SDN-ATK: a novel SDN-specific attack dataset

Distributed Denial of Service (DDoS) attacks represent a major concern in modern Software Defined Networking (SDN), as SDN controllers are sensitive points of failures in the whole SDN architecture. Recently, research on DDoS attacks detection in SDN has focused on investigation of how to leverage data plane programmability, enabled by P4 language, to detect attacks directly in network switches, with marginal involvement of SDN controllers. In order to effectively address cybersecurity management in SDN architectures, we investigate the potential of Artificial Intelligence and Machine Learning (ML) algorithms to perform automated DDoS Attacks Detection (DAD), specifically focusing on Transmission Control Protocol SYN flood attacks. We compare two different DAD architectures, called Standalone and Correlated DAD, where traffic features collection and attack detection are performed locally at network switches or in a single entity (e.g., in SDN controller), respectively. We combine the capability of ML and P4-enabled data planes to implement real-time DAD. Illustrative numerical results show that, for all tested ML algorithms, accuracy, precision, recall and F1-score are above 98% in most cases, and classification time is in the order of few hundreds of upmu text {s} in the worst case. Considering real-time DAD implementation, significant latency reduction is obtained when features are extracted at the data plane by using P4 language.Graphic

Software Defined Networking (SDN) is a dynamic architecture that employs a variety of applications for making networks more adaptable and centrally controlled. It is easy to attack the entire network in SDN because the control plane and data plane are separated. DDoS attack is major danger to SDN service providers because it can shut down the entire network and stop services to all customers at any time. One of the key flaws of most SDN architectures is lack of susceptibility to DDoS attacks with its types like TCP flooding, UDP flooding, SYN flooding, ICMP flooding and DHCP flooding for detecting those kinds of attacks. The machine learning algorithms are widely used in recent years to identify DDoS attacks. This research utilizes Decision Tree Classifier for detection and classification of DDoS attacks on SDN. The Forward Feature Selection technique is also used in the research to select the best features from the dataset and from that dataset the data are employed to train and test the model by Decision Tree Classifier Algorithm. The decision Tree Classifier technique is a supervised method used to forecast desired values of observations using rudimentary machine learning decision rules derived from training data. Based on the accuracy of decision tree techniques, in future, a hybrid learning model will be designed for detecting the Distributed Denial of Services in an SDN environment with high accuracy and a low false negative rate.

Considering the problem that the SDN controller can not fully resolve the virtual network function during the Software Defined Network (SDN) and Network Function Virtualization (NVF) collaborative deployment in the satellite network, a SDN/NFV coordination based on the three-layer satellite network is designed. The framework extends the SDN controller function and proposes the SDN controller function extension method (SDN-FE) based on LightGBM algorithm. SDN-FE has extended the functions of the original SDN controller in three aspects. One is based on LightGBM to establish a classification model for intelligent forwarding of SDN controller data packets. The second is to learn and predict VNF modification of data packets through logistic regression. The third is to design an idle state monitoring mechanism. The above method effectively enhances the control capability of the SDN controller to the network. In terms of SDN packet forwarding classification, SDN-FE is compared with existing well-known machine learning classification algorithms such as SVM, random forest, LSTM. Simulation experiments show that the SDN packet forwarding classification problem is predictable. The average accuracy of the LightGBM model in multi-classification problems is over 69%, which is better than machine learning models such as SVM and random forest. The next step is to conduct an in-depth study of the packet rule learning algorithm in VNF.

