A Deep Neural Network Architecture for Intrusion Detection in Software-Defined Networks

Document Type : Software-defined networking (SDN)-Yaghmaee

Authors

Somayeh Jafari Horestani

Somayeh Soltani

Seyed Amin Hosseini Seno

Department of Computer Engineering, Ferdowsi University of Mashhad

10.22067/cke.2022.75815.1055

Abstract

For more comprehensive security of a computer network as well as the use of firewall and anti-virus security equipment, intrusion detection systems (IDSs) are needed to detect the malicious activity of intruders. Therefore, the introduction of a high-precision intrusion detection system is critical for the network. Generally, the general framework of the proposed intrusion detection models is the use of text classification, and today deep neural networks (DNNs) are one of the top classifiers. A variety of DNN-based intrusion detection models have been proposed for software-defined networks (SDNs); however, these methods often report performance metrics solely on one well-known dataset. In this paper, we present a DNN-based IDS model with a 12-layer arrangement which works well on three datasets, namely, NSL-KDD, KDD99, and UNSW-NB15. The layered layout of the proposed model is considered the same for all the three datasets, which is one of the strengths of the proposed model. To evaluate the proposed solution, six other DNN-based IDS models have been designed. The values of the evaluation metrics, including accuracy, precision, recall, F-measure, and loss function, show the superiority of the proposed model over these six models. In addition, the proposed model is compared with several recent articles in this field, and the superiority of the proposed solution is shown.

Keywords

Intrusion detection

Software-defined network

Deep learning

Network security

Subjects

• Computer and Network Security

---

References

 

[1]  Heady, R., Luger, G., Maccabe, A., and Servilla, M., "The architecture of a network level intrusion detection system", Los Alamos National Lab., 1990.

[2]   Panda, M., Abraham, A., and Patra, M. R., "A hybrid intelligent approach for network intrusion detection", Procedia Engineering, Vol. 30, pp. 1-9, 2012.

[3]   Sheikhan, M., and Bostani, H., "A hybrid intrusion detection architecture for internet of things", in 2016 8th International Symposium on Telecommunications (IST), IEEE, pp. 601-606, 2016.

[4]   Lin, S.-W., Ying, K.-C., Lee, C.-Y., and Lee, Z.-J., "An intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection", Applied Soft Computing, Vol. 12, No. 10, pp. 3285-3290, 2012.

[5]    Vinayakumar, R., Alazab, M., Soman, K., Poornachandran, P., Al-Nemrat, A., and Venkatraman, S., "Deep learning approach for intelligent intrusion detection system", IEEE Access, Vol. 7, pp. 41525-41550, 2019.

[6]   Jiang, F., et al., "Deep learning based multi-channel intelligent attack detection for data security", IEEE transactions on Sustainable Computing, Vol. 5, No. 2, pp. 204-212, 2018.

[7]   Chalapathy, R., and Chawla, S., "Deep learning for anomaly detection: A survey", arXiv preprint arXiv,1901.03407, 2019.

[8]   Sultana, N., Chilamkurti, N., Peng, W., and Alhadad, R., "Survey on SDN based network intrusion detection system using machine learning approaches", Peer-to-Peer Networking and Applications, Vol. 12, No. 2, pp. 493-501, 2019.

[9]   Kwon, D., Kim, H., Kim, J., Suh, S. C., Kim, I., and Kim, K. J., "A survey of deep learning-based network anomaly detection", Cluster Computing, Vol. 22, No. 1, pp. 949-961, 2019.

[10] Chaabouni,   N., Mosbah, M., Zemmari, A., Sauvignac, C., and Faruki, P., "Network intrusion detection for IoT security based on learning techniques", IEEE Communications Surveys & Tutorials, Vol. 21, No. 3, pp. 2671-2701, 2019.

[11] Zhong, G., Ling, X., and Wang, L. N., "From shallow feature learning to deep learning: Benefits from the width and depth of deep architectures", Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, Vol. 9, No. 1, pp. e1255, 2019.

[12] Hodo, E., Bellekens, X., Hamilton, A., Tachtatzis, C., and Atkinson, R., "Shallow and deep networks intrusion detection system: A taxonomy and survey", arXiv preprint arXiv, 1701.02145, 2017.

[13] Lansky, J., Ali, S., Mohammadi, M., Majeed, M. K., Karim, SH., Rashidi, S., Hosseinzadeh, M., Rahmani, AM., "Deep learning-based intrusion detection systems: a systematic review", IEEE Access. No. 14, Vol. 9, pp. 101574-99, Jul, 2021.

[14] Ahmad Z., Shahid Khan, A., Wai Shiang, C., Abdullah, J., Ahmad, F., "Network intrusion detection system: A systematic study of machine learning and deep learning approaches", Transactions on Emerging Telecommunications Technologies, Vol. 32(1), pp. e4150, Jan, 2021.

