Content area
The proliferation of Software-Defined Networks (SDNs) has revolutionized network management by decoupling the control and data planes, thereby introducing unparalleled flexibility and programmability. However, this architectural shift also exposes SDNs to a wide range of security threats, making them highly susceptible to sophisticated and dynamic cyberattacks. Traditional Intrusion Detection Systems (IDSs), often designed for static and monolithic network architectures, struggle to adapt to the dynamic nature and unique requirements of SDNs. This dissertation presents a comprehensive study on enhancing IDS performance in SDNs by integrating advanced machine learning, deep learning, and innovative transformer-based models.
The research begins by addressing the inherent challenges of SDN-based IDSs, including the need for scalable solutions capable of processing high volumes of network traffic, resource efficiency in managing IDS infrastructure, adaptability to evolving and zero-day attacks, and the complexities of multi-stage attack detection. To tackle these challenges, this dissertation makes the following significant contributions:
-Traffic-Aware Load Balancing and IDS Chaining: A novel framework is introduced for clustering traffic flows based on their characteristics and dynamically chaining IDSs to optimize resource utilization. This method reduces computational overhead while maintaining high detection accuracy, enabling SDNs to manage traffic bursts efficiently.
-Machine Learning and Continual Learning Approaches: The study incorporates few-shot and lifelong learning methodologies to mitigate catastrophic forgetting and enhance the adaptability of IDSs to zero-day attacks. By leveraging advanced anomaly detection techniques, the framework provides robust protection against previously unseen attack vectors.
-Deep Reinforcement Learning for Adaptive Security: A Deep Reinforcement Learning (DRL)-based framework is proposed, capable of learning optimal defense strategies in real-time. This approach effectively balances the trade-off between detection accuracy and computational efficiency, ensuring the system's resilience under dynamic network conditions.
-Transformer-Based Intrusion Detection Framework: A pioneering multi-modal Transformer-based IDS (TransIDS) is developed, combining log message analysis with packet-level data from PCAP files. The framework employs attention mechanisms to capture temporal and contextual dependencies, enabling the accurate detection of complex, multi-stage attack scenarios.
-Cross-Domain Multi-Stage Attack Detection: The dissertation further introduces CrossAlert, a novel alert-based system that leverages semantic embeddings and prototypical networks to detect multi-stage attacks across different operational domains. By addressing domain shift challenges, CrossAlert ensures high performance and adaptability in diverse environments.
The effectiveness of the proposed solutions is validated through extensive experiments on benchmark datasets, demonstrating superior performance compared to state-of-the-art approaches. Notably, the frameworks achieve higher detection rates, reduced false positives, and improved scalability, making them well-suited for deployment in large-scale, real-world SDN environments.
This work represents a significant advancement in the field of cybersecurity for SDNs, bridging the gap between traditional intrusion detection methods and the demands of modern, dynamic networks. By combining theoretical insights with practical implementations, this dissertation lays a robust foundation for the development of intelligent, resource-efficient, and adaptable IDSs, paving the way for more secure and resilient SDN architectures.
