Leveraging the Power of Machine Learning Techniques for Intrusion Detection in Software-Defined Networks

The complexity of handling modern apps is causing older network architectures to struggle. As a result, Software Defined Networking (SDN) has developed into a paradigm-shifting network framework that enables administrators to exercise programmable control over whole network infrastructures. This development makes it easier to configure and operate large networks, but it also adds vulnerabilities, including the possibility of Distributed Denial of Service (DDoS) assaults that could take down the SDN controller. Integrating security tools like firewalls, intrusion detection and prevention systems, and anti-DDoS solutions is crucial to reducing this danger. In the context of SDN, leveraging the analytical power of Machine Learning (ML) algorithms to analyse network traffic patterns is a key tactic for fending off DDoS attacks. Effective defence systems are supported by these ML models, which can distinguish between normal network behaviour and DDoS assault traffic with ease. Decision trees (DT), support vector machines (SVM), and artificial neural networks (ANN) are examples of supervised ML techniques that have evolved into crucial tools in this field. These algorithms are developed utilising datasets with annotations that include examples of both legitimate and malicious network traffic. Once trained, the models may be used to instantly categorise incoming traffic, making it easier to identify and contain any DDoS attacks in real-time.

The evolution from conventional network frameworks to Software-Defined Networks (SDNs) marks a pivotal shift in network management. SDNs offer a unique architecture where a centralized controller orchestrates network traffic, separating the control plane from the data plane. This architecture not only brings enhanced flexibility, agility, and scalability to network operations but also introduces specific security challenges, primarily due to the centralization of control, which can be a potential Single Point of Failures (SPOFs). Addressing these security concerns, this paper introduces an innovative machine learning-based Intrusion Detection System (IDS) tailored for SDNs, by proposing a three-stage CatBoost Classifier (3CC). This classifier is specifically designed for efficient and effective intrusion and vulnerability detection within SDN environments. The multistage aspect of the classifier allows for refined and detailed analysis, catering to a diverse array of attack vectors. Another key feature of our approach is the utilization of real-world data from SDN environments, which ensures that our model is tested and validated under realistic and current conditions. Furthermore, the integration of GPU acceleration significantly enhances the training speed of our model, a critical factor given the voluminous nature of network data. The proposed model, 3CC, demonstrates remarkable performance in our evaluations, achieving an accuracy of 99.8966%. This high level of precision in detecting and identifying various network intrusions and vulnerabilities underlines the efficacy of our approach. Our paper contributes significantly to the field of SDN security, offering a sophisticated, multistage classification solution that leverages the latest in machine learning techniques and real-world applicability.

Performance evaluation of machine learning techniques in predicting cumulative absolute velocity

Distributed Denial of Service (DDoS) attacks represent a major concern in modern Software Defined Networking (SDN), as SDN controllers are sensitive points of failures in the whole SDN architecture. Recently, research on DDoS attacks detection in SDN has focused on investigation of how to leverage data plane programmability, enabled by P4 language, to detect attacks directly in network switches, with marginal involvement of SDN controllers. In order to effectively address cybersecurity management in SDN architectures, we investigate the potential of Artificial Intelligence and Machine Learning (ML) algorithms to perform automated DDoS Attacks Detection (DAD), specifically focusing on Transmission Control Protocol SYN flood attacks. We compare two different DAD architectures, called Standalone and Correlated DAD, where traffic features collection and attack detection are performed locally at network switches or in a single entity (e.g., in SDN controller), respectively. We combine the capability of ML and P4-enabled data planes to implement real-time DAD. Illustrative numerical results show that, for all tested ML algorithms, accuracy, precision, recall and F1-score are above 98% in most cases, and classification time is in the order of few hundreds of upmu text {s} in the worst case. Considering real-time DAD implementation, significant latency reduction is obtained when features are extracted at the data plane by using P4 language.Graphic

