Intrusion Detection Using Extremely Limited Data Based on SDN

In Western Europe, the number of Internet connected devices is expected to increase from the 2.3 billion devices in 2017, to 4 billion in 2022. Dealing with this growth is an increasing problem for administrators attempting to ensure that Quality of Service levels are maintained. Software Defined Networking (SDN) has been proposed as one of the solutions to some of the problems caused by this increasing volume of data, such as the time it takes to manually reconfigure switches in response to changing network conditions. SDN moves the distributed networking paradigm to a centralised solution, which is easier to manage, but comes with other issues for security focused administrators. SDN can lead to a reduction in the amount of information available for Intrusion Detection Systems (IDSs). This is because IDSs still rely on direct packet sampling techniques, which can provide more information than the aggregated view of networks SDN flow tables provide. As deep learning and other artificial intelligence techniques look likely to become more commonplace in IDSs, this reduction in information becomes an increasing problem. Many of these methods require large training sets with many features. In this paper, we propose a method to correct this imbalance through the creation of a novel framework, which will allow upwards of 90% precision on the state of the art UNSW-NB15 dataset while only using a small fraction of the features available, matching those available within a SDN environment.