An Unsupervised Attack Detection Approach for Software Defined Networks

Software Defined Networking (SDN) is quickly becoming a vital technology for the future Internet. SDN provides a worldwide network with the capacity to manage network traffic dynamically. One of the main advantages of SDN over traditional networks is that it provides better network security due to centralised control. However, the flexibility offered by SDN architecture raises several additional network security concerns that must be addressed to improve SDN network security. This study proposes an unsupervised learning method to address attacks in the SDN controller. 7 extracted features from southbound traffic have been used to train KMeans, MeanShift, Density-Based Spatial Clustering of Applications with Noise (DBSCAN), AgglomerativeClustering, Balanced Iterative Reducing and Clustering using Hierarchies (BIRCH), MiniBatchKMeans, Ordering Points To Identify Cluster Structure (OPTICS), and SpectralClustering, which are all well-known unsupervised classifiers. In terms of various well-known performance measuring criteria, such as Silhouette Score (SS), Calinski Harabasz Index (CHI), and Davies Bouldin Index (DBI), BIRCH outperforms all other classifiers.