An efficient and interpretable intrusion detection framework for software-defined networks with multi-class...

Software-Defined Networks (SDNs) are already susceptible to cyber-attacks because of the weak security mechanisms and limited resources. This is predicted to be intensified in the Internet of Things era with a forecast of more than 29 billion connected devices in 2030, thereby broadening the threat surface significantly and making it increasingly difficult for cybersecurity solutions to address these threats. Conventional intrusion detection systems(IDSs) on SDNs are challenged by imbalanced multi-class data, high-dimensional and noisy features, and a lack of interpretability. To address these challenges, this study proposes a hybrid SDN-based IDS framework that integrates Generative Adversarial Networks (GANs) to handle imbalanced datasets, one-way ANOVA and Genetic Algorithm (GA) for feature selection, baseline classifier optimization using Grid Search and Explainable AI techniques such as SHapley Additive exPlanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), Morris sensitivity analysis and permutation combination to achieve robust, accurate, and interpretable intrusion detection. The grid search-optimized XGBoost model, denoted as OptiXGB-IDS, demonstrates high performance on the InSDN dataset, with a test accuracy of 99.87%, and macro-averaged precision, recall, and F1-score of 0.9618, 0.9951 and 0.9775 respectively. In addition, the model achieves a Cohen's kappa coefficient of 0.9982 and a Brier score of 0.0024, with an inference time of 0.026312 ms per flow. In order to further test cross-dataset robustness, the proposed framework was also validated on the CIC-IDS2017 dataset, where OptiXGB-IDS achieved the highest test accuracy of 98.70% and outperformed all other competing models. The proposed hybrid GA-GAN-XAI framework significantly improves the IDS performance by providing key traffic flow features and improving spatial and temporal feature learning, making it highly robust and providing a very precise and reliable solution for detecting complex and previously unseen cyber threats in SDN-based IoT environments.