Clustering and feature selection based approach for detecting Attacks in SDN Networks

Software-Defined Networking (SDN) is a recent technology that separates the network control plane from the data plane. It enables more automated provisioning and offers several advantages, such as improved manageability, scalability, and performance. However, SDN involves specific security challenges, such as Distributed Denial of Service (DDoS) attacks, particularly flooding attacks with a very high packet-per-second rate. These attacks can overwhelm the SDN controller and OpenFlow switches, potentially leading to total network failure. To address these challenges, we propose an intrusion detection system that performs two main tasks: monitoring network traffic and extracting relevant features in the SDN environment, and predicting these flows in real-time to classify them as either legitimate or malicious using an unsupervised learning technique known as clustering. Additionally, a feature selection method is employed to enhance the model and improve its performance.