A Distributed Attack Detection System for SDN Using Stack of Classifiers
Ravindra Kumar Chouhan, Mithilesh Atulkar, Naresh Kumar Nagwani · International Journal of Engineering Trends and Technology · 2022
For the last few years, the Software Defined Network (SDN) architecture has grown in popularity in industries and academia due to its advantages over traditional networks. Because of its emergence, it has attracted many attackers who interfere with the network's normal operation. To defend against such attacks, the SDN controller centrally monitors all network activities and then takes appropriate action. This task consumes the majority of the controller's resources, resulting in controller performance degradation. To address this problem, this paper proposes an architecture in which data plane resources are used for intrusion detection, freeing up the controller for other network-related tasks. In the switch of the data plane, a stack of classifiers composed of Random Forest (RF) and K-Nearest Neighbour (KNN) at level 0 and Logistic Regression (LR) at level 1 is used. Also, to fasten the attack detection process, the appropriate features have been selected using Pearson's Correlation Coefficient and mutual information of the features. The UNSW-NB15 dataset has been used to demonstrate this architecture's performance. The performance has been measured under the metrics Precision, Accuracy, F1 value, Recall, Prediction Time, and Cohen's Kappa Coefficient. In terms of recall, accuracy, CKC, and feature count, the classifier stack surpasses the individual classifiers. Its performance is slightly inferior to that of other classifiers under precision, F1, and prediction time, but the difference is manageable when other parameters are considered. Hence, the stack of the classifier is selected for deployment in the data plane devices.