An efficient and interpretable intrusion detection framework for software-defined networks with multi-class imbalanced data using genetic and GAN-based optimization
A hybrid SDN-based IDS framework that integrates Generative Adversarial Networks (GANs) to handle imbalanced datasets, one-way ANOVA and Genetic Algorithm for feature selection, baseline classifier optimization using Grid Search and Explainable AI techniques to achieve robust, accurate, and interpretable intrusion detection.
Abstract
Software-Defined Networks (SDNs) are already susceptible to cyber-attacks because of the weak security mechanisms and limited resources. This is predicted to be intensified in the Internet of Things era with a forecast of more than 29 billion connected devices in 2030, thereby broadening the threat surface significantly and making it increasingly difficult for cybersecurity solutions to address these threats. Conventional intrusion detection systems(IDSs) on SDNs are challenged by imbalanced multi-class data, high-dimensional and noisy features, and a lack of interpretability. To address these challenges, this study proposes a hybrid SDN-based IDS framework that integrates Generative Adversarial Networks (GANs) to handle imbalanced datasets, one-way ANOVA and Genetic Algorithm (GA) for feature selection, baseline classifier optimization using Grid Search and Explainable AI techniques such as SHapley Additive exPlanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), Morris sensitivity analysis and permutation combination to achieve robust, accurate, and interpretable intrusion detection. The grid search-optimized XGBoost model, denoted as OptiXGB-IDS, demonstrates high performance on the InSDN dataset, with a test accuracy of 99.87%, and macro-averaged precision, recall, and F1-score of 0.9618, 0.9951 and 0.9775 respectively. In addition, the model achieves a Cohen’s kappa coefficient of 0.9982 and a Brier score of 0.0024, with an inference time of 0.026312 ms per flow. In order to further test cross-dataset robustness, the proposed framework was also validated on the CIC-IDS2017 dataset, where OptiXGB-IDS achieved the highest test accuracy of 98.70% and outperformed all other competing models. The proposed hybrid GA-GAN-XAI framework significantly improves the IDS performance by providing key traffic flow features and improving spatial and temporal feature learning, making it highly robust and providing a very precise and reliable solution for detecting complex and previously unseen cyber threats in SDN-based IoT environments.
As the number of network attacks continues to increase, cybersecurity systems require intelligent and scalable solutions to detect more and more complex network attacks in real time. This paper suggests an end-to-end intelligent cybersecurity system for detecting intrusion with CICIDS2017 dataset with multiple classes. Proposed system performs complete data pre-processing that consists of missing value removal, duplication elimination, label encoding, feature normalisation and Principal Component Analysis based feature selection to enhance the data quality and learning efficiency. Some ML models such as DT, RF, ET, LR, Gaussian Naïve Bayes and a soft Voting Classifier are tested along with DL architectures like DNN, CNN, LSTM, CNN-LSTM, and CNN-LSTM-GRU. In addition, the works of Generative AI models, such as VAE, GAN, and Distil GPT2 are explored for anomaly modelling, generation of minority samples, and generation of text data for cybersecurity applications. XAI techniques (LIME and SHAP) reveal the main network traffic aspects to improve transparency of the forecast. The experimental results indicate that the Voting Classifier obtained the accuracy of 99.6% and the LSTM model obtained the accuracy of 99.3%. Both models can reliably detect various types of cyber attacks. Last, the framework is also deployed as a web application that uses Flask to enable real-time deployment of intrusion prediction and visualisation.
Kanemoni Omkar, Donempudi Shailaja, Dr. Jyothi Anantula et al.· 2026 6th International Confe...· 0 citations
A stacked ensemble ML model combining Random Forest and Logistic Regression and Logistic Regression as a meta-classifier, while Extreme Gradient Boosting as a meta-classifier is proposed in this study to improve software system cyberattack detection.
Anshika Sharma, S. Rani· SN Computer Science· 0 citations
A Kitchenham-informed systematic literature review methodology, this review synthesizes 186 studies published between 2018 and 2026 and develops a perturbation-realism taxonomy, ranging from feature-level manipulation to executable packet-level attacks, that clarifies when reported success corresponds to deployable risk.
