Detecting and mitigating security anomalies in software-defined networking (SDN) using gradient-boosted trees and floodlight controller characteristics

Basit Öğe Kaydı
dc.authorscopusidAli Ghaffari / 57197223215
dc.authorscopusidBahman Arasteh / 39861139000
dc.authorwosidAli Ghaffari / AAV-3651-2020
dc.authorwosidBahman Arasteh / AAN-9555-2021
dc.contributor.authorJafarian, Tohid
dc.contributor.authorGhaffari, Ali
dc.contributor.authorSeyfollahi, Ali
dc.contributor.authorArasteh, Bahman
dc.date.accessioned2025-04-17T12:14:35Z
dc.date.available2025-04-17T12:14:35Z
dc.date.issued2025
dc.departmentİstinye Üniversitesi, Mühendislik ve Doğa Bilimleri Fakültesi, Bilgisayar Mühendisliği Bölümü
dc.description.abstractCutting-edge and innovative software solutions are provided to address network security, network virtualization, and other network-related challenges in highly congested SDN-powered networks. However, these networks are susceptible to the same security issues as traditional networks. For instance, SDNs are significantly vulnerable to distributed denial of service (DDoS) attacks. Previous studies have suggested various anomaly detection techniques based on machine learning, statistical analysis, or entropy measurement to combat DDoS attacks and other security threats in SDN networks. However, these techniques face challenges such as collecting sufficient and relevant flow data, extracting and selecting the most informative features, and choosing the best model for identifying and preventing anomalies. This paper introduces a new and advanced multi-stage modular approach for anomaly detection and mitigation in SDN networks. The approach consists of four modules: data collection, feature selection, anomaly classification, and anomaly response. The approach utilizes the NetFlow standard to gather data and generate a dataset, employs the Information Gain Ratio (IGR) to select the most valuable features, uses gradient-boosted trees (GBT), and leverages Representational State Transfer Application Programming Interfaces (REST API) and Static Entry Pusher within the floodlight controller to construct an exceptionally efficient structure for detecting and mitigating anomalies in SDN design. We conducted experiments on a synthetic dataset containing 15 types of anomalies, such as DDoS attacks, port scans, worms, etc. We compared our model with four existing techniques: SVM, KNN, DT, and RF. Experimental results demonstrate that our model outperforms the existing techniques in terms of enhancing Accuracy (AC) and Detection Rate (DR) while simultaneously reducing Classification Error (CE) and False Alarm Rate (FAR) to 98.80 %, 97.44 %, 1.2 %, and 0.38 %, respectively.
dc.identifier.citationJafarian, T., Ghaffari, A., Seyfollahi, A., & Arasteh, B. (2025). Detecting and mitigating security anomalies in software-defined networking (SDN) using gradient-boosted trees and floodlight controller characteristics. Computer Standards & Interfaces, 91, 103871.
dc.identifier.doi10.1016/j.csi.2024.103871
dc.identifier.endpage20
dc.identifier.scopus2-s2.0-85193449669
dc.identifier.scopusqualityQ1
dc.identifier.startpage1
dc.identifier.urihttps://hdl.handle.net/20.500.12713/6245
dc.identifier.volume91
dc.identifier.wosWOS:001242591600001
dc.identifier.wosqualityQ1
dc.indekslendigikaynakWeb of Science
dc.indekslendigikaynakScopus
dc.institutionauthorGhaffari, Ali
dc.institutionauthorArasteh, Bahman
dc.institutionauthoridAli Ghaffari /0000-0001-5407-8629
dc.institutionauthoridBahman Arasteh / 0000-0001-5202-6315
dc.language.isoen
dc.publisherElsevier b.v.
dc.relation.ispartofComputer standards and interfaces
dc.relation.publicationcategoryMakale - Uluslararası Hakemli Dergi - Kurum Öğretim Elemanı
dc.rightsinfo:eu-repo/semantics/closedAccess
dc.subjectAnomaly Detection
dc.subjectEntropy
dc.subjectFloodlight
dc.subjectGradient Boosted Trees
dc.subjectNetflow
dc.subjectSoftware-Defined Networking
dc.titleDetecting and mitigating security anomalies in software-defined networking (SDN) using gradient-boosted trees and floodlight controller characteristics
dc.typeArticle

Dosyalar

Orijinal paket
Listeleniyor 1 - 1 / 1
Küçük Resim Yok
Ä°sim:
1-s2.0-S0920548924000400-main.pdf
Boyut:
7.06 MB
Biçim:
Adobe Portable Document Format
Ä°ndir
Lisans paketi
Listeleniyor 1 - 1 / 1
Küçük Resim Yok
Ä°sim:
license.txt
Boyut:
1.17 KB
Biçim:
Item-specific license agreed upon to submission
Açıklama:
Ä°ndir

Koleksiyon

Bilgisayar Mühendisliği Bölümü Makale Koleksiyonu