Research methods in machine learning play a pivotal role since the accuracy and reliability of the results are influenced by the research methods used. The main aims of this paper were to explore current research methods in machine learning, emerging themes, and the implications of those themes in machine learning research. To achieve this the researchers analyzed a total of 100 articles published since 2021 in IEEE journals. This study revealed that Machine learning uses quantitative research methods with experimental research design being the de facto research approach. The study also revealed that researchers nowadays use more than one algorithm to address a problem. Optimal feature selection has also emerged to be a key thing that researchers are using to optimize the performance of Machine learning algorithms. Confusion matrix and its derivatives are still the main ways used to evaluate the performance of algorithms, although researchers are now also considering the processing time taken by an algorithm to execute. Python programming languages together with its libraries are the most used tools in creating, training, and testing models. The most used algorithms in addressing both classification and prediction problems are; Naïve Bayes, Support Vector Machine, Random Forest, Artificial Neural Networks, and Decision Tree. The recurring themes identified in this study are likely to open new frontiers in Machine learning research. Keywords: Research methods in machine learning, machine learning algorithms, machine learning techniques.

Software-Defined Networking (SDN) is a promising solution for large-scale network management that offers extensive opportunities for optimization. However, the centralized control inherent in SDN also exposes networks to security threats, notably Distributed Denial of Service (DDoS) attacks. To address these challenges, machine learning (ML) techniques have emerged as potent tools for anomaly detection and mitigation. This paper proposes a novel approach for traffic classification within SDN environments that distinguishes between benign and malicious traffic using supervised ML techniques. This study introduces a unique dataset tailored for DDoS attack detection, overcoming the limitations of existing datasets, such as unrealistic topologies and lack of public availability. Benchmarking against the CICDDoS2019 dataset validated the efficacy and relevance of the custom dataset. This research has significant implications for real-world applications, offering improved capabilities for detecting and mitigating DDoS attacks in SDN infrastructure. Experimental results demonstrated the effectiveness of the proposed random forest model, achieving a remarkable accuracy of 98.97% and a minimal False Alarm Rate (FAR) of 0.023. These findings underscore the potential of ML-based approaches in enhancing network security and resilience against DDoS attacks in SDN environments, paving the way for future advancements in network-defense strategies.

ABSTRACTThis paper reviews the activity-travel behaviour literature that employs Machine Learning (ML) techniques for empirical analysis and modelling. Machine Learning algorithms, which attempt to build intelligence utilizing the availability of large amounts of data, have emerged as powerful tools in the fields of pattern recognition and big data analysis. These techniques have been applied in activity-travel behaviour studies since the early ’90s when Artificial Neural Networks (ANN) were employed to model mode choice decisions. AMOS, an activity-based modelling system developed in the mid-’90s, has ANN at its core to model and predict individual responses to travel demand management measures. In the dawn of 2000, ALBATROSS, a comprehensive activity-based travel demand modelling system, was proposed by Arentze and Timmermans using Decision Trees. Since then researchers have been exploring ML techniques like Support Vector Machines (SVM), Decision Trees (DT), Neural Networks (NN), Bayes Classifiers, and more recently, Ensemble Learners to model and predict activity-travel behaviour. A large number of publications over the years and an upward trend in the number of published articles over time indicate that Machine Learning is a promising tool for activity-travel behaviour analysis and prediction. This article, first of its kind in the literature, reviews these studies and explores the trends in activity-travel behaviour research that apply ML techniques. The review finds that mode choice decisions have received wide attention in the literature on ML applications. It was observed that most of the studies identify the lack of interpretability as a serious shortcoming in ML techniques. However, very few studies have attempted to improve the interpretability of the models. Further, some studies report the importance of feature engineering in ML-based studies, but very few studies adopt feature engineering before model development. Spatiotemporal transferability of models is another issue that has received minimal attention in the literature. In the end, the paper discusses possible directions for future research in the area of activity-travel behaviour modelling using ML techniques.

Parameter importance assessment improves efficacy of machine learning methods for predicting snow avalanche sites in Leh-Manali Highway, India

