Security anomaly detection in software‐defined networking based on a prediction technique

Abstract

SummaryNowadays, software‐defined networking (SDN) is regarded as the best solution for the centralized handling and monitoring of large networks. However, it should be noted that SDN architecture suffers from the same security issues, which are the case with common networks. As a case in point, one of the shortcomings of SDNs is related to its high vulnerability to distributed denial of service (DDoS) attacks and other similar ones. Indeed, anomaly detection systems have been considered to deal with these attacks. The challenges are related to designing these systems including gathering data, extracting effective features, and selecting the best model for anomaly detection. In this paper, a novel combined approach is proposed; this method uses NetFlow protocol for gathering information and generating dataset, information gain ratio (IGR), in order to select the effective and relevant features and ensemble learning scheme (Stacking) for developing a structure with desirable performance and efficiency for detecting anomaly in SDN environment. The results obtained from the experiments revealed that the proposed method performs better than other methods in terms of enhancing accuracy (AC) and detection rate (DR) and reducing classification error (CE) and false alarm rate (FAR). The AC, DR, CE, and FAR of the proposed model were measured as 99.92%, 99.83%, 0.08%, and 0.03%, respectively. Furthermore, the proposed method prevents the occurrence of excessive overload on the controller and OpenFlow.

Ensemble learning for intrusion detection systems: A systematic mapping study and cross-benchmark evaluation

“…Huan et al [149] argued that the fusion of clustering undersampling and AdaBoost algorithm improved the effect of network traffic anomaly detection. Jafarian et al [139] used a novel combined approach for anomaly detection. The method used NetFlow protocol for acquiring information and generating datasets, information gain ratio for selecting the relevant attributes, and stacking ensemble for detecting anomaly in SDN networks.…”

A novel feature selection algorithm for IoT networks intrusion detection system based on parallel CNN-LSTM model

“…Although the computational complexity of the proposed method is more, it is balanced in proportion to the increase in accuracy and execution time. The network is expanding both in size and complexity (Jafarian, Masdari et al 2020). Table 6 shows the comparison of model complexity and execution time in 100 rounds and three rounds for each model.…”

Present and Future of Network Security Monitoring

“…Yet, these new paradigms are at the same time solution and problem from the security perspective. Like this, adopting SDN and NFVs introduce new vulnerabilities and security requirements, being the availability one of the most relevant [114,116,120,126].…”

“…A number of works tackle these new security issues related to the SDN, some of them aiming to enhance the detection techniques or following a security monitoring approach [116,120,121,123,124,[126][127][128]132]. In addition, Santos da Silva et al manifest the need of human intervention during the monitoring cycle [120].…”