FLOW BASED ANOMALY DETECTION IN SOFTWARE DEFINED NETWORKING: A DEEP LEARNING APPROACH WITH FEATURE SELECTION METHOD

Abstract

Software Defined Networking (SDN) has come to prominence in recent years and demonstrates an enormous potential in shaping the future of networking by separating control plane from data plane. As a newly emerged technology, SDN has its inherent security threats that can be mitigated by securing the OpenFlow controller that manages flow control in SDN. On the other hand, Recurrent Neural Networks (RNN) show a remarkable result in sequence learning, particularly in architectures with gated unit structures such as Long Short-term Memory (LSTM). In recent years, several permutations of LSTM architecture have been proposed mainly to overcome the computational complexity of LSTM. Therefore, in this dissertation, a novel study is presented that will empirically investigate and evaluate flow-based anomaly detection method in OpenFlow controller using LSTM architecture variants such as Gated Recurrent Unit (GRU). Hence, in this exploration, we propose a combined Gated Recurrent Unit Long Short-Term Memory (GRU-LSTM) Network intrusion detection architecture. In order to improve the classifier performance, an appropriate ANOVA FTest and Recursive feature Elimination (RFE) (ANOVA F-RFE) feature selection method also have been applied. The proposed approach is tested using the benchmark dataset NSL-KDD. A subset of complete dataset with convenient feature selection ensures the highest accuracy of 87% with GRU-LSTM Model.