Air pollution in Macau has become a serious problem following the Pearl River Delta’s (PRD) rapid industrialization that began in the 1990s. With this in mind, Macau needs an air quality forecast system that accurately predicts pollutant concentration during the occurrence of pollution episodes to warn the public ahead of time. Five different state-of-the-art machine learning (ML) algorithms were applied to create predictive models to forecast PM2.5, PM10, and CO concentrations for the next 24 and 48 h, which included artificial neural networks (ANN), random forest (RF), extreme gradient boosting (XGBoost), support vector machine (SVM), and multiple linear regression (MLR), to determine the best ML algorithms for the respective pollutants and time scale. The diurnal measurements of air quality data in Macau from 2016 to 2021 were obtained for this work. The 2020 and 2021 datasets were used for model testing, while the four-year data before 2020 and 2021 were used to build and train the ML models. Results show that the ANN, RF, XGBoost, SVM, and MLR models were able to provide good performance in building up a 24-h forecast with a higher coefficient of determination (R2) and lower root mean square error (RMSE), mean absolute error (MAE), and biases (BIAS). Meanwhile, all the ML models in the 48-h forecasting performance were satisfactory enough to be accepted as a two-day continuous forecast even if the R2 value was lower than the 24-h forecast. The 48-h forecasting model could be further improved by proper feature selection based on the 24-h dataset, using the Shapley Additive Explanations (SHAP) value test and the adjusted R2 value of the 48-h forecasting model. In conclusion, the above five ML algorithms were able to successfully forecast the 24 and 48 h of pollutant concentration in Macau, with the RF and SVM models performing the best in the prediction of PM2.5 and PM10, and CO in both 24 and 48-h forecasts.

Software Defined Networking (SDN) is a dynamic architecture that employs a variety of applications for making networks more adaptable and centrally controlled. It is easy to attack the entire network in SDN because the control plane and data plane are separated. DDoS attack is major danger to SDN service providers because it can shut down the entire network and stop services to all customers at any time. One of the key flaws of most SDN architectures is lack of susceptibility to DDoS attacks with its types like TCP flooding, UDP flooding, SYN flooding, ICMP flooding and DHCP flooding for detecting those kinds of attacks. The machine learning algorithms are widely used in recent years to identify DDoS attacks. This research utilizes Decision Tree Classifier for detection and classification of DDoS attacks on SDN. The Forward Feature Selection technique is also used in the research to select the best features from the dataset and from that dataset the data are employed to train and test the model by Decision Tree Classifier Algorithm. The decision Tree Classifier technique is a supervised method used to forecast desired values of observations using rudimentary machine learning decision rules derived from training data. Based on the accuracy of decision tree techniques, in future, a hybrid learning model will be designed for detecting the Distributed Denial of Services in an SDN environment with high accuracy and a low false negative rate.

Biogas plant operators often face huge challenges in the monitoring, controlling and optimisation of the anaerobic digestion (AD) process, as it is very sensitive to surrounding changes, which often leads to process failure and adversely affects biogas production. Conventional implemented methods and mechanistic models are impractical and find it difficult to model the nonlinear and intricate interactions of the AD process. Thus, the development of machine learning (ML) algorithms has attracted considerable interest in the areas of process optimization, real-time monitoring, perturbation detection and parameter prediction. This paper provides a comprehensive and up-to-date overview of different machine learning algorithms, including artificial neural network (ANN), fuzzy logic (FL), adaptive network-based fuzzy inference system (ANFIS), support vector machine (SVM), genetic algorithm (GA) and particle swarm optimization (PSO) in terms of working mechanism, structure, advantages and disadvantages, as well as their prediction performances in modelling the biogas production. A few recent case studies of their applications and limitations are also critically reviewed and compared, providing useful information and recommendation in the selection and application of different ML algorithms. This review shows that the prediction efficiency of different ML algorithms is greatly impacted by variations in the reactor configurations, operating conditions, influent characteristics, selection of input parameters and network architectures. It is recommended to incorporate mixed liquor volatile suspended solids (MLVSS) concentration of the anaerobic digester (ranging from 16,500 to 46,700mg/L) as one of the input parameters to improve the prediction efficiency of ML modelling. This review also shows that the combination of different ML algorithms (i.e. hybrid GA-ANN model) could yield better accuracy with higher R2 (0.9986) than conventional algorithms and could improve the optimization model of AD. Besides, future works could be focused on the incorporation of an integrated digital twin system coupled with ML techniques into the existing Supervisory Control and Data Acquisition (SCADA) system of any biogas plant to detect any operational abnormalities and prevent digester upsets.

