ML‐IDSDN: Machine learning based intrusion detection system for software‐defined network

Alzahrani, Abdulsalam O.; Alenazi, Mohammed J. F.

doi:10.1002/cpe.7438

Cited by 28 publications

(24 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…MCAD outperformed IDSs proposed on [33], [38] on attacks (A) and normal (N) traffic, as shown in Table 10. Although IDSs proposed in [40], [43] have slightly higher accuracy performance than MCAD (Figure 8), they are lacking a small number of features and/or diversity of attack types. In [40], the authors used 48 features, compared to MCAD, which uses five features only: this reflects a more complex model than MCAD.…”

Section: A Simulation Resultsmentioning

confidence: 99%

“…In [40], the authors used 48 features, compared to MCAD, which uses five features only: this reflects a more complex model than MCAD. In [43], the authors proposed a model that works only against DDoS and probe attacks, compared to MCAD, which works against a wide spectrum of attacks. is under attack.…”

Section: A Simulation Resultsmentioning

confidence: 99%

“…The authors of [43] worked on the development of an IDS for SDNs. The IDS, ML-IDSDN, is based on machine learning and aims to detect malicious activity on SDNs.…”

Section: B Previous Workmentioning

confidence: 99%

See 2 more Smart Citations

MCAD: A Machine Learning Based Cyberattacks Detector in Software-Defined Networking (SDN) for Healthcare Systems

Halman

Alenazi

2023

IEEE Access

Self Cite

View full text Add to dashboard Cite

The healthcare sector deals with sensitive and significant data that must be protected against illegitimate users. Software-defined networks (SDNs) are widely used in healthcare systems to ensure efficient resource utilization, security, optimal network control, and management. Despite such advantages, SDNs suffer from a major issue posed by a wide range of cyberattacks, due to the sensitivity of patients' data. These attacks diminish the overall network performance, and can cause a network failure that might threaten human lives. Therefore, the main goal of our work is to propose a machine learning-based cyberattack detector (MCAD) for healthcare systems, by adapting a layer three (L3) learning switch application to collect normal and abnormal traffic, and then deploy MCAD on the Ryu controller. Our findings are beneficial for enhancing the security of healthcare applications by mitigating the impact of cyberattacks. This work covers the testing of MCAD using a wide spectrum of both ML algorithms and attacks, and provides a performance comparison for every pair of ML algorithms/attacks to illustrate the strengths and weaknesses of different algorithms against a specific attack. The MCAD shows impressive performance, achieving an F1-score of 0.9998 and of 0.9882 on normal and attack classes, respectively, which implies a high level of reliability. MCAD also achieved 5,709,692 samples per second on throughput, which reflects a high-performance real-time system with respect to complexity. Additionally, it showed a positive impact on the network KPIs by increasing the throughput by 609%, and decreasing delay and jitter by 77% and 23%, respectively, compared to attack results.

show abstract

Section: A Simulation Resultsmentioning

confidence: 99%

Section: A Simulation Resultsmentioning

confidence: 99%

See 1 more Smart Citation

MCAD: A Machine Learning Based Cyberattacks Detector in Software-Defined Networking (SDN) for Healthcare Systems

Halman

Alenazi

2023

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…They employed a hybrid classifier stack that combined KNN, SVM, and Logistic Regression (LR) to identify the DDoS attacks. The article described in Reference [37] presents two datasets produced from SDN using Mininet and Ryu controllers, which comprise regular traffic and various attacks. The experiments part was conducted using KNN, XGBoost, SVM (RBF), SVM (linear), MLP, Decision Tree (DT), RF, Adaptive Boosting (AdaBoost), Naïve Bayes (NB).…”

Section: Limitations and Research Gapmentioning

confidence: 99%

An efficient approach to detect distributed denial of service attacks for software defined internet of things combining autoencoder and extreme gradient boosting with feature selection and hyperparameter tuning optimization

