An optimization-inspired intrusion detection model for software-defined networking

As an emerging network architecture, software-defined networking (SDN) has the core concept of separating the control plane from the network hardware and unifying its management by a central controller. Since the centralized control of SDN is such that an attack on the controller can lead to the paralysis of the entire network, intrusion detection has become particularly significant for SDN. Currently, more and more intrusion detection systems based on machine learning and deep learning are being applied to SDN, but most have drawbacks such as complex models and low detection accuracy. This paper proposes an enhanced spider wasp optimizer (ESWO) algorithm for feature dimensionality reduction of intrusion detection datasets and constructs a new intrusion detection model (IDM), namely ESWO-IDM, for SDN. The ESWO algorithm integrates multiple strategies, including tent chaotic map strategy and elite opposition learning strategy to improve the diversity of the population, Lévy flight strategy to prevent the algorithm from falling into local optimum in the early stage, and dynamic adjustment strategy of control parameters to balance exploration and exploitation of the algorithm. ESWO was empirically evaluated using eight benchmark test functions and four UCI datasets to comprehensively demonstrate its advantages. Binary and multiclassification experiments were conducted using the InSDN dataset to analyze the ESWO-IDM performance and compare it with other IDMs. The experimental results show that the ESWO-IDM achieves the best performance in all the metrics in both binary classification and multiclassification and has the most prominent effect on the detection of normal, denial of service (DoS), distributed DoS, and Brute Force Attack types, which effectively improves SDN intrusion detection from the viewpoint of optimization.