Ataa M Sami, Sanad Eman E, El-Khoribi Reda A
Fuclty of Computers and Artificial Intelligence, Cairo University, Giza, Egypt.
Sci Rep. 2024 Nov 25;14(1):29159. doi: 10.1038/s41598-024-79001-1.
Ensuring robust network security is crucial in the context of Software-Defined Networking(SDN). Which, becomes a multi-billion dollar industry, and it's deployed in many data centers nowadays. The new technology provides network programmability, network centralized control, and a global view of the network. But, unfortunately, it comes with new vulnerabilities, and new attack vectors compared to the traditional network. SDN network cybersecurity became a trending research topic due to the hype of Machine Learning (ML) when a group of Machine Learning(ML) techniques called Deep Learning(DL) started to take shape in the setting of SDN networks. This paper focuses on developing advanced Deep Learning(DL) models to address the inherent new attack vectors. In this paper, we have built and compared two models that can be used for building a complete Intrusion Detection System(IDS) solution, one using a hybrid CNN-LSTM architecture and the other using Transformer encoder-only architecture. We specifically target the SDN controller where it represents a crucial point. We utilized the InSDN dataset for training and testing our models, this dataset captures real-world traffic within the SDN environment. For evaluation, we have used accuracy, precision, recall, and F1 Score. Our experiment results show that the Transformer model with 48 features achieves the highest accuracy at 99.02%, while the CNN-LSTM model achieves 99.01%. We have reduced the features to 6 and 4, which gave us varying impacts on the models' performance. We have merged 4 poorly represented attacks in one class, which enhanced the accuracy by a significant score. Additionally, we investigate binary classification by merging all attack types into a single class, as a result, the accuracy increased for both models. The CNN-LSTM model achieves the best results with an accuracy of 99.19% for 6 feature sets, this enhances the state-of-the-art results.
在软件定义网络（SDN）的背景下，确保强大的网络安全至关重要。SDN已成为一个价值数十亿美元的行业，如今已部署在许多数据中心。这项新技术提供了网络可编程性、网络集中控制以及网络的全局视图。但不幸的是，与传统网络相比，它带来了新的漏洞和新的攻击向量。由于机器学习（ML）的热潮，当一组称为深度学习（DL）的机器学习技术在SDN网络环境中开始形成时，SDN网络网络安全成为一个热门研究课题。本文专注于开发先进的深度学习（DL）模型，以应对固有的新攻击向量。在本文中，我们构建并比较了两个可用于构建完整入侵检测系统（IDS）解决方案的模型，一个使用混合CNN-LSTM架构，另一个使用仅含Transformer编码器的架构。我们特别针对SDN控制器，因为它是一个关键点。我们利用InSDN数据集来训练和测试我们的模型，该数据集捕获了SDN环境中的真实流量。为了进行评估，我们使用了准确率、精确率、召回率和F1分数。我们的实验结果表明，具有48个特征的Transformer模型达到了最高准确率，为99.02%，而CNN-LSTM模型达到了99.01%。我们将特征减少到6个和4个，这对模型性能产生了不同的影响。我们将4种代表性不足的攻击合并为一类，这显著提高了准确率。此外，我们通过将所有攻击类型合并为一个单一类别来研究二分类，结果，两个模型的准确率都有所提高。对于6个特征集，CNN-LSTM模型取得了最佳结果，准确率为99.19%，这提升了当前的最优结果。
