A HYBRID TRANSFORMER-BASED DEEP LEARNING FRAMEWORK FOR REAL-TIME CYBERATTACK DETECTION IN SOFTWARE-DEFINED NETWORKS

Abstract

SDN is a new paradigm in network management, which targets to decouple the control plane from the data plane, resulting in a new flexible, programmable and centralized network management system for resource administration. One of the critical issues with Software-Defined Networking security is the presence of a centralized component, the SDN controller, that can be a source of vulnerabilities to the data flows or to the SDN controller itself. In this paper, we introduce a hybrid approach to intrusion detection known as TransSDN-Hybrid, that combines the self-attention mechanisms of transformers with one-dimensional Convolutional Neural Networks to boost the accuracy and effectiveness of detecting cyberattacks in Software-Defined Networking environments. It is a novel Temporal Positional Encoding method for preserving the temporal information for a deeper understanding of complex attack trajectories. Furthermore, to achieve near-zero inference latency feature and more compact sizes, knowledge distillation, INT8 quantization is employed. The proposed system has been assessed based on the datasets of InSDN, CICIDS2017, and SDN-FlowTrace; and evaluated in comparison with well known Intrusion Detection Schemes for machine learning era, Deep Learning era and State-of-the Art Transformer-based era. According to the experimental results, the detection accuracy of TransSDN-Hybrid attains promising results with 99.34%, 99.46% and 98.87% in the InSDN, CICIDS2017, and SDN-FlowTrace datasets, respectively, with maintaining high throughput and low latency. The findings support the proposed architecture to have a decent detection-accuracy solution while maintaining computation efficiency and deployment feasibility, setting it as a suitable solution for detecting cyber attacks in the next-generation SDN networks in real time.