Collaborative Detection Technology of SDN Abnormal Traffic Based on Federated Learning

doi:10.19678/j.issn.1000-3428.0064310

Abstract

Abstract: Anomaly detection is an effective method for discovering potential security threats.However, current anomaly detection methods used in the Software-Defined Network(SDN) exhibit commom problems such as weak adaptability, poor coordination.This study proposes a collaborative anomaly detection technology based on federated learning, which fully utilizes the characteristics of the topology and traffic in the network.First, a collaborative detection architecture based on multiple detection nodes is developed via federated learning.This study extracts features with the information entropy, analyzes the traffic correlation with the relative entropy, and formulates the parameter aggregation weight optimization algorithm to train an efficient and adaptive anomaly detection model.Finally, the parameter aggregation weight optimization algorithm is applied for collaborative training and optimizing of the anomaly detection model with multiple detection nodes to improve the detection accuracy in anomaly detection.The simulation results show that compared with the independent training and traditional federated learning algorithm, the detection accuracy of the proposed algorithm is improved by 31.69% and 7.92%, respectively.Thus, the proposed algorithm has a better abnormal traffic detection effect and stronger environmental adaptability.

Key words: Software-Defined Network(SDN), federated learning, abnormal traffic, collaborative detection, information entropy

摘要： 网络流量异常状态检测是发现潜在安全威胁的重要手段，但是现有异常流量检测方法普遍存在环境适应性不强、协同能力较弱等问题。结合SDN网络的拓扑结构与流量特征，提出基于联邦学习的异常流量协同检测技术。利用SDN网络中的检测节点，构建基于联邦学习的多检测节点协同检测架构。通过信息熵计算提取流量特征，从相对熵的角度分析检测节点的流量关联度，并根据该关联度设计模型训练过程中的参数聚合权重优化算法，提高检测模型的适应能力。应用参数聚合权重优化算法进行多检测节点异常流量检测模型的协同训练，提升检测模型对异常流量的识别准确率。仿真结果表明，与本地独立训练和传统联邦学习算法相比，基于参数聚合权重优化算法的识别准确率分别提升了31.69%和7.92%，具有更好的异常流量检测效果及更强的环境适应能力。

关键词: 软件定义网络, 联邦学习, 异常流量, 协同检测, 信息熵

CLC Number:

TP393.0

CHEN Hexiong, LUO Yuwei, WEI Yunkai, GUO Wei, HANG Feilu, HE Yingjun, YANG Ning. Collaborative Detection Technology of SDN Abnormal Traffic Based on Federated Learning[J]. Computer Engineering, 2023, 49(3): 168-176.

陈何雄, 罗宇薇, 韦云凯, 郭威, 杭菲璐, 何映军, 杨宁. 基于联邦学习的SDN异常流量协同检测技术[J]. 计算机工程, 2023, 49(3): 168-176.