Setitra

Fan

Bensalem

2023

Trans Emerging Tel Tech

View full text Add to dashboard Cite

The growing popularity of Software Defined Networks (SDN) and the Internet of Things (IoT) has led to the emergence of Software Defined Internet of Things (SDIoT) based on centralized network management by the Control Plane, which can handle the dynamic nature of IoT devices and the high volume of network traffic. However, due to their specific design, SDIoTs are the ideal target for Distributed Denial of Service (DDoS) attacks, becoming one of the most destructive threats. Machine learning (ML) techniques are best suited to solve this problem due to the recent growth and sophistication of DDoS attacks. In this study, we propose an enhanced deep learning approach based on combining AutoEncoder (AE) and Extreme Gradient Boosting (XGBoost). First, we applied the SHapley Additive exPlanations (SHAP) feature selection method to select the appropriate features subset according to their correlation results. Next, the AE is trained on the previous subset to learn a compact representation of the input features. The latent representation generated by the AE is then used as input for the XGBoost model, which is trained to predict the target variable and classify the traffic as usual or attack. In parallel, Grid Search Cross Validation (GSCV) is used to find the optimal hyperparameters for the AE‐XGBoost. The experimental results using two publicly available realistic SDN‐Iot datasets demonstrate that the proposed approach enables precise identification of DDoS attacks in SDIoT networks, achieving a 99.9920% accuracy, an F1 score of 0.999917, and a low false positive rate. Furthermore, the proposed model's performance exceeds that of the models used for comparison.

show abstract

“…The "built SDN cloud" uses software-defined networking to provide network resource flexibility, scalability, and control. It consists of four levels, each with its own specific functions [7]. Each layer's gadgets are different from one another [8].…”

Section: Introductionmentioning

confidence: 99%

Dual discriminator conditional sheep flock generative adversarial network-based intrusion detection system in MAC-based SDN framework

Nanavath

Bhattacharyya

2023

Preprint

View full text Add to dashboard Cite

Software-defined networking (SDN) technology enables and supports the 5G ecosystem, which is expected to handle a vast amount of sensitive data and provide connectivity to many users, making them more vulnerable to cyberattacks. Security measures, such as access control, encryption, authentication, and intrusion detection systems, must be implemented to protect network security against adversarial attacks. An intrusion detection system is a security technology designed to detect vulnerabilities in computer systems. Medium Access Control (MAC) addresses are required to identify and control access to specific devices on a network. Although there are various methods for intrusion detection, the most popular approaches have low accuracy. Therefore, a dual discriminator conditional sheep flock generative adversarial network-based intrusion detection system (IDS) in MAC-based SDN architecture is proposed to solve these issues and detect and prevent attacks. Initially, the 5G users authenticate with the help of the Four-Q-Curve algorithm. Next, the ideal switches are chosen to overcome the flow table overload using the univariate ensemble feature selection technique. Following this, a dual-discriminator conditional generative adversarial network (DC-GAN) is used to categorize selected features into normal, assault, and suspicious packets. The Sheep Flock Optimization Algorithm (SFOA) is used to optimize the DC-GAN. Then, the Growing Self-Organizing Map (GSOM) classifies the suspicious packets into normal and malicious packets. The experimental results show that the proposed method outperforms the existing methods in terms of accuracy, F1 score, sensitivity, and false alarm rate while ensuring low energy consumption and higher network throughput.

show abstract

ML‐IDSDN: Machine learning based intrusion detection system for software‐defined network

Cited by 28 publications

References 40 publications

MCAD: A Machine Learning Based Cyberattacks Detector in Software-Defined Networking (SDN) for Healthcare Systems

MCAD: A Machine Learning Based Cyberattacks Detector in Software-Defined Networking (SDN) for Healthcare Systems

An efficient approach to detect distributed denial of service attacks for software defined internet of things combining autoencoder and extreme gradient boosting with feature selection and hyperparameter tuning optimization

Dual discriminator conditional sheep flock generative adversarial network-based intrusion detection system in MAC-based SDN framework

Contact Info

Product

Resources

About