classifier output and achieve an accuracy of 88%. Substantial experiments with comparative analysis clearly show that, deep learning would be a better choice for intrusion detection in OpenFlow Controller.Symmetry 2020, 12, 7 2 of 21 of the network, taking advantage of decision-making from the global perspective of the network in the controller. However, to be successful in current dynamic environments, traffic monitoring becomes a cornerstone in SDN given that management applications often need to make use of accurate and timely traffic measurements. Forwarding components like switches, routers, etc., are elements of the data plane and the controller is the only element of the control plane. Decoupling of the network control and forwarding functions, and direct programmability of the network give network managers enough control over the network. Separation of the routing and forwarding activities of networking components (e.g., switches, routers, etc.) from the data plane, makes the administration and management of the network straightforward because the control plane now only has to handle logical network topology-related information, traffic routing, and so forth while the data plane only needs to manage the network traffic using the configuration provided by the control unit. The SDN paradigm was the outcome of some works of the research world that suggested the necessity of building programmable networks as a practical way to experiment with new protocols in production networks. From its inception, it has gained lots of attention from academia and industry. It is supported by giants of the Internet world like Google, Cisco, HP, Juniper or NEC and by standardization organizations like the Open Network Foundation (ONF) or the Internet Engineering Task Force (IETF), so one can state that this network paradigm has a lot of potential to succeed. The proposal of the OpenFlow protocol [2] in 2008 wa...

A novel approach for intrusion detection systems: V-IDS

“…Even though binary and multi-class classification were done in this study, the studies compared according to multi-class accuracies, since not all studies were contained both classifications. [34] MCD-KDE 91.71 Ieracitano et al [35] AE50 87 Garg et al [36] SVM 87.56 Dong et al [37] MCA-LSTM 82.15 Dey et al [38] GRU-LSTM 87.91 Li et al [39] GINI-GBDT-PSO 86.10 Wu et al [40] CNN 79.48 Le et al [41] LSTM 92 Gogoi et al [42] TUIDS 96.55 Tang et al [43] DNN 91.7 Yin et al [44] RNN 83.28 Tang et al [45] RNN 89 Proposed Technique V-IDS 97.52…”

Deep network approach with stacked sparse autoencoders in detection of DDoS attacks on SDN‐based VANET

“…Second, DL‐based attack detection was made based on gated recurrent unit‐LSTM. When the results obtained in both cases were compared, it was emphasised that DL is a better option for intrusion recognition [18].…”

SAAE-DNN: Deep Learning Method on Intrusion Detection

“…Machine learning methods first select features, and then use classifiers to detect intrusions, such as random forest (RF) [4], decision tree (DT) [5], and support vector machine (SVM) [6]. Deep learning methods can automatically extract features and classify to realize intrusion detection, such as autoencoders [7], long short term memory (LSTM) [8], and deep neural networks (DNN) [9]. The ensemble learning method uses various ensemble and hybrid technologies for intrusion detection, including bagging [10], boosting [11], stacking [12], and combined classifier methods [13].…”