LSTM-Based Model for Intrusion Detection in SDN-IoT Networks
Randa Srour Ali, Eman AbdElhalim, Hala B. Nafea, Ahmad Hassan · MEJ Mansoura Engineering Journal · 2025
Ensuring security in Software-Defined Networking (SDN)-enabled Internet of Things (IoT) environments is a critical challenge due to the increasing complexity of cyber threats. This study proposes an intrusion detection system based on Long Short-Term Memory (LSTM) networks to enhance security in SDN-IoT networks. The research methodology involves data preprocessing, feature selection, and model training using the SDN-IoT dataset. Data preprocessing includes handling missing values and applying various encoding (label, one-hot, frequency, binary) and normalization (minmax, log, robust, z-scaling) techniques to optimize feature representation. Feature selection, conducted using Random Forest and correlation matrix analysis, reduces the feature set from 33 to 20, improving computational efficiency while maintaining high accuracy. The proposed LSTM model consists of four layers with 64 units each and incorporates dropout for regularization. It is trained over 20 epochs using the Adam optimizer and categorical cross-entropy loss function. The model achieves a peak accuracy of 98.5% with z-scaling and the optimized feature set, outperforming other configurations. Performance evaluation using precision, recall, and F1-score (each at 0.98) confirms the model's effectiveness in accurately classifying network traffic. Further validation through the confusion matrix and Receiver Operating Characteristic (ROC) curves reinforces its reliability.