[15] Kocher, G., Kumar, G., "Machine learning and deep learning methods for intrusion detection systems: recent developments and challenges", Soft Computing, Vol. 25(15), pp. 9731-63, Aug, 2021.

[16] Jasim, A. D., "A survey of intrusion detection using deep learning in internet of things", Iraqi Journal For Computer Science and Mathematics,Vol. 3(1), pp. 83-93, Jan 30, 2022.

[17] Alsoufi, M. A., Razak, S., Siraj, M. M., Nafea, I., Ghaleb, F. A., Saeed, F., Nasser, M., "Anomaly-based intrusion detection systems in iot using deep learning: A systematic literature review", Applied Sciences, No. 9, Vol. 11(18), pp. 8383, sep, 2021.

[18] Lee, S. W., Mohammadi, M., Rashidi, S., Rahmani, A. M., Masdari, M., Hosseinzadeh, M., "Towards secure intrusion detection systems using deep learning techniques: Comprehensive analysis and review", Journal of Network and Computer Applications, Aug No. 1, Vol. 187, pp. 103111, Aug, 2021.

[19] Ahmed, M., Shatabda, S., Islam, A. K., Robin, M., Islam, T., "Intrusion detection system in software-defined networks using machine learning and deep learning techniques–a comprehensive survey", 2021.

[20] Wang, G., Hao, J., Ma, J., and Huang, L., "A new approach to intrusion detection using Artificial Neural Networks and fuzzy clustering", Expert systems with applications, Vol. 37, No. 9, pp. 6225-6232, 2010.

[21] Aburomman, A. A., and Reaz, M. B. I., "A novel SVM-kNN-PSO ensemble method for intrusion detection system", Applied Soft Computing, Vol. 38, pp. 360-372, 2016.

[22] Baek, S., Kwon, D., Kim, J., Suh, S. C., Kim, H., and Kim, I., "Unsupervised labeling for supervised anomaly detection in enterprise and cloud networks", in 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud), IEEE, pp. 205-210, 2017.

[23] Wang, H., Gu, J., and Wang, S., "An effective intrusion detection framework based on SVM with feature augmentation", Knowledge-Based Systems, Vol. 136, pp. 130-139, 2017.

[24] Aljawarneh, S., Aldwairi, M., and Yassein, M. B., "Anomaly-based intrusion detection system through feature selection analysis and building hybrid efficient model", Journal of Computational Science, Vol. 25, pp. 152-160, 2018.

[25] Pham, N. T., Foo, E., Suriadi, S., Jeffrey, H., and Lahza, H. F. M., "Improving performance of intrusion detection system using ensemble methods and feature selection", in Proceedings of the Australasian Computer Science Week Multiconference, pp. 1-6, 2018.

[26] He, D., Chen, X., Zou, D., Pei, L., and Jiang, L., "An improved kernel clustering algorithm used in computer network intrusion detection", in 2018 IEEE International Symposium on Circuits and Systems (ISCAS), IEEE, pp. 1-5, 2018.

[27] Song, J., Takakura, H., Okabe, Y., and Kwon, Y., "Unsupervised anomaly detection based on clustering and multiple one-class SVM", IEICE transactions on communications, Vol. 92, No. 6, pp. 1981-1990, 2009.

[28] Zhu, M., Ye, K., and Xu, C.-Z., "Network anomaly detection and identification based on deep learning methods", in International Conference on Cloud Computing Springer, pp. 219-234, 2018.

[29] Li, Z., Qin, Z., Huang, K., Yang, X., and Ye, S., "Intrusion detection using convolutional neural networks for representation learning", in International conference on neural information processing, Springer, Vol. ???, pp. 858-866, 2017.

[30] Liu, Y., Liu, S., and Zhao, X., "Intrusion detection algorithm based on convolutional neural network", DEStech Transactions on Engineering and Technology Research, No. iceta, 2017.

[31] Potluri, S., Ahmed, S., and Diedrich, C., "Convolutional neural networks for multi-class intrusion detection system", in International Conference on Mining Intelligence and Knowledge Exploration, Springer, pp. 225-238, 2018.

[32] Nguyen, S. -N., Nguyen, V.-Q., Choi, J., and Kim, K., "Design and implementation of intrusion detection system using convolutional neural network for DoS detection", in Proceedings of the 2nd international conference on machine learning and soft computing, pp. 34-38, 2018.

[33] Yin, C., Zhu, Y., Fei, J., and He, X., "A deep learning approach for intrusion detection using recurrent neural networks", Ieee Access, Vol. 5, pp. 21954-21961, 2017.

