Anomaly-Based Intrusion Detection for Software-Defined Networks Through an Ensemble Learning Approach

Abstract

Software Defined Network (SDN) is a paradigm shift in the wired network; the approach separates the control plane from the data plane. However, such architectural development becomes problematic for IDS due to the inherent limitations of the signature-based models, which cannot keep pace with the increasingly emerging threats. In this paper, the performance of the ensemble learning models is analyzed for anomaly-based intrusion detection of SDNs. we use general and IoT network intrusion datasets to compare different machine learning methodologies for constructing IDS., with the test of the model on SDN network intrusion datasets. We also investigate three Support Vector Machines (SVM), Random Forest (RF), and K-Nearest Neighbors (KNN) algorithms in their base formats and improved versions using ensemble methods, showcasing that the combination significantly enhances detection accuracy, precision, and recall essential for achieving robust SDN security. The weighted-average precision and recall are used to report the performance metrics in order to consider the imbalance across attack categories. In particular, the ensemble model achieved an accuracy of 0.99 on general and IoT datasets, and 0.97 on SDN datasets, with weighted precision of 1.00 and weighted recall of 0.99 and 0.97, respectively. The proposed approach of the ensemble method has the advantage of learning a lot of types of traffic patterns, and the false positive rate as well as the false negative rate are comparatively low, however, this comes at the cost of increased training time and computational complexity.  In general, our study reveals the effectiveness and applicability of ensemble learning toward critical security issues related to SDNs.