A mutual information-driven hybrid deep learning framework for SDN intrusion identification

Abstract

Software-Defined Networking (SDN) enhances network programmability and manageability through decoupling the control and data plane, though the same has resulted in the controller being an attractive assault target. To date, no flexible Intrusion Identification System (IDS) developed for SDN is only capable of efficient intrusion identification with a low FPR (False Positive Rate), So restricting its applicability. This paper proposes a Hybrid Artificial Intelligence Deep structure for Assault Identification (HAID-AD) in SDN, comprising three steps, namely preprocessing, variable extraction, and assault identification. The network traffic data is preprocessed in the first stage, by normalizing the values through a Mean-Median Absolute Deviation Integrated Tanh Normalization (MMAD-TanhN) method for ensuring uniform variables scale. The second stage retrieves the value disclosest attributes from the raw and statistical variables extract through the combination of Enhanced MI (En-MI) and ReliefF. The traffic variables are then categorized in the final stage, based on the combination of Hybrid Modified ShuffleNet-LinkNet (HyMS-LNet). The prediction of Modified ShuffleNet (MShNet), and LinkNet is fused via a soft voting system as the final output for reliable assault identification. The recommended HAID-AD setup is evaluated with the InSDN data set and the results are derived from accuracy precision recall, F1-score specificity FPR and FNR measures. For 90% training data, it achieved accuracy precision F1-score, and AUC of 98.5%, 97%, 98% and 0.97 with FPR and FNR of 1.5% and 2.5% respectively. It is compared to the existing methods for all the derived measures and obtained better performance. It can be inferred from these results that the recommended structure has proved to be an efficient intrusion identification measure for SDN.