The software defined network (SDN) collects network traffic data and proactively manages networks. SDN’s programmability makes it excellent for developing distributed applications, cybersecurity, and decentralized network control in multitenant data centers. This exceptional architecture is vulnerable to security concerns, such as distributed denial of service (DDoS) attacks. DDoS attacks can be very serious due to the fact that they prevent authentic users from accessing, temporarily or indefinitely, resources they would normally expect to have. Moreover, there are continuous efforts from attackers to produce new techniques to avoid detection. Furthermore, many existing DDoS detection methods now in use have a high potential for producing false positives. This motivates us to provide an overview of the research studies that have already been conducted in this area and point out the strengths and weaknesses of each of those approaches. Hence, adopting an optimal detection method is necessary to overcome these issues. Thus, it is crucial to accurately detect abnormal flows to maintain the availability and security of the network. In this work, we propose hybrid deep learning algorithms, which are the long short-term memory network (LSTM) and convolutional neural network (CNN) with a stack autoencoder for DDoS attack detection and checkpoint network, which is a fault tolerance strategy for long-running processes. The proposed approach is trained and tested with the aid of two DDoS attack datasets in the SDN environment: the DDoS attack SDN dataset and Botnet dataset. The results show that the proposed model achieves a very high accuracy, reaching 99.99% in training, 99.92% in validation, and 100% in precision, recall, and F1 score with the DDoS attack SDN dataset. Also, it achieves 100% in all metrics with the Botnet dataset. Experimental results reveal that our proposed model has a high feature extraction ability and high performance in detecting attacks. All performance metrics indicate that the proposed approach is appropriate for a real-world flow detection environment.

A novel approach for accurate detection of the DDoS attacks in SDN-based SCADA systems based on deep recurrent neural networks

The conventional criteria of Intrusion Detection Systems (IDS) need to evolve because they fail to detect modern cyber security threats adequately. The advantages of machine learning (ML) and deep learning (DL) models in IDS functionality are limited by the inability to provide explanations which prevents cybersecurity professionals from validating decisions. The research analyzes DL-based IDS performance and interpretability standards through the examination of the NSL-KDD dataset. A screening process identified models that combined high reliability and accuracy numbers as selection candidates. feedforward neural networks (FNN), convolutional neural networks (CNN), and recurrent neural networks (RNN)—findings revealed that CNN achieved the greatest accuracy of 94.2% along with an AUC of 0.97 exempting FNN (91.3%) and RNN (93.8%). The effective extraction of spatial features from network traffic data by CNN models leads to its higher performance. The "black-box" nature of CNNs within DL models makes them difficult to understand because they remain concealed from users. The research integrated local interpretable model-agnostic explanations (LIME) and Shapley additive explanations (SHAP) to interpret decisions at the feature level. The implemented methods did not result in substantial accuracy improvements yet they made classification decisions more trustworthy and understandable by indicating the important features involved. Furthermore, in these developments there exist technical obstacles associated with high processing expenses and performance versus deployment speed balancing requirements. Research initiatives should focus on developing explainability techniques that maintain high-performance rates and excellent interpretability in IDS systems.

Software Defined Networking (SDN) revolutionizes network control by separating the control plane from the data plane. Although the latter improves SDN agility and scalability, it creates a security hole, particularly in a central control plane, leading to SDN environments becoming high-profile targets for advanced cybersecurity threats. Due to static and signature-based point-in-time behavior, traditional security methods are unable to keep up with modern attacks that are an anomaly to SDNs. Artificial Intelligence (AI) with its different applications and techniques, has the capability of detecting SDN cyber threats’ anomalies. This paper presents the results of a literature scoping exercise that used a total of 54 papers that looked at AI-driven anomaly detection in SDN. The findings showed that control theory, activity theory, and anomaly detection theory are three theoretical aspects that contribute to the topic of AI-driven anomaly detection in SDN. Furthermore, different machine learning algorithms give different results. In this regard, Random Forest (RF), Support Vector Machine (SVM), and Multi-Layer Perceptron would help in detecting threats of a familiar nature, while autoencoders and K-means can detect unfamiliar threats. While deep learning architectures such as Long Short-Term Memory (LSTM) networks and Convolutional Neural Networks (CNN) support low-latency anomaly detection while maintaining throughput and network stability. The findings could be the basis of providing a conceptual framework on how an intelligent, adaptive, and resilient SDN with real-time threat defense mechanisms could be designed, developed, and deployed.

