Source-linked AI summary
Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning
Alexandre Amaral, Fernando Moro, Ana Malheiro
TL;DR
The paper addresses the need for attack response that can operate within rapidly shrinking attacker timelines and reduce reliance on manual diagnosis and mitigation. It presents an automated machine-learning and SDN system that creates training data, selects classifiers, detects attacks, and issues blocking rules. In a SYN flooding case study, KNN achieved a 96.7% F1-score and automatic detection and blocking completed in 21 seconds.
Problem
Manual attack diagnosis and mitigation are slow and costly, while breakout time can reach 27 seconds, creating a need for more automated response.
Method
The system automatically creates and aggregates IP-flow training data, evaluates machine-learning algorithms, and uses an IPS module to trigger SDN blocking rules.
Results
96.7% F1-score was achieved by KNN, and the attack was automatically detected and blocked after 21 seconds.
Takeaways & Limitations
The experiments and case study show the system’s potential to enable automatic attack detection and mitigation with minimal human intervention.
Takeaways & Limitations
Future work will analyze additional algorithms, test large-scale networks, and compare distributed and federated approaches in production scenarios.
Abstract
from arXiv · showhide
Autonomous response has evolved into a timing-critical challenge rather than solely a matter of detection accuracy. In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds, a window that precludes any human-in-the-loop workflow. This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement, evaluating its performance against this stringent temporal constraint rather than relying exclusively on detection accuracy. An automated data pipeline collects IP flows and aggregates them into labeled training data, while a prevention module selects and trains candidate classifiers and issues blocking rules directly to the SDN controller. In a SYN flooding denial of service case study, the deployed K-Nearest Neighbors classifier achieved an F1 score of 96.7% and the cycle from flow availability to enforced block completed in 21 seconds, below the fastest breakout time reported to date.
1 Introduction
Network complexity, heterogeneity, and rapidly advancing attacks make manual diagnosis and mitigation increasingly difficult and time-consuming. The proposed system automates machine-learning model development, real-time attack response, and SDN countermeasures to reduce manual intervention.
- Motivation: Network heterogeneity, vulnerabilities, and IoT exposure have increased the challenges of detecting and mitigating attacks.The paper highlights heterogeneous devices and protocols, growing vulnerabilities, and IoT devices used in DDoS attacks.
- Motