Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning
Abstract Overview
This paper presents an automated cyber defense system for software-defined networks that combines real-time traffic monitoring, machine-learning-based attack diagnosis, and automatic mitigation. The system is organized into two modules: Network Dataset Creation (NDC), which converts and aggregates IP-flow data into training datasets, and an Intrusion Prevention System (IPS), which automates model configuration, training, evaluation, detection, and controller-triggered blocking actions. The implementation uses IP-flow features and supports multiple classical machine learning algorithms with grid search and stratified cross-validation for model selection. A case study evaluates the approach on a university campus traffic dataset and demonstrates online detection and mitigation of a SYN flooding attack.
Novelty
The distinctive contribution is the integration of the full operational cycle into one SDN-oriented tool: automated flow-dataset construction, assisted classifier selection, and automatic insertion of blocking rules at the controller. The paper positions this end-to-end automation as less explored than prior work that focuses mainly on detection accuracy on public datasets.
Results
In the reported case study, the authors trained models on a 95 GB campus-network dataset containing normal traffic plus DoS and Probe attacks, and selected KNN for the demonstrated deployment. For that scenario, KNN achieved 96.6% accuracy, 93.7% precision, 100% recall, and 96.7% F1-score, and the system detected and blocked a SYN flooding attack in 21 seconds without human intervention.
Key Points
- The NDC module automates IP-flow extraction, preprocessing, and aggregation to build training datasets from raw traffic captures.
- The IPS module supports comparative training and evaluation of six machine learning algorithms and can load a chosen model for live monitoring.
- The demonstrated SDN workflow pushes blocking rules to the Floodlight controller after attack detection, enabling automatic containment of a SYN flood attack.