Analysis of detection systems in a Software-Defined Network

Abstract

Software-Defined Networking (SDN), a novel and innovative networking technology, offers programmability and flexibility within networks and centralized control of those networks. The separation of data and control planes, as well as the concentration of all control provisioning options within a SDN controller, are two of the most significant ways in which SDN improves on traditional network deployments. However, because different planes in an SDN network are separated, the network contains several attack vectors that malicious users could exploit. Distributed Denial-of-Service (DDoS) attacks pose a unique threat to SDN because they can disrupt connections between the controller and data plane devices. Therefore, developing and implementing intrusion detection systems (IDS) in SDN is necessary. This paper investigates IDS in software-defined networks for effectively detecting DDoS attacks using signature-based and machine learning (ML)-based approaches. Mininet and OpenDayLight are used to simulate an SDN environment in which normal and attack traffic is generated to assess intrusion detection techniques. The Snort IDS is employed as the signature-based IDS in this study, while the ML algorithms, Random Forest (RF), J48, Naive Bayes (NB), and Support Vector Machine (SVM) are used to implement the ML-based IDS. The IDS are examined using SDN-generated traffic, with the InSDN-NB model surpassing all other ML models and Snort IDS with 98.86% prediction accuracy and a train time of 1.46s.