An interpretable intrusion detection system for software defined networks using feature optimization and temporal learning

The Software Defined Network (SDN) system has transformed network management through its ability to operate dynamic network configurations from a central control point which manages all network resources. The machine learning-based Intrusion Detection System (IDS) which currently exists needs to address three fundamental problems because these issues result in poor detection effectiveness while requiring extensive training and making it hard to understand their classification outcomes. In an attempt to evade these limitations, this paper will present a new security model known as Gazelle Optimized Ensemble IntruDet Model (GOEIM) to SDN environment protection. The given GOEIM architecture recommends that the data should be preprocessed and then its normalization, which would stabilize the features, followed by the Gazelle Optimization Algorithm (GOA), to perform a dimensionality reduction and optimal selection of features. A hybrid explainability-oriented feature discrimination mechanism known as Permutation-Enhanced Relevance Learning with Explainability (PERL-X) that is a combination of Permutation Feature Importance, Layer-wise Relevance Propagation, and DeepLIFT is one of the contributions to the field made by the work. A succession model of bidirectional temporal dependencies of SDN traffic is then realized by another Bi-directional Simple Recurrent Unit (Bi-SRU) model that will make it possible to classify intrusion correctly and promptly. Experimental evaluation of the proposed GOEIM using benchmark SDN intrusion dataset reveals that it is very high with detection accuracy of 99.37, reduction rate of false alarm is 41.6 and training efficiency is 28.4 percent as compared to the available IDS models.