/ / Recommend / Download Citations

URL: http://www.ecice06.com/EN/10.19678/j.issn.1000-3428.0064310

http://www.ecice06.com/EN/Y2023/V49/I3/168

Figures/Tables 9

References

[1] KREUTZ D, RAMOS F M V, VERISSIMO P E, et al.Software-defined networking:a comprehensive survey[J].Proceedings of the IEEE, 2014, 103(1):14-76.
[2] ZENG Y, GUO S T, LIU G Y.Comprehensive link sharing avoidance and switch aggregation for software-defined data center networks[J].Future Generation Computer Systems, 2019, 91:25-36
[3] 曹永轶, 金伟正, 吴静, 等.一种面向SDN的跨平面协作DDoS检测与防御方法[J].计算机工程, 2020, 46(11):148-156. CAO Y Y, JIN W Z, WU J, et al.A DDoS detection and defense method based on cross plane cooperation for SDN[J].Computer Engineering, 2020, 46(11):148-156.(in Chinese)
[4] 张朝昆, 崔勇, 唐翯祎, 等.软件定义网络(SDN)研究进展[J].软件学报, 2015, 26(1):62-81. ZHANG C K, CUI Y, TANG H Y, et al.State-of-the-art survey on Software-Defined Networking(SDN)[J].Journal of Software, 2015, 26(1):62-81.(in Chinese)
[5] 徐玉华, 孙知信.软件定义网络中的异常流量检测研究进展[J].软件学报, 2020, 31(1):183-207. XU Y H, SUN Z X.Research development of abnormal traffic detection in software defined networking[J].Journal of Software, 2020, 31(1):183-207.(in Chinese)
[6] 何亨, 胡艳, 郑良汉, 等.云环境中基于SDN的高效DDoS攻击检测与防御方案[J].通信学报, 2018, 39(4):139-151. HENG H, HU Y, ZHENG L H, et al.Efficient DDoS attack detection and prevention scheme based on SDN in cloud environment[J].Journal on Communications, 2018, 39(4):139-151.(in Chinese)
[7] MOUSAVI S M, ST-HILAIRE M.Early detection of DDoS attacks against SDN controllers[C]//Proceedings of International Conference on Computing, Networking and Communications(ICNC).Washington D.C., USA:IEEE Press, 2015:77-81.
[8] JANKOWSKI D, AMANOWICZ M.On efficiency of selected machine learning algorithms for intrusion detection in software defined networks[J].International Journal of Electronics and Telecommunications, 2016, 62(3):247-252.
[9] WANG P, CHAO K M, LIN H C, et al.An efficient flow control approach for SDN-based network threat detection and migration using support vector machine[C]//Proceedings of the 13th International Conference on E-Business Engineering(ICEBE).Washington D.C., USA:IEEE Press, 2016:56-63.
[10] LATAH M, TOKER L.Towards an efficient anomaly-based intrusion detection for software-defined networks[J].IET Networks, 2018, 7(6):453-459.
[11] CUI J, ZHANG J, HE J T, et al.DDoS detection and defense mechanism for SDN controllers with K-Means[C]//Proceedings of the 13th International Conference on Utility and Cloud Computing(UCC).Washington D.C., USA:IEEE Press, 2020:394-401.
[12] 林昕, 吕峰, 姜亚光, 等.网络异常流量智能感知模型构建[J].工业技术创新, 2021, 8(3):7-14. LIN X, LÜ F, JIANG Y G, et al.Establishment of intelligent perception model of abnormal network traffic[J].Industrial Technology Innovation, 2021, 8(3):7-14.(in Chinese)
[13] 陈解元.基于LSTM的卷积神经网络异常流量检测方法[J].信息技术与网络安全, 2021, 40(7):42-46. CHEN X Y.Network intrusion detection based on convolutional neural networks with LSTM[J].Information Technology and Network Security, 2021, 40(7):42-46.(in Chinese)
[14] 陈怡欣.SDN环境下的流量异常检测技术研究[D].合肥:中国科学技术大学, 2021. CHEN Y X.Abnormal traffic detection technology in software-defined network[D].Hefei:University of Science and Technology of China, 2021.(in Chinese)
[15] 王丽宝.基于协同学习的网络异常检测研究[D].北京:北京化工大学, 2020. WANG L B.Research on network anomaly detection based on collaborative learning[D] Beijing:Beijing University of Chemical Technology, 2020.(in Chinese)
[16] MCMAHAN H B, MOORE E, RAMAGE D, et al.Communication-efficient learning of deep networks from decentralized data[EB/OL].[2022-02-11].https://arxiv.org/abs/1602.05629.
[17] 杨强.AI与数据隐私保护:联邦学习的破解之道[J].信息安全研究, 2019, 5(11):961-965. YANG Q.AI and data privacy protection:the way to federated learning[J].Journal of Information Security Research, 2019, 5(11):961-965.(in Chinese)
[18] YANG Q, LIU Y, CHEN T J, et al.Federated machine learning[J].ACM Transactions on Intelligent Systems and Technology, 2019, 10(2):1-19.
[19] 周传鑫, 孙奕, 汪德刚, 等.联邦学习研究综述[J].网络与信息安全学报, 2021, 7(5):77-92. ZHOU C X, SUN Y, WANG D G, et al.Survey of federated learning research[J].Chinese Journal of Network and Information Security, 2021, 7(5):77-92.(in Chinese)
[20] SHARMA S, XING C P, LIU Y, et al.Secure and efficient federated transfer learning[C]//Proceedings of IEEE International Conference on Big Data.Washington D.C., USA:IEEE Press, 2019:2569-2576.
[21] 刘奕, 李建华, 张一瑫, 等.基于特征属性信息熵的网络异常流量检测方法[J].信息网络安全, 2021, 21(2):78-86. LIU Y, LI J H, ZHANG Y T, et al.Network abnormal flow detection method based on feature attribute information entropy[J].Netinfo Security, 2021, 21(2):78-86.(in Chinese)
[22] LAKHINA A, CROVELLA M, DIOT C.Mining anomalies using traffic feature distributions[J].ACM SIGCOMM Computer Communication Review, 2005, 35(4):217-228.
[23] 李蕊, 张路桥, 李海峰, 等.基于熵的网络异常流量检测研究综述[J].计算机系统应用, 2017, 26(6):36-39. LI R, ZHANG L Q, LI H F, et al.Survey of entropy-based network traffic anomaly detection methods[J].Computer Systems & Applications, 2017, 26(6):36-39.(in Chinese)
[24] 关卿, 王宏, 李全良.信息熵在网络流量矩阵估算中的应用[J].计算机工程, 2010, 36(14):77-78, 81. GUAN Q, WANG H, LI Q L.Application of information entropy in network traffic matrix estimation[J].Computer Engineering, 2010, 36(14):77-78, 81.(in Chinese)
[25] LI T, SAHU A K, TALWALKAR A, et al.Federated learning:challenges, methods, and future directions[J].IEEE Signal Processing Magazine, 2020, 37(3):50-60.
[26] DUCHI J, HAZAN E, SINGER Y.Adaptive subgradient methods for online learning and stochastic optimization[J].Journal of machine learning research, 2011, 12(61):2121-2159.
[27] VOGELS T, KARIMIREDDY S P, JAGGI M.PowerSGD:practical low-rank gradient compression for distributed optimization[C]//Proceedings of the 33rd International Conference on Neural Information Processing Systems.New York, USA:ACM Press, 2019:14269-14278.
[28] WANG H, SIEVERT S, CHARLES Z, et al.ATOMO:communication-efficient learning via atomic sparsification[C]//Proceedings of the 32nd International Conference on Neural Information Processing Systems, New York, USA:Curran Associates Inc., 2018:9872-9883.
[29] KONEČNÝ J, MCMAHAN H B, YU F X, et al.Federated learning:strategies for improving communication efficiency[EB/OL].[2022-02-11].https://arxiv.org/abs/1610.05492.
[30] MOUSTAFA N, SLAY J.UNSW-NB15:a comprehensive data set for network intrusion detection systems(UNSW-NB15 network data set)[C]//Proceedings of Military Communications and Information Systems Conference(MilCIS).Washington D.C., USA:IEEE Press, 2015:1-6.

Please choose a citation manager

Content to export