Hybrid Deep Learning: An Efficient Reconnaissance and Surveillance Detection Mechanism in SDN

Abstract

Software defined network (SDN) centralized control intelligence and network abstraction aims to facilitate applications, service deployment, programmability, innovation and ease in configuration management of the underlying networks. However, the centralized control intelligence and programmability is primarily a potential target for the evolving cyber threats and attacks to throw the entire network into chaos. The authors propose a control plane-based orchestration for varied sophisticated threats and attacks. The proposed mechanism comprises of a hybrid Cuda-enabled DL-driven architecture that utilizes the predictive power of Long short-term memory (LSTM) and Convolutional Neural Network (CNN) for an efficient and timely detection of multi-vector threats and attacks. A current state of the art dataset CICIDS2017 and standard performance evaluation metrics have been employed to thoroughly evaluate the proposed mechanism. We rigorously compared our proposed technique with our constructed hybrid DL-architectures and current benchmark algorithms. Our analysis shows that the proposed approach outperforms in terms of detection accuracy with a trivial trade-off speed efficiency. We also performed a 10-fold cross validation to explicitly show unbiased results. INDEX TERMS Security, hybrid deep learning model, software defined networks, long short-term memory, convolutional neural network.

Deep Neural Network (DNN) Solution for Real-time Detection of Distributed Denial of Service (DDoS) Attacks in Software Defined Networks (SDNs)

“…According to [9], deep learning-based Convolution Neural Network (CNN) intrusion detection system can be used to predict DDoS attacks in SDN. Malik et al [3] state that the CNN model trained using the NSL-KDD dataset can be deployed in an SDN environment and produce a detection accuracy of 70%. Garg et al [2] states that deep learning Restricted Boltzmann Machine (RBM) and KDD 99 dataset can detect anomalies in real-time.…”

“…The ever-expanding web, emerging of Internet of Things (IoT) and the rise of social media require reliable, flexible, and scalable network [2]. Public and private network traffic is growing every day which has complexity during implementation, hence the requirement of programmability and central management network architecture [3]. As the name SDN suggests, it is a computer network implemented and centrally managed by software through programming [4].…”

“…Whenever they are innovative, attackers always try to stay in the loop by inventing new attack methods that are directed to the innovation. Attackers have changed their attacking methods from single-vector attacks to multi-vector attacks [3]. The central programmability also comes with new cyber-attacks challenges because of a single point of failure.…”

“…The central programmability also comes with new cyber-attacks challenges because of a single point of failure. Attackers can target the controller by flooding it with a huge amount of attack to make it unavailable for legitimate users [3].…”

“…Distributed Denial of Service (DDoS) attacks proved to be one of the cybersecurity challenges of SDN [3]. They are different mechanisms and technology to protect SDN from DDoS attacks.…”