The growth of Internet of Things devices has expanded the number of attackable targets of advanced cyber threats by orders of magnitude, and the limited computational capabilities of IoT devices have made more traditional intrusion detection systems infeasible to execute at the edge. A Knowledge-Distilled Multi-Model Intrusion Detection and Prevention System is presented, which combines a Residual Graph Convolutional Network, Long Short-Term Memory classifier, and a Conditional Tabular Generative Adversarial Network enhanced with the student-only autoencoders through multi-loss knowledge distillation to create a high-performing Teacher ensemble and compresses its intelligence into an edge-deployed system. The system is evaluated using the IoT-23 benchmark of 325 million network flow records and attains 98.2% Teacher-Student fidelity, 0.94 Knowledge Retention Score, and 4.4x throughput increase with 82.7% reduction in the parameter and provides per-packet SHapely Additive exPlanation forensic explainability.
S. K, Menaka T K, N. R· 2026 4th International Confe...· 0 citations
The escalating frequency of zero-day cyber-attacks, defined as exploits that target previously undisclosed software vulnerabilities, has outpaced the capability of signature-based and conventional supervised Intrusion Detection Systems (IDS) to respond in a timely and trustworthy manner. Deep learning models have improved raw detection accuracy for novel attack patterns, but their opaque, black-box decision processes undermine analyst trust, complicate forensic accountability, and slow incident response in Security Operations Centres (SOCs). This study proposes and empirically evaluates a hybrid Explainable Artificial Intelligence (XAI)-based Intrusion Detection framework that combines an unsupervised auto encoder for anomaly and novelty scoring with a supervised Transformer–LSTM classifier for known-attack discrimination, coupled with an open-set recognition layer for zero-day flagging. Post-hoc interpretability is furnished through SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME), generating both global feature-importance rankings and per-alert, analyst-facing rationales. The framework was trained and evaluated on three benchmark datasets (CICIDS2017, NSL-KDD, and UNSW-NB15) under a leave-one-attack-family-out protocol that simulates genuine zero-day conditions by withholding entire attack categories from training. Experimental results show that the proposed hybrid model attained 97.8% accuracy, 97.2% precision, 96.9% recall, 97.0% F1-score, and an area-under-curve (AUC) of 0.986 on unseen attack categories, outperforming standalone CNN, LSTM, Random Forest, and SVM baselines by margins of 3.7 to 9.4 percentage points in F1-score. SHAP analysis identified flow duration, destination-port entropy, and packet inter-arrival variance as the dominant discriminative features across attack families, while LIME-generated local explanations demonstrated high fidelity (mean fidelity score of 0.91) to the underlying model behaviour. The findings indicate that embedding explainability directly into the zero-day detection pipeline, rather than treating it as an auxiliary diagnostic layer, materially improves both detection robustness and analyst-facing transparency without incurring prohibitive computational overhead. The paper concludes with recommendations for operational deployment, dataset diversification, and future integration of causal and counterfactual explanation methods.
Samuel Okechukwu Nnaji, Christabel Linda Uchenwa, Anyalebechi Felicia Nneamaka· International Journal Of Eng...· 0 citations
Distributed Denial-of-Service (DDoS) attacks remain among the most disruptive threats to modern network infrastructure, with adversaries continually adapting their strategies to overwhelm cloud platforms, Internet-of-Things (IoT) deployments, and Software-Defined Network (SDN) environments. Traditional signature-based intrusion detection systems exhibit inherent inflexibility against novel attack vectors, motivating a shift toward intelligent, data-driven defense mechanisms. This paper presents an intelligent DDoS detection and mitigation framework that combines classical Machine Learning (ML) classifiers with Deep Learning (DL) architectures to achieve high-fidelity, low-latency attack identification across heterogeneous network topologies. Evaluated on the CICDDoS2019, NSL-KDD, and UNSW-NB15 benchmark datasets, the proposed hybrid framework incorporating XGBoost and a Bidirectional LSTM model achieves a classification accuracy of 99.31%, a precision of 99.18%, a recall of 99.27%, and an F1-score of 99.22%, outperforming standalone classifiers while sustaining sub-millisecond detection latency under realistic traffic loads. SDN-assisted rule insertion further reduces the mean mitigation response time to 8.4 ms. The results affirm the viability of deploying intelligent, explainable ML-based defense pipelines in production-grade network environments.
S. Singh, Alok Kumar· International Journal of Com...· 0 citations