A hybrid IndRNNLSTM approach for real-time anomaly detection in software-defined networks

TL;DR

This paper introduces a hybrid IndRNN-LSTM model combined with feature selection techniques for real-time anomaly detection in SDN, demonstrating improved accuracy on the NSL-KDD dataset.

Contribution

The novel hybrid IndRNN-LSTM approach effectively captures both dependent and non-dependent features for anomaly detection in SDN environments.

Findings

Achieved MAE=1.22 and RMSE=9.92 on NSL-KDD dataset

Hybrid model outperforms traditional RNN-based methods

Feature selection enhances model performance

Abstract

Anomaly detection in SDN using data flow prediction is a difficult task. This problem is included in the category of time series and regression problems. Machine learning approaches are challenging in this field due to the manual selection of features. On the other hand, deep learning approaches have important features due to the automatic selection of features. Meanwhile, RNN-based approaches have been used the most. The LSTM and GRU approaches learn dependent entities well; on the other hand, the IndRNN approach learns non-dependent entities in time series. The proposed approach tried to use a combination of IndRNN and LSTM approaches to learn dependent and non-dependent features. Feature selection approaches also provide a suitable view of features for the models; for this purpose, four feature selection models, Filter, Wrapper, Embedded, and Autoencoder were used. The proposed IndRNNLSTM algorithm, in combination with Embedded, was able to achieve MAE=1.22 and RMSE=9.92 on NSL-KDD data.