[34] Tang, T. A., Mhamdi, L., McLernon, D., Zaidi, S. A. R., and Ghogho, M., "Deep recurrent neural network for intrusion detection in sdn-based networks", in 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), IEEE, pp. 202-206, 2018.

[35] Vinayakumar, R., Soman, K., and Poornachandran, P., "A comparative analysis of deep learning approaches for network intrusion detection systems (N-IDSs): deep learning for N-IDSs", International Journal of Digital Crime and Forensics (IJDCF), Vol. 11, No. 3, pp. 65-89, 2019.

[36] Chockwanich,              N., and Visoottiviseth, V., "Intrusion detection by deep learning with tensorflow", in 2019 21st International Conference on Advanced Communication Technology (ICACT), IEEE, pp. 654-659, 2019.

[37] Zhong, M., Zhou, Y., Chen, G., "Sequential model based intrusion detection system for IoT servers using deep learning methods. Sensors", No. 5, Vol. 21(4), pp. 1113, Feb, 2021.

[38] Ponkarthika, M., and Saraswathy, V., "Network intrusion detection using deep neural networks", Asian Journal of Science and Technology, Vol. 2, No. 2, pp. 665-673, 2018.

[39] Vinayakumar,              R., Soman, K., and Poornachandran, P., "Applying convolutional neural network for network intrusion detection", in 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI), IEEE, pp. 1222-1228, 2017.

[40] Chawla, A., Lee, B., Fallon, S., and Jacob, P., "Host based intrusion detection system with combined CNN/RNN model", in Joint European Conference on Machine Learning and Knowledge Discovery in Databases, Springer, pp. 149-158, 2018.

[41] Wang, W., et al., "HAST-IDS: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection", IEEE access, Vol. 6, pp. 1792-1806, 2017.

[42] Hsu, C.-M., Hsieh, H.-Y., Prakosa, S. W., Azhari, M. Z., and Leu, J.-S., "Using long-short-term memory based convolutional neural networks for network intrusion detection", in International wireless internet conference, Springer, pp. 86-94, 2018.

[43] Lee T. H., Chang, L. H., Syu, C. W., "Deep learning enabled intrusion detection and prevention system over SDN networks", In2020 IEEE International Conference on Communications Workshops (ICC Workshops), Jun 7, pp. 1-6, IEEE, 2020.

[44] Malik, J., Akhunzada, A., Bibi, I., Imran, M., Musaddiq, A., Kim, S. W., "Hybrid deep learning: An efficient reconnaissance and surveillance detection mechanism in SDN", IEEE Access. No. 16, Vol. 8, pp. 134695-706, Jul, 2020.

[45] Mohammadi, S., and Namadchian, A., "A new deep learning approach for anomaly base IDS using memetic classifier", International Journal of Computers Communications & Control, Vol. 12, No. 5, pp. 677-688, 2017.

[46] Niyaz, Q., "Design and Implementation of a Deep Learning based Intrusion Detection System in Software-Defined Networking Environment", University of Toledo, 2017.

[47] Shone, N., Ngoc, T. N., Phai, V. D., and Shi, Q., "A deep learning approach to network intrusion detection", IEEE transactions on emerging topics in computational intelligence, Vol. 2, No. 1, pp. 41-50, 2018.

[48] Farahnakian, F., and Heikkonen, J., "A deep auto-encoder based approach for intrusion detection system", in 2018 20th International Conference on Advanced Communication Technology (ICACT), IEEE, pp. 178-183, 2018.

[49] Papamartzivanos, D., Mármol, F. G., and Kambourakis, G., "Introducing deep learning self-adaptive misuse network intrusion detection systems", IEEE Access, Vol. 7, pp. 13546-13560, 2019.

[50] A. Abusitta, M. Bellaiche, M. Dagenais, and T. Halabi, "A deep learning approach for proactive multi-cloud cooperative intrusion detection system", Future Generation Computer Systems, Vol. 98, pp. 308-318, 2019.

[51] Tang, T. A., Mhamdi, L., McLernon, D., Zaidi, S. A. R., and Ghogho, M., "Deep learning approach for network intrusion detection in software defined networking", in 2016 international conference on wireless networks and mobile communications (WINCOM), IEEE, pp. 258-263, 2016.

[52] Roy, S. S., Mallik, A., Gulati, R., Obaidat, M. S., and Krishna, P. V., "A deep learning based artificial neural network approach for intrusion detection", in International Conference on Mathematics and Computing, Springer, pp. 44-53, 2017.

[53] Ustebay, S., Turgut, Z., and Aydin, M. A., "Cyber attack detection by using neural network approaches: shallow neural network, deep neural network and autoencoder," in International conference on computer networks, Springer,pp. 144-155, 2019.

