Real-Time Network Traffic Classification With Learned Feature Imputation and SDN-Based Automated Response
Year: 2026
Type: article
Abstract: Real-time deployment of deep learning (DL)-based network intrusion detection systems (NIDS) is often limited by a feature-space mismatch between offline training datasets and online monitoring tools. Benchmark datasets commonly provide CICFlowMeter-style flow statistics, whereas operational monitors such as Zeek expose only a smaller set of real-time observable attributes. To address this gap, we propose an end-to-end workflow for multi-dimensional network traffic classification (NTC) that combines learned feature imputation (FI), TensorFlow Serving-based inference, and software-defined networking (SDN)-enabled response. Zeek-derived observable features are used by a lightweight TSMixer-inspired imputation model to reconstruct the missing CICFlowMeter-compatible attributes required by pre-trained classifiers. The completed feature vectors are normalized and sent through FastAPI to Docker-hosted Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) models for binary, attack-type, and application-level classification. Predictions are enforced through OpenFlow rules in a Ryu controller using confidence-aware actions: malicious flows with confidence above 80% are dropped, flows with confidence between 60% and 80% are paused, and flows with confidence below 60% are allowed. A Gradio dashboard supports real-time monitoring in a Mininet-based testbed. The system achieves 99.74% binary accuracy, 96.83% attack-classification accuracy, 98.39% application-classification accuracy, and maximum R2 = 0.9015 for continuous feature imputation. Once a completed flow record is available, the independently benchmarked processing stages yield a composed mean processing estimate of approximately 25.7 ms from feature completion, inference, network transmission, and SDN rule installation.
Authors: Sayed Shafiullah Sadat, Abdul Awal Quraishi, Mohammad Wasil Jalali, Iqbal Ahmadi, Mohammad Shah Omid
Institutions: Polytechnical University of Kabul, Kateb University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,075
OpenAlex ID: W7214601337