Designing a Network Intrusion Detection System Based on Machine Learning for Software Defined Networks

Abstract

Software-defined Networking (SDN) has recently developed and been put forward as a promising and encouraging solution for future internet architecture. Managed, the centralized and controlled network has become more flexible and visible using SDN. On the other hand, these advantages bring us a more vulnerable environment and dangerous threats, causing network breakdowns, systems paralysis, online banking frauds and robberies. These issues have a significantly destructive impact on organizations, companies or even economies. Accuracy, high performance and real-time systems are essential to achieve this goal successfully. Extending intelligent machine learning algorithms in a network intrusion detection system (NIDS) through a software-defined network (SDN) has attracted considerable attention in the last decade. Big data availability, the diversity of data analysis techniques, and the massive improvement in the machine learning algorithms enable the building of an effective, reliable and dependable system for detecting different types of attacks that frequently target networks. This study demonstrates the use of machine learning algorithms for traffic monitoring to detect malicious behavior in the network as part of NIDS in the SDN controller. Different classical and advanced tree-based machine learning techniques, Decision Tree, Random Forest and XGBoost are chosen to demonstrate attack detection. The NSL-KDD dataset is used for training and testing the proposed methods; it is considered a benchmarking dataset for several state-of-the-art approaches in NIDS. Several advanced preprocessing techniques are performed on the dataset in order to extract the best form of the data, which produces outstanding results compared to other systems. Using just five out of 41 features of NSL-KDD, a multi-class classification task is conducted by detecting whether there is an attack and classifying the type of attack (DDoS, PROBE, R2L, and U2R), accomplishing an accuracy of 95.95%.

Accuracy Based Fault Tolerant Two Phase - Intrusion Detection System (TP-IDS) Using Machine Learning and HDFS

“…The significant results about the same are explained in results and discussion section. [26]. NSL KDD consists of mainly records of Normal, DOS, Probe attack types, R2L, U2R.…”

Enriched intuitionistic fuzzy rule pruning using butterfly optimization for rule pruning in intrusion detection

“…The C4.5 decision tree is also involved in detection of IDS. Bridges et al [10] performed a detail survey on leverage host-based data sources for identifying attacks on commercial network. In this work a targeted sub survey of host-based intrusion detection and using publicly available system calls are considered in this study.…”

A Survey on Network-Based Intrusion Detection Systems Using Machine Learning Algorithms

“…It has recently been used to construct highly fast and accurate classification NIDS models. Alzahrani et al [10]proposed an XGboost-based classification model for NIDS in software-defined networks. The study [10] showed that the proposed XGBoost model outperformed more than seven algorithms used in NIDS while using six different evaluation metrics.…”

“…AbdulsalamAlzahrani et al [10] presented a study demonstrating the use of machine learning methods for traffic monitoring as part of a network intrusion detection system in the software-defined networks controller to detect malicious activities in the network. Three different tree-based machine learning approaches, Decision Tree, Random Forest, and XGBoost, were used to show attack detection.…”