Evaluation of Machine Learning Techniques for Security in SDN

Abstract

Software Defined Networking (SDN) has emerged as the most viable programmable network architecture to solve many challenges in legacy networks. SDN separates the network control plane from the data forwarding plane and logically centralizes the network control plane. The logically centralized control improves network management through global visibility of the network state. However, centralized control opens doors to security challenges. The SDN control platforms became the most attractive venues for Denial of Service (DoS) and Distributed DoS (DDoS) attacks. Due to the success and inevitable benefits of Machine Learning (ML) in fingerprinting security vulnerabilities, this article proposes and evaluates ML techniques to counter DoS and DDoS attacks in SDN. The ML techniques are evaluated in a practical setup where the SDN controller is exposed to DDoS attacks to draw important conclusions for ML-based security of future communication networks.

UGRansome1819: A Novel Dataset for Anomaly Detection and Zero-Day Threats

“…For instance, the degree of freedom of the Machine Learning model was not considered in [3] to evaluate the number of adjustable parameters or weights and [51] suggested to fine-tune "hyper-parameters" in the framework doing the learning, but it is still not an optimal evaluation approach. In [52,53], various assessment methods have been suggested to test and assess Machine Learning models without mentioning the confusion matrix. Recently, Maseer et al [54] have used the CICIDS 2017 dataset to evaluate the Machine Learning model but the time complexity and confusion matrix were not considered.…”

“…Recently, Maseer et al [54] have used the CICIDS 2017 dataset to evaluate the Machine Learning model but the time complexity and confusion matrix were not considered. The discussion of the validation drawbacks presented in [3,[51][52][53][54]] is summarised in Table 3. Reference Drawbacks [3] The time complexity was not considered.…”

“…[52] The confusion matrix was not considered. [53] Binary stratification was considered without confusion matrix. [54] The time complexity and confusion matrix are not considered.…”

Comparison of Machine Learning Techniques Applied to Traffic Prediction of Real Wireless Network

“…Ahnaf Ahmad et al [34] evaluated the application of several ML algorithms for Intrusion Detection Systems (IDS) in Software Defined Networks (SDN). SDN separates the network control and the data forwarding planes.…”

“…With changing data, some algorithms need other parameters or are not able to be executed efficiently [17], [18]. Traffic might be changed To use data preprocessing techniques such as OHE, Min-Max Scaling, and others Data quality related problems DP [47] To use a sliding window algorithm solving the problem of data imbalance [45] To train models on artificial labeled dataset and then use trained models on real world unlabeled data [34] To create a dataset with the traffic flow generator [36] To use random oversampling technique to create more data and solve the problem of the data imbalance A growing number of features that need processing HW, SW [30], [66], [67] To improve the hardware Overfitting DP [30] To remove irrelevant features or noise Potential neglection of critical features N [28] To employ the Diversity Coding-Network Coding (DC-NC) in the network that improves latency but not at the expense of reliability A for a unified interface and data formats A [35] Harmonization of interfaces Limited storage capacity A, HW [63] To move the unwanted inputs to backup storage/improve hardware The emergence of new types of input data A, DP [7], [17], [18], [35], [41], [66] Potential in using Unsupervised-and Reinforcement Learning Limited scalability of ML models DP, A, SW [35] To develop new algorithms better suited for complex systems Appearance of anomalies in the network operation DP [45], [47] Finding abnormal traffic patterns using machine learning algorithms [34], [50] Detecting attacks using data analysis algorithms A -Architecture N -Networking DP -Data Processing HW -Hardware specific SW -Software specific considering the development of heterogeneous networks, and ML algorithms might be able to handle new inputs.…”