Leveraging Artificial Intelligence and Machine Learning for Robust Intrusion Detection in Software-Defined Networks

Abstract

Software-Defined Networking (SDN) separates the control plane from the data plane and centralizes network intelligence in software, delivering programmability, rapid reconfiguration, and scalability. That same centralization concentrates authority in a single controller process, turning it into a high-value target and a systemic point of failure. Signature-based tools such as Snort and Suricata cannot recognize attacks for which no signature yet exists, and purely statistical anomaly detectors produce false-positive rates that are impractical for automated response at production scale. This paper presents an AI/ML-based intrusion detection framework purpose-built for SDN traffic. Four classifiers - Random Forest (RF), Support Vector Machine (SVM), one-dimensional Convolutional Neural Network (CNN), and Long Short-Term Memory (LSTM) network - are trained and evaluated under one unified protocol across three benchmark datasets (CICIDS2017, NSL-KDD, and InSDN), with SMOTE oversampling confined to training folds inside nested crossvalidation to avoid data leakage. The best-performing model, LSTM, is deployed as a live application module inside the Ryu SDN controller, where it classifies flows in real time and issues OpenFlow FlowMod rules to contain malicious traffic. On the CICIDS2017 holdout partition the LSTM model reaches 98.7% accuracy, a macro F1-score of 0.986, and a false-positive rate of 0.8%, with its advantage over the other three classifiers confirmed significant by Wilcoxon signed-rank testing $(p<0.01)$. Beyond reporting classifier accuracy, this paper contributes a controller-integrated, multi-dataset, statistically validated evaluation framework, together with an explicit accounting of its threats to validity and the operational conditions under which it would need to be re-validated before production deployment.