Multi-class Intrusion Detection System in SDN Based on Hybrid LSTM Model

Software-defined networking (SDN) is a new network paradigm, which is highly decoupled compared to traditional networks. It makes the network innovation easier to operate by separating the data and control planes of the network. However, there are more risks due to the structure of SDN. The attack on the controller will lead to the paralysis of the entire network, so the intrusion detection is particularly important. With the rise of this artificial intelligence, machine learning technology and deep learning technology have been applied in all aspects of life. Deep learning has the advantages of high accuracy, light weight, and fast response speed. Therefore, deep learning technology has also been applied in the field of intrusion detection, while the methods proposed at this stage are mainly concentrated in traditional networks, and are often used to detect Distributed Denial of Service (DDoS) attacks, which lack standardization in attack detection. In this work, we propose a hybrid Long Short Term Memory (LSTM)-based multi-class intrusion detection method to detect 8 common intrusion types on the InSDN dataset. Firstly, a feature selection method is proposed for the high-dimensional data of SDN network, to extract the positive features that are effective for model decision-making, reduce the misleading of the model by unfavorable and negative features, and reduce the computational cost. Secondly, a multi-class intrusion detection model based on multi-output nodes and hybrid LSTM is proposed to improve the accuracy of the model. Finally, this paper compares the proposed model with the machine learning models to verify the performance of the model. Experiments show that the method proposed in this paper improves the accuracy by 37.95%, 25.56%, 23.06% and 10.17% when compared with LOGISTIC, ADABOOST, Random Forest and NETWORK models, respectively, and provides an effective method for multi-class intrusion detection.