Network Threat Detection Using Machine/Deep Learning in SDN-Based Platforms: A Comprehensive Analysis of State-of-the-Art Solutions, Discussion, Challenges, and Future Research Direction

Abstract

A revolution in network technology has been ushered in by software defined networking (SDN), which makes it possible to control the network from a central location and provides an overview of the network’s security. Despite this, SDN has a single point of failure that increases the risk of potential threats. Network intrusion detection systems (NIDS) prevent intrusions into a network and preserve the network’s integrity, availability, and confidentiality. Much work has been done on NIDS but there are still improvements needed in reducing false alarms and increasing threat detection accuracy. Recently advanced approaches such as deep learning (DL) and machine learning (ML) have been implemented in SDN-based NIDS to overcome the security issues within a network. In the first part of this survey paper, we offer an introduction to the NIDS theory, as well as recent research that has been conducted on the topic. After that, we conduct a thorough analysis of the most recent ML- and DL-based NIDS approaches to ensure reliable identification of potential security risks. Finally, we focus on the opportunities and difficulties that lie ahead for future research on SDN-based ML and DL for NIDS.

Network intrusion detection system by learning jointly from tabular and text‐based features

“…ML techniques have been increasingly applied to improve the accuracy and reduce false positives of anomaly‐based NIDS (Ahmed et al, 2022; Tufan et al, 2021). Researchers have leveraged various datasets and models to develop effective NIDS.…”

“…Signature‐based methods rely on predefined attack signatures but may struggle to detect new threats or polymorphic attacks that adapt to evade detection. In contrast, anomaly‐based NIDSs excel at identifying unusual or unexpected behaviour, making them particularly effective against zero‐day attacks and unknown threats (Ahmed et al, 2022; Khraisat et al, 2019; Ozkan‐Okay et al, 2021). By analyzing traffic patterns and identifying anomalies, anomaly‐based NIDSs can detect previously unknown attacks that would otherwise go undetected by signature‐based systems.…”

“…While anomaly‐based NIDSs have an advantage in reducing false negatives, they may produce a higher rate of false positives, flagging non‐malicious activity as an attack. Achieving the right balance between false positives and false negatives is crucial to ensure optimal security (Ahmed et al, 2022).…”

“…Machine learning (ML) has proven to be a powerful asset in anomaly‐based NIDS, enabling the detection of new intrusions and various network behaviours, including those previously unseen or unknown (Ahmed et al, 2022; Tufan et al, 2021). NIDSs analyze network logs, encompassing both tabular features like source and destination IP addresses, ports, timestamps, and non‐tabular features like payload data, often in non‐human‐readable forms like binary or encoded text.…”

A novel hybrid optimization enabled robust CNN algorithm for an IoT network intrusion detection approach

“…ML methods are used in intrusion detection systems, but dataset pre-processing and anomaly traffic detection are time-consuming and complex [ 58 ]. However, using DL methods [ 59 ], features may be mapped to a higher degree with more distinct feature spaces. A CNN is a deep learning approach that uses a convolution layer to automatically extract useful features from the authentic data feature plane through convolution layer.…”