Real-Time Anomaly Detection in Software-Defined Networks using an Integrated ELK Stack and Machine Learning Framework

Abstract Software-Defined Networking (SDN) enhances net-work programmability and management by separating the control and data planes. However, this centralized architec-ture introduces significant security vulnerabilities, making the controller a prime target and necessitating robust, real-time monitoring. Traditional tools often fall short in dynamic SDN environments. This paper presents an integrated framework for real-time anomaly detection in SDN. The system utilizes Mininet for SDN emulation with an OpenDaylight controller, and leverages the ELK stack [6] (Elasticsearch, Logstash, Kibana), augmented by Filebeat and RSyslog, for comprehensive log collection from both control and data planes. Logs are pro-cessed, parsed, and indexed for analysis. Machine learning capabilities within Kibana are employed for anomaly detection. Experimental results demonstrate successful centralized log management, real-time visualization of network activity, and the detection of 47 distinct anomaly events during simulated DDoS-like attacks, with these events further classified into 50 critical/major and 28 warning severity instances. The primary contribution is a practical, end-to-end system demonstrating effective real-time anomaly detection in SDN using a customized ELK and ML approach.