A Hybrid Deep Learning Approach for Network Intrusion Detection System in Software-Defined Networking with Hybrid Feature Selection

The increasing adoption of Software-Defined Networking (SDN) introduces flexible and programmable architectures but also creates new security challenges, including vulnerability to Distributed Denial-of-Service (DDoS), botnet, and probing attacks. Traditional intrusion detection systems often fall short in adapting to dynamic SDN environments d ue to high false alarm rates and limited generalization. This paper proposes a hybrid deep learning model—CNN-BiLSTM—designed to detect network intrusions in SDN infrastructures. The proposed approach leverages the spatial feature extraction capabilities of Convolutional Neural Networks (CNN) and the sequential learning power of Bidirectional Long Short-Term Memory (BiLSTM) networks. A hybrid feature selection technique combining Random Forest and Recursive Feature Elimination (RFE) is employed to enhance learning efficiency. Experiments conducted on benchmark datasets including NSL-KDD, UNSW-NB15, and InSDN demonstrate that the CNN-BiLSTM model achieves superior performance in both binary and multiclass classification tasks, outperforming baseline models in accuracy, F1-score, and detection rate. These results confirm the model’s effectiveness in enhancing SDN security against evolving cyber threats