Software-defined networking (SDN) has reformed the traditional approach to managing and configuring networks by isolating the data plane from control plane. This isolation helps enable centralized control over network resources, enhanced programmability, and the ability to dynamically apply and enforce security and traffic policies. The shift in architecture offers numerous advantages such as increased flexibility, scalability, and improved network management but also introduces new and notable security challenges such as Distributed Denial-of-Service (DDoS) attacks. Such attacks focus on affecting the target with malicious traffic and even short-lived DDoS incidents can drastically impact the entire network’s stability, performance and availability. This comprehensive review paper provides a detailed investigation of SDN principles, the nature of DDoS threats in such environments and the strategies used to detect/mitigate these attacks. It provides novelty by offering an in-depth categorization of state-of-the-art detection techniques, utilizing machine learning, deep learning, and federated learning in domain-specific and general-purpose SDN scenarios. Each method is analyzed for its effectiveness. The paper further evaluates the strengths and weaknesses of these techniques, highlighting their applicability in different SDN contexts. In addition, the paper outlines the key performance metrics used in evaluating these detection mechanisms. Moreover, the novelty of the study is classifying the datasets commonly used for training and validating DDoS detection models into two major categories: legacy-compatible datasets that are adapted from traditional network environments, and SDN-contextual datasets that are specifically generated to reflect the characteristics of modern SDN systems. Finally, the paper suggests a few directions for future research. These include enhancing the robustness of detection models, integrating privacy-preserving techniques in collaborative learning, and developing more comprehensive and realistic SDN-specific datasets to improve the strength of SDN infrastructures against DDoS threats.

<title>Abstract</title> In today’s digital era, the proliferation of online services has rendered networks increasingly vulnerable to Distributed Denial-of-Service (DDoS) attacks, which can severely disrupt availability and cause significant economic and reputational losses. Software-Defined Networking (SDN), as a promising paradigm for programmable and flexible network management, offers both opportunities and challenges in mitigating such threats. However, the centralized architecture of SDN controllers exposes them to being prime targets for DDoS attacks, demanding advanced detection mechanisms. Traditional detection systems, often signature-based or threshold-based, struggle with novel or complex attack patterns, producing high false positive rates and insufficient detection accuracy. To address these limitations, this paper proposes a hybrid model that integrates Convolutional Neural Networks (CNNs) for feature extraction with Particle Swarm Optimization (PSO) for hyperparameter tuning, tailored for DDoS detection in SDN environments. The CNN leverages deep learning capabilities to automatically capture spatial patterns in traffic data, while PSO optimizes model parameters to enhance detection precision and reduce false alarms. Mathematical formulation of PSO is introduced to optimize CNN hyperparameters, achieving a 0.8% improvement in accuracy over baseline CNN. Experimental evaluations conducted in an SDN testbed using Mininet and the POX controller demonstrate that the proposed CNN-PSO model significantly outperforms baseline CNN and traditional machine learning approaches. The hybrid model achieves higher accuracy, improved F1-scores, and reduced false positive rates, confirming its potential as a scalable and intelligent defense mechanism against evolving DDoS threats in modern network infrastructures.

ObjectivesA radiomics-based explainable eXtreme Gradient Boosting (XGBoost) model was developed to predict central cervical lymph node metastasis (CCLNM) in patients with papillary thyroid carcinoma (PTC), including positive and negative effects.MethodsA total of 587 PTC patients admitted at Binzhou Medical University Hospital from 2017 to 2021 were analyzed retrospectively. The patients were randomized into the training and test cohorts with an 8:2 ratio. Radiomics features were extracted from ultrasound images of the primary PTC lesions. The minimum redundancy maximum relevance algorithm and the least absolute shrinkage and selection operator regression were used to select CCLNM positively-related features and radiomics scores were constructed. Clinical features, ultrasound features, and radiomics score were screened out by the Boruta algorithm, and the XGBoost model was constructed from these characteristics. SHapley Additive exPlanations (SHAP) was used for individualized and visualized interpretation. SHAP addressed the cognitive opacity of machine learning models.ResultsEleven radiomics features were used to calculate the radiomics score. Five critical elements were used to build the XGBoost model: capsular invasion, radiomics score, diameter, age, and calcification. The area under the curve was 91.53% and 90.88% in the training and test cohorts, respectively. SHAP plots showed the influence of each parameter on the XGBoost model, including positive (i.e., capsular invasion, radiomics score, diameter, and calcification) and negative (i.e., age) impacts. The XGBoost model outperformed the radiologist, increasing the AUC by 44%.ConclusionsThe radiomics-based XGBoost model predicted CCLNM in PTC patients. Visual interpretation using SHAP made the model an effective tool for preoperative guidance of clinical procedures, including positive and negative impacts.

