SDN-IDS: A Deep Learning Model for Detecting DDoS Attacks
Ahsan Shariff M, Nelson Kennedy Babu C · International Journal of Electronics and Communication Engineering · 2024
The centralization of control and programmability in Software-Defined networking (SDN) have enhanced network functionality, but they have also made it vulnerable to security threats like Distributed Denial of Service (DDoS) attacks, which may target both the data and control planes. To detect and mitigate the DDoS attacks in SDN’s control plane, a novel attack detection model is proposed in this research. The proposed model is developed utilizing Deep Learning (DL) and metaheuristic optimization algorithms. The key objective of this research is to classify and detect the attacks in SDN’s control plane layer. The proposed model, SDN-Intrusion Detection System (SDN-IDS), includes four main phases: data collection, data preprocessing, feature selection and classification. Initially, the InSDN dataset is collected to train and evaluate the research model. The data preprocessing phase includes data cleaning, data transformation, and normalization processes. After preprocessing, a Binary variant of the Ant Lion Optimizer (BALO) algorithm is used for selecting optimal features from the input dataset. Based on the selected features, the Attention-Based Bidirectional Long Short-Term Memory (ABiLSTM) model is implemented for classification. To improve the classification accuracy of the ABiLSTM model, the Bayesian Optimization (BO) technique is applied for hyperparameter tuning. The SDN-IDS model is assessed in terms of detection rate, accuracy, f1-score, FAR, and precision. Based on this analysis, the model attained 99.61% accuracy, 99.53% detection rate, 99.70% precision, 99.58% f1-score, and 0.46% FAR. Overall, these results indicate that the proposed SDNIDS model effectively detects and classifies DDoS attacks within the SDN control layer with higher accuracy while maintaining a low FAR compared to the existing models.