Search

Addressing the high computational expenses, congested shared links, and propensity for single-point failures in network devices that can lead to a degradation of software defined network (SDN) service quality or even network paralysis during the execution of large-scale SDN detection tasks by traditional abnormal traffic detection methods, a distributed abnormal traffic detection method for SDN based on deep learning was proposed. This method constructed a “one-to-many” distributed generative adversarial network (D-VAE-WGAN) with a discriminator deployed on a cloud server and multiple generators deployed on SDN controllers. Utilizing normal traffic samples, collaborative training of the D-VAE-WGAN was completed, resulting in independent abnormal traffic detection proxies on controllers, enabling distributed detection of abnormal traffic within each controller's subnet in a large-scale SDN environment. Experimental results indicate that this method can rapidly and accurately detect abnormal samples in large-scale SDN, outperforming traditional methods in detection metrics such as accuracy and recall rate, and can detect unknown anomalies.

At present, the threats to network security are also increasing, among which abnormal traffic detection is the key link to ensure network security. Traditional detection methods based on signature or threshold are often difficult to adapt to the increasingly complex network environment and new attack methods. Therefore, this paper optimizes and improves the data processing technology, proposes a network ATD method based on particle swarm optimization (PSO) algorithm, and explores in detail the traffic data collection and pre-processing, the feature recognition of abnormal traffic, the application of PSO algorithm, real-time monitoring and response mechanism. The results of two sets of simulation experiments are as follows: compared with the traditional model, the accuracy rate of ATD of the improved algorithm is increased by 7.2% on average, and the detection time is reduced by 7.35s on average. This method not only enhances the adaptability of the model to new attacks, but also improves the degree of automation of detection. [ABSTRACT FROM AUTHOR]

Considering the problems of traditional intrusion detection methods limited by the class imbalance of datasets and the poor representation of selected features, a detection method based on VAE-CWGAN and fusion of statistical importance of features was proposed. Firstly, data preprocessing was conducted to enhance data quality. Secondly, a VAE-CWGAN model was constructed to generate new samples, addressing the problem of imbalanced datasets, ensuring that the classification model no longer biased towards the majority class. Next, standard deviation, difference of median and mean were used to rank the features and fusion their statistical importance for feature selection, aiming to obtain more representative features, which made the model can better learn data information. Finally, the mixed data set after feature selection was classified through a one-dimensional convolutional neural network. Experimental results show that the proposed method demonstrates good performance advantages on three datasets, namely NSL-KDD, UNSW-NB15, and CIC-IDS-2017. The accuracy rates are 98.95%, 96.24%, and 99.92%, respectively, effectively improving the performance of intrusion detection. [ABSTRACT FROM AUTHOR]

Traditional low-rate denial of service (LDoS) attack detection methods were complex in feature extraction, high in computational cost, single in experimental data background settings, and outdated in attack scenarios, so it was difficult to meet the demand for LDoS attack detection in a real network environment. By studying the principle of LDoS attack and analyzing the features of LDoS attack traffic, a detection method of LDoS attack based on simple statistical features of network traffic was proposed. By using the simple statistical features of network traffic packets, the detection data sequence was constructed, the time correlation features of input samples were extracted by deep learning technology, and the LDoS attack judgment was made according to the difference between the reconstructed sequence and the original input sequence. Experimental results show that the proposed method can effectively detect the LDoS attack traffic in traffic and has strong adaptability to heterogeneous network traffic. [ABSTRACT FROM AUTHOR]