Real-Time Anomaly Detection Framework to Mitigate Emerging Threats in Software Defined Networks

Real-Time Anomaly Detection Framework to Mitigate Emerging Threats in Software Defined Networks

연구 분야: Networking

학회: Journal of Network and Systems Management

The Software Defined Networking (SDN) framework offers a practical and programmer-friendly approach to computer network design, addressing numerous issues that plague legacy networks. By centralizing and separating the control plane from the data plane, SDN provides an ideal foundation for addressing various security concerns. However, the attributes that make SDN attractive, its centralized management, also make it a prime target for a wide range of cyberattacks. While previous studies have addressed security threats in legacy networks, SDN introduces new vulnerabilities that require fresh insights and strategies. Various attacks can disrupt legitimate network services, posing a significant challenge in early detection and mitigation due to the inherent complexity of SDN traffic. This paper tackles these challenges by employing advanced feature selection techniques to reduce the dimensionality of data required for training machine learning models. This streamlined approach enhances the efficiency of attack vector detection within the SDN environment. Furthermore, we propose the integration of a machine learning model into the SDN controller, enabling real-time detection and immediate mitigation of malicious network flows. We evaluate the effectiveness of our proposed framework using the InSDN and NITSDN datasets. To assess its impact on SDN controller performance, we implement the lightweight framework in a simulated SDN environment. Our results demonstrate that the proposed solution incurs minimal overhead, ensuring that network performance remains largely unaffected. This research contributes to the ongoing efforts to secure SDN architectures, providing a practical and efficient approach to detect and mitigate emerging threats in SDNs. It underscores the importance of proactive measures to safeguard the integrity and availability of SDN-based network services.