Parkinson's disease (PD) is a progressive neurodegenerative disorder affecting millions worldwide. Early detection of PD is crucial for effective treatment and management of the disease. Deep learning (DL) and machine learning (ML) have emerged as promising approaches for detecting PD. In this study, a comparative performance analysis is done for DL and ML applications based on speech signals. DL methods using convolutional neural networks (CNNs), long short-term memory (LSTM) networks, and ML methods employing random forest and the XGBoost model were trained and assessed. Performance of the models are evaluated using a variety of performance metrics, including accuracy, precision, recall, and F1-score. Results showed that the XGBoost model outperformed the DL models in terms of accuracy and F1 score, while the CNN and LSTM models achieved higher precision and recall. These findings suggest that XGBoost can be a useful tool for detecting PD based on speech signals, particularly in scenarios where interpretability and computational efficiency are important.

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

Software Defined Networking (SDN) has revolutionized network administration by providing centralized management through software, enabling traffic adjustment independent of the data plane. Despite the benefits, SDN networks are prone to security threats from external sources, thus necessitating the implementation of security measures. Unfortunately, most existing efforts have been just a simple mapping of earlier solutions into the SDN environments. This paper addresses the problem of SDN security based on deep learning in a purely native SDN environment, where a Deep Learning intrusion detection module is tailored to a native SDN environment. In particular, we propose a hybrid Deep AutoEncoder with a Random Forest classifier model (DAERF) to enhance intrusion detection performance in a native SDN environment. The proposed model is incorporated into a novel adaptive framework for attack mitigation in SDN environments. The proposed framework consists of a three-layer protection mechanism for detecting and preventing attacks. It is based on entropy-based detection, hybrid machine learning in the control layer and proactive services monitoring in the application layer. Experimental results have shown that our DEARF proposed autoencoder model achieved anomaly detection rates in excess of 98% in stand-alone mode as well as when incorporated within the framework, making it highly solution for next generation SDN networks.

Software-Defined Networks (SDN) provides more control and network operation over a network infrastructure as an emerging and revolutionary paradigm in networking. Operating the many network applications and preserving the network services and functions, the SDN controller is regarded as the operating system of the SDN-based network architecture. The SDN has several security problems because of its intricate design, even with all its amazing features. Denial-of-service (DoS) attacks continuously impact users and Internet service providers (ISPs). Because of its centralized design, distributed denial of service (DDoS) attacks on SDN are frequent and may have a widespread effect on the network, particularly at the control layer. We propose to implement both MLP (Multilayer Perceptron) and CNN (Convolutional Neural Networks) based on conventional methods to detect the Denial of Services (DDoS) attack. These models have got a complex optimizer installed on them to decrease the false positive or DDoS case detection efficiency. We use the SHAP feature selection technique to improve the detection procedure. By assisting in the identification of which features are most essential to spot the incidents, the approach aids in the process of enhancing precision and flammability. Fine-tuning the hyperparameters with the help of Bayesian optimization to obtain the best model performance is another important thing that we do in our model. Two datasets, InSDN and CICDDoS-2019, are utilized to assess the effectiveness of the proposed method, 99.95% for the true positive (TP) of the CICDDoS-2019 dataset and 99.98% for the InSDN dataset, the results show that the model is highly accurate.

Purpose The purpose of the study concludes detecting address resolution protocol (ARP) Spoofing attack in software-defined network (SDN) architecture meanwhile using different machine learning models to evaluate their effectiveness. Design/methodology/approach This research originates from building a SDN topology and researching into its changes under ARP Spoofing attack. Based on that, the authors propose four features which show obvious abnormalities in network under attack stage. The data collected from SDN controller is used to build a data set, which is then put into different machine learning models, which are: Artificial Neuron network (ANN), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), CNN-LSTM and Gated Recurrent Unit (GRU). Findings After applying this proposal in simulation and experimental environments, they achieve impressive performance metrics. In simulation environment, the GRU model stands out with the highest accuracy of 98.94%. In real environments, the CNN-LSTM model leads with a recall of 98.38% and an F1-Score of 98.57%, while the LSTM model has the highest precision (98.8%). The GRU model also performs strongly in real scenarios with a high accuracy of 97.65%. ANN, despite its reliability, struggles with lower recall and F1-Score across both environments. Originality/value This analysis emphasizes the importance of the proposed features when applied to different models and their high potential to conduct in practical environment.