Network anomaly detection with machine learning techniques for SDN networks

Abstract

Security is a concern for traditional networks and those based on new technology such as Software Defined Networks (SDN) and Internet of Things (IoT). Machine learning techniques are typical to automatically identify and classify attacks in the form of intrusion detection systems. This paper presents machine learning algorithms for attack classification over the CES CIC IDS2018 dataset. The analysis includes an evaluation of the performance of traditional Machine Learning (ML) techniques such as Decision Trees (DT), Random Forest (RF), and a Neural Network architecture in two different samples of the dataset: one with the all the features and another with selected features for SDN. The details of the dataset, as well as the used methodology and evaluation results, are presented in this paper. After a comparison between the different ML algorithms, the conclusion is that DT and RF are both highly accurate for classification (97% for all the features and 87% for the SDN features) and also require less processing.