This study presents the development of a realistic and comprehensive SDN-ATK dataset designed to evaluate the effectiveness of machine learning (ML) and deep learning (DL) approaches for attack detection in Software-Defined Networking (SDN) environments. Unlike existing datasets, SDN-ATK explicitly includes attacks targeting key SDN components such as SDN controllers and OpenFlow switches, addressing a critical gap in current research. We evaluated three ML (XGBoost, Random Forest, and Decision Tree) and three DL (Convolutional Neural Network (CNN), Feed-forward Neural Network (FNN), and Long Short-Term Memory (LSTM)) algorithms across binary and multiclass classification tasks to assess detection performance. Our results demonstrate that DL models, particularly FNN and CNN outperform ML counterparts, achieving 98–99% accuracy, precision, and recall in binary classification. Explainability analyses were conducted using SHAP (SHapley Additive explanations) on the XGBoost model, offering valuable insights into the importance of feature and improving transparency in ML-based attack detection. The study’s findings provide critical guidance for both academia and industry, highlighting that within our Ryu-based SDN testbed, DL models demonstrated more reliable and balanced performance for large-scale attack detection. This work lays a solid foundation for future research, including developing real-time, intelligent, and explainable intrusion detection systems for SDN environments.

Machine learning (ML) techniques are essential in the detection of network attacks and enhancing network security. A device or software that recognizes any unusual pattern in the network and alerts the user about the same is an intrusion detection system (IDS). In this chapter, we have described the use of ML classification algorithms on the UNSW-NB15 dataset, leading to the generation of a network intrusion detection model which classifies incoming traffic into malicious or non-malicious traffic and issues an alert to the user. We have implemented the following ML algorithms – support vector machine, artificial neural network, and one-class support vector machine with an average accuracy of 89.25%, 91.54%, and 93.05%, respectively. Two graphical user interfaces (online and offline versions) have been developed for the system. Thus, the chapter proposes an optimized intrusion detection system that improves upon the existing intrusion detection systems which detect malicious packets in the network.

An intrusion detection system (IDS) is an essential component of any modern network. The purpose of an IDS is to detect intrusion and generate appropriate alarms so that the intrusion can be mitigated. Implementing an IDS in a Software Defined Network (SDN) is easier since an SDN controller has a centralized view of the whole network. Researchers have made many efforts to use machine learning (ML) for developing network-based IDS in SDN. The network-based IDS analyzes different characteristics of incoming network traffic to detect intrusion. Early detection of intrusion is crucial for an IDS because if the intrusion is not detected quickly enough, it can cause severe damage, such as data breaches and service shutdowns. This paper focuses on detecting intrusion in SDN as early as possible using real-time flow-based features. Our aim is to detect intrusion with less amount of packets per flow, which not only facilitates early intrusion detection but also is useful when an intrusion flow has less number of packets. We show that although ML models perform well in offline training on a dataset, their performance decreases ~25% when fewer packets are used to generate features for the ML model. In all our experiments, a simple Random Forest (RF) algorithm outperforms a complex deep learning model on a publicly available dataset for intrusion detection in SDN.

ObjectiveEnhanced technology in computer and internet has driven scale and quality of data to be improved in various areas including healthcare sectors. Machine Learning (ML) has played a pivotal role in efficiently analyzing those big data, but a general misunderstanding of ML algorithms still exists in applying them (e.g., ML techniques can settle a problem of small sample size, or deep learning is the ML algorithm). This paper reviewed the research of diagnosing mental illness using ML algorithm and suggests how ML techniques can be employed and worked in practice.MethodsResearches about mental illness diagnostic using ML techniques were carefully reviewed. Five traditional ML algorithms-Support Vector Machines (SVM), Gradient Boosting Machine (GBM), Random Forest, Naïve Bayes, and K-Nearest Neighborhood (KNN)-frequently used for mental health area researches were systematically organized and summarized.ResultsBased on literature review, it turned out that Support Vector Machines (SVM), Gradient Boosting Machine (GBM), Random Forest, Naïve Bayes, and K-Nearest Neighborhood (KNN) were frequently employed in mental health area, but many researchers did not clarify the reason for using their ML algorithm though every ML algorithm has its own advantages. In addition, there were several studies to apply ML algorithms without fully understanding the data characteristics.ConclusionResearchers using ML algorithms should be aware of the properties of their ML algorithms and the limitation of the results they obtained under restricted data conditions. This paper provides useful information of the properties and limitation of each ML algorithm in the practice of mental health.