Department of Computer Science, Hanyang University, Seoul 04763, Korea.
Department of Computer Science, COMSATS University Islamabad, Vehari Campus, Vehari 61100, Pakistan.
Sensors (Basel). 2022 Nov 2;22(21):8434. doi: 10.3390/s22218434.
Software-defined networking (SDN) has gained tremendous growth and can be exploited in different network scenarios, from data centers to wide-area 5G networks. It shifts control logic from the devices to a centralized entity (programmable controller) for efficient traffic monitoring and flow management. A software-based controller enforces rules and policies on the requests sent by forwarding elements; however, it cannot detect anomalous patterns in the network traffic. Due to this, the controller may install the flow rules against the anomalies, reducing the overall network performance. These anomalies may indicate threats to the network and decrease its performance and security. Machine learning (ML) approaches can identify such traffic flow patterns and predict the systems' impending threats. We propose an ML-based service to predict traffic anomalies for software-defined networks in this work. We first create a large dataset for network traffic by modeling a programmable data center with a signature-based intrusion-detection system. The feature vectors are pre-processed and are constructed against each flow request by the forwarding element. Then, we input the feature vector of each request to a machine learning classifier for training to predict anomalies. Finally, we use the holdout cross-validation technique to evaluate the proposed approach. The evaluation results specify that the proposed approach is highly accurate. In contrast to baseline approaches (random prediction and zero rule), the performance improvement of the proposed approach in average accuracy, precision, recall, and f-measure is (54.14%, 65.30%, 81.63%, and 73.70%) and (4.61%, 11.13%, 9.45%, and 10.29%), respectively.
软件定义网络 (SDN) 得到了迅猛的发展，可以应用于从数据中心到广域网 5G 网络等各种网络场景。它将控制逻辑从设备转移到集中式实体（可编程控制器），以实现高效的流量监控和流管理。基于软件的控制器对转发元素发送的请求实施规则和策略；但是，它无法检测网络流量中的异常模式。由于这个原因，控制器可能会针对异常情况安装流规则，从而降低整体网络性能。这些异常可能表示对网络的威胁，降低网络的性能和安全性。机器学习 (ML) 方法可以识别这些流量模式并预测系统即将面临的威胁。在这项工作中，我们提出了一种基于机器学习的服务，用于预测软件定义网络中的流量异常。我们首先通过使用基于签名的入侵检测系统对可编程数据中心进行建模，创建一个大型网络流量数据集。特征向量经过预处理，并针对转发元素的每个流请求进行构建。然后，我们将每个请求的特征向量输入到机器学习分类器中进行训练，以预测异常。最后，我们使用留一交叉验证技术来评估所提出的方法。评估结果表明，所提出的方法具有很高的准确性。与基线方法（随机预测和零规则）相比，所提出方法在平均准确率、精度、召回率和 F1 分数方面的性能提升分别为（54.14%、65.30%、81.63%和 73.70%）和（4.61%、11.13%、9.45%和 10.29%）。
