Search

In this study, we present and implement the SAnDet (SDN anomaly detector) architecture, an anomaly-based intrusion detection system designed to take advantage of the capabilities offered by software-defined networking (SDN) architecture, as a controller application. The SAnDet system is composed of three modules: statistics collection, anomaly detection, and anomaly prevention. In particular, we utilize replicator neural networks (RNN), which is a specialized variant of the autoencoder, and the LSTM-based encoder–decoder (EncDecAD) method, which is a special type of long short-term memory (LSTM) network that has demonstrated a strong performance on data series particularly, to identify unknown attacks using flow features collected from OpenFlow switches. In our experiments, we utilize flow-based features extracted from network traffic data containing various types of attacks as input to our models in the form of time series. We evaluate the performance of our methods using the accuracy and area under the receiver operating characteristic curve (AUC) metrics. Our experimental results demonstrate that EncDecAD outperforms RNN and that our approach offers several benefits over previously conducted research. [ABSTRACT FROM AUTHOR]

B Correction to: Neural Computing and Applications (2023) 35:12,175-12,193 b https://doi.org/10.1007/s00521-023-08376-5 The author of the above article has requested to correct the below provided reference citations in the Published article: In page 12,177, the first line from the third paragraph should read as below: Deep learning methods include a knowledge-based learning-based development algorithm, and the keywords for deep learning are unsupervised machine learning, multilayer learning, and artificial intelligence [29][7]. In page 12,182, Under the heading 3.3 Evaluation metrics, the last paragraph should read as below: Receiver operating characteristics (ROC): In the case of a class imbalance problem in the dataset, the ROC curve [58][59] is being used as a normal criterion for testing classifiers [60]. [Extracted from the article]