Multi-class intrusion detection system in SDN based on hybrid BiLSTM model

Software-defined networking (SDN) is a new network paradigm, which is highly decoupled compared to traditional networks, and makes it easier to operate by separating the data and control planes of the network, promoting logical centralization of network control, and introducing the ability to program the network. Due to the feature of logically centralized control, the attack on the controller will lead to the paralysis of the entire network, so the intrusion detection is particularly important for SDN. With the rise of artificial intelligence network, machine learning technology and deep learning technology have been applied in all aspects of life. Due to the advantages of high accuracy, light weight, and fast response speed, deep learning is beneficial for intrusion detection. However, the methods proposed at this stage are mainly concentrated in traditional networks, and they are often used to detect DDoS (Distributed Denial of Service) attacks only, which cannot be applied to SDN directly to classify different attack types specific to this new network paradiam. In this work, we propose a hybrid Long Short Term Memory (LSTM)-based multi-class intrusion detection method, i.e., Convolutional Neural Network with Attention (CNNA)-BiLSTM to detect 8 common intrusion types on the InSDN dataset. Firstly, a feature selection method is proposed for the high-dimensional data of SDN network data traffic to extract the positive features that are effective for model decision-making, reduce the misleading of the model by unfavorable and negative features, and decrease the computational cost. Secondly, a multi-class intrusion detection model based on multi-output nodes and hybrid BiLSTM with attention is proposed to improve the accuracy of the model for emerging detection. The proposed deep learning model provides a better classification result in two-class and multi-class problems compared with other methods. It achieves an accuracy of 99.86% and 99.31% on two-class and multi-class scenarios, respectively. Moreover, our proposed model can accurately detect each category in multi-classification detection, while other standard models cannot detect Botnet, Web, and U2R attacks accurately because of their small sample scales.