DMSTG-AD: an SDN intrusion detection method based on dynamic multi-scale spatio-temporal graph neural network.

Area of Science:

• Computer Science
• Network Security
• Artificial Intelligence

Background:

• Software-defined networking (SDN) simplifies management but increases vulnerability to sophisticated cyberattacks.
• Traditional intrusion detection systems struggle with the dynamic and complex nature of network traffic in SDN environments.
• Existing methods often fail to capture intricate topological dependencies and temporal patterns.

Purpose of the Study:

• To propose a novel dynamic multi-scale spatio-temporal graph neural network (DMSTG-AD) framework for enhanced intrusion detection in SDN.
• To address the limitations of conventional methods in analyzing complex network traffic dynamics.
• To improve the accuracy and efficiency of detecting various network intrusions.

Main Methods:

• Developed a DMSTG-AD framework utilizing Gated Recurrent Unit (GRU)-driven dynamic node embeddings and an adaptive adjacency matrix.
• Employed edge-node collaborative convolution for spatial dependency extraction.
• Integrated multi-scale dilated convolutions and bidirectional GRU for temporal pattern analysis.
• Implemented a spatio-temporal cross-attention mechanism to fuse spatial and temporal features.

Main Results:

• Achieved 99.34% multi-classification accuracy on the CIC-IDS2017 dataset.
• Attained 99.88% overall accuracy on the InSDN dataset.
• Demonstrated significant performance improvements over existing mainstream intrusion detection methods.
• Ablation studies confirmed the effectiveness of dynamic modeling, dual-channel feature extraction, and cross-attention.

Conclusions:

• The proposed DMSTG-AD framework offers a highly accurate approach for intrusion detection in SDN environments.
• Dynamic graph neural networks show significant potential for advancing network security.
• The study provides a robust solution for detecting complex network anomalies and improving overall network defense.