An incremental hybrid adaptive network-based IDS in Software Defined Networks to detect stealth attacks
Abdullah H Alqahtani
TL;DR
The paper addresses the challenge of stealthy attacks and concept drift in SDN-based intrusion detection by proposing an incremental adaptive hybrid NIDS that combines signature-based Adaptive Random Forest (ARF) with anomaly-based Adaptive One-Class SVM (OC-SVM). Concept drift is detected and managed using ADWIN to keep both detectors updated in streaming data, enabling detection of both known and unknown attacks. Evaluations across DAPT 2020, APT-SDN, InSDN, and CICIDS2017 show high accuracy (~0.99) and robust drift handling, outperforming non-adaptive baselines and highlighting the benefits of a drift-aware, SDN-enabled NIDS. The work demonstrates practical viability for robust intrusion detection in dynamic SDN environments and outlines avenues for exploring additional drift techniques and deployment scenarios.
Abstract
Network attacks have became increasingly more sophisticated and stealthy due to the advances in technologies and the growing sophistication of attackers. Advanced Persistent Threats (APTs) are a type of attack that implement a wide range of strategies to evade detection and be under the defence radar. Software Defined Network (SDN) is a network paradigm that implements dynamic configuration by separating the control plane from the network plane. This approach improves security aspects by facilitating the employment of network intrusion detection systems. Implementing Machine Learning (ML) techniques in Intrusion Detection Systems (IDSs) is widely used to detect such attacks but has a challenge when the data distribution changes. Concept drift is a term that describes the change in the relationship between the input data and the target value (label or class). The model is expected to degrade as certain forms of change occur. In this paper, the primary form of change will be in user behaviour (particularly changes in attacker behaviour). It is essential for a model to adapt itself to deviations in data distribution. SDN can help in monitoring changes in data distribution. This paper discusses changes in stealth attacker behaviour. The work described here investigates various concept drift detection algorithms. An incremental hybrid adaptive Network Intrusion Detection System (NIDS) is proposed to tackle the issue of concept drift in SDN. It can detect known and unknown attacks. The model is evaluated over different datasets showing promising results.