DeepIDPS: An Adaptive DRL-Based Intrusion Detection and Prevention System for SDN

Abstract

Most intrusion detection systems (IDS) are vulnerable to novel attacks and struggle to maintain a balance between high accuracy and a low false positive rate. Furthermore, the relevant features of Distributed Denial of Service (DDoS) attacks in conventional networks may not necessarily apply to the Software-defined network (SDN) environment. Additionally, weak feature selection algorithms can omit critical parameters and result in significant data loss. Although earlier works on network flow analysis using Long Short-Term Memory (LSTM) show excellent ability, they fall short in obtaining deep features from network flow, resulting in lower accuracy. The emergence of Attention Mechanism(AM) and deep reinforcement learning (DRL) present a promising solution for intrusion detection and enhancing security in SDN. AM has the capability to assign varying weights to different network traffic features, enabling IDS to extract and emphasize more crucial information. This paper introduces DeepIDPS, a novel DRL-based network intrusion detection system utilizing a CNN-LSTM approach and Attention Mechanism specifically designed for SDN environments. DeepIDPS demonstrates an exceptional ability for continuous auto-learning within the network context, effectively identifying diverse forms of network intrusions while significantly augmenting both prevention and detection capabilities.

Topics & Concepts