[54] Vigneswaran, R. K., Vinayakumar, R., Soman, K., and Poornachandran, P., "Evaluating shallow and deep neural networks for network intrusion detection systems in cyber security", in 2018 9th International conference on computing, communication and networking technologies (ICCCNT), IEEE, pp. 1-6, 2018.

[55] Javeed, D., Gao, T., Khan, M.T., Ahmad, I., "A hybrid deep learning-driven SDN enabled mechanism for secure communication in Internet of Things (IoT)", Sensors, No. 18, Vol. 21(14), pp. 4884, Jul, 2021.

[56] Hande, Y., Muddana, A., "Intrusion detection system using deep learning for software defined networks (SDN)", In2019 International Conference on Smart Systems and Inventive Technology (ICSSIT) 2019 Nov 27, pp. 1014-1018, IEEE, 2019.

[57] Duy, P. T., Khoa, N. H., Nguyen, A. G., Pham, V. H., "DIGFuPAS: Deceive IDS with GAN and Function-Preserving on Adversarial Samples in SDN-enabled networks", Computers & Security, No. 1, Vol. 109, pp. 102367, Oct, 2021.

[58] Boukria, S., Guerroumi, M., "Intrusion detection system for SDN network using deep learning approach", In2019 International Conference on Theoretical and Applicative Aspects of Computer Science (ICTAACS), Dec 15, Vol. 1, pp. 1-6, IEEE, 2019.

[59] Seyedkolaei, A. A., Seno, S. A. H., Moradi, A., and Budiarto, R., "Cost-Effective Survivable Controller Placement in Software-Defined Networks", IEEE Access, Vol. 9, pp. 129130-129140, 2021.

[60] Prajapati, A., Sakadasariya, A., and Patel, J., "Software defined network: Future of networking", in 2018 2nd International Conference on Inventive Systems and Control (ICISC), IEEE, pp. 1351-1354, 2018.

[61] Khairi, M. H., Ariffin, S. H., Latiff, N. A., Abdullah, A., and Hassan, M., "A review of anomaly detection techniques and distributed denial of service (DDoS) on software defined network (SDN)", Engineering, Technology & Applied Science Research, Vol. 8, No. 2, pp. 2724-2730, 2018.

[62] Shaghaghi, A., Kaafar, M. A., Buyya, R., and Jha, S., "Software-defined network (SDN) data plane security: issues, solutions, and future directions", Handbook of Computer Networks and Cyber Security, pp. 341-387, 2020.

[63] Ludwig, S. A., "Intrusion detection of multiple attack classes using a deep neural net ensemble", in 2017 IEEE Symposium Series on Computational Intelligence (SSCI), IEEE, pp. 1-7, 2017.

[64] Faker, O., and Dogdu, E., "Intrusion detection using big data and deep learning techniques", in Proceedings of the 2019 ACM Southeast Conference, pp. 86-93, 2019.

[65] Rawat, S., Srinivasan, A., Ravi, V., Ghosh, U., "Intrusion detection systems using classical machine learning techniques vs integrated unsupervised feature learning and deep neural network", Internet Technology Letters, Jan, Vol. 5(1), pp. e232, 2022.

[66] Powers, D. M., "Evaluation: from precision, recall and F-measure to ROC, informedness, markedness and correlation", arXiv preprint arXiv, 2010.16061, 2020.

[67] Revathi, S., and Malathi, A., "A detailed analysis on NSL-KDD dataset using various machine learning techniques for intrusion detection", International Journal of Engineering Research & Technology (IJERT), Vol. 2, No. 12, pp. 1848-1853, 2013.

[68] Abadi, M., et al., "Tensorflow: A system for large-scale machine learning", in 12th {USENIX} symposium on operating systems design and implementation ({OSDI} 16), pp. 265-283, 2016.

[69] Saritha Reddy, A., Ramasubba Reddy, B., Suresh Babu, A., "An Improved Intrusion Detection System for SDN using Multi-Stage Optimized Deep Forest Classifier", International Journal of Computer Science & Network Security, Vol. 22(4), pp. 374-86, 2022.

[70] Fu, Y., Du, Y., Cao, Z., Li, Q., Xiang, W. A., "Deep Learning Model for Network Intrusion Detection with Imbalanced Data", Electronics, Mar 14, Vol. 11(6), pp. 898, 2022.

[71] Imrana, Y., Xiang, Y., Ali, L., Abdul-Rauf, Z., "A bidirectional LSTM deep learning approach for intrusion detection", Expert Systems with Applications, Dec 15, Vol. 185, pp. 115524, 2021.

[72] Toldinas, J., Venčkauskas, A., Damaševičius, R., Grigaliūnas, Š., Morkevičius, N., Baranauskas, E., "A novel approach for network intrusion detection using multistage deep learning image recognition", Electronics, Aug 1, Vol. 10(15), pp. 1854, 2021.