Intrusion detection in software defined network using deep learning approaches.

Area of Science:

• Cybersecurity
• Machine Learning
• Computer Networks

Background:

• Software-Defined Networking (SDN) offers programmability and centralized control but introduces new vulnerabilities.
• Machine Learning (ML), particularly Deep Learning (DL), is increasingly applied to address SDN security challenges.
• Intrusion Detection Systems (IDS) are critical for identifying and mitigating threats in SDN environments.

Purpose of the Study:

• To develop and compare advanced Deep Learning (DL) models for enhanced intrusion detection in SDN networks.
• To evaluate the performance of hybrid CNN-LSTM and Transformer encoder-only architectures for SDN security.
• To investigate the impact of feature reduction and attack class merging on model accuracy.

Main Methods:

• Developed and compared two DL models: a hybrid CNN-LSTM architecture and a Transformer encoder-only architecture.
• Utilized the InSDN dataset for training and testing, focusing on the SDN controller.
• Evaluated models using accuracy, precision, recall, and F1 Score, including experiments with reduced features and merged attack classes.

Main Results:

• The Transformer model achieved 99.02% accuracy with 48 features; the CNN-LSTM model achieved 99.01%.
• Feature reduction impacted model performance, with the CNN-LSTM model reaching 99.19% accuracy using 6 features after merging attack classes.
• Binary classification (merging all attacks) further increased accuracy for both models, enhancing state-of-the-art results.

Conclusions:

• Advanced DL models, particularly Transformer and CNN-LSTM architectures, show high efficacy in detecting intrusions in SDN networks.
• Feature engineering and strategic merging of attack classes can significantly improve IDS performance.
• The developed models offer a robust solution for enhancing SDN network cybersecurity.