Year: 2024
Type: article
Abstract: Software Defined Networks (SDNs) have revolutionized the way modern networks are managed and orchestrated. This sophisticated infrastructure can provide numerous benefits but at the same time introduce several security challenges. A centralized controller holds the responsibility of managing the network traffic, thus making it an attractive target to attackers. Intrusion Detection Systems (IDSs) play a crucial role in identifying and addressing security threats within the SDN. In this paper, we developed an SDN-IDS system by utilizing machine learning techniques for anomaly detection to identify deviations in network behavior. This is specifically challenging due to the fact that we only have a few samples from several of the attack classes, i.e. minority classes. Five machine learning algorithms were employed to train the SDN-IDS, and ultimately the most appropriate one was chosen. Moreover, we applied the SMOTE and Tomek link re-samplings on the dataset as well as a cost-sensitive learning technique to enhance the classification performance of the minority attacks. The Decision Tree (DT) model, trained on a feature-reduced and resampled dataset using cost-sensitive learning, achieved an impressive overall performance with 99.87% accuracy and an F1-score of 99.87. Additionally, it demonstrated a classification accuracy above 99% in identifying 11 out of the 15 possible traffic classes.
DOI: 10.52953/uqwk9413
Authors: Sotiris Chatzimiltis, Suraj Rohira Lucas, Mohammad Shojafar, Mahdi Boloursaz Mashhadi, Rahim Tafazolli
Institution: University of Surrey
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W4405578422