TPOT-IDSDN: an AutoML-based model optimisation for intrusion detection system against cyber threats in software defined-networking

The architectural shift of software defined networks (SDN) creates new security concerns, necessitating the creation of robust intrusion detection systems (IDS) to protect the network infrastructure. This paper focuses on the essential challenge of selecting classifiers for anomaly-based IDS in an SDN environment. An automated machine learning (AutoML) framework called tree-based pipeline optimisation tool (TPOT) was used to speed up this procedure substantially. TPOT automates model selection and hyperparameter optimisation, to decide a best classifier suited for the given dataset. The TPOT framework selected the ExtraTreesClassifier for multiclass and the XGB stacked with the BernoulliNB classifier for binary class with lower execution time (26.91 s, 11.29 s) and 100% accuracy. A comprehensive examination of standard nine machine learning (ML) classifiers confirmed TPOT has provided the best model. When deployed in the IDS framework of SDN, the selected classifiers showed a 100% detection rate that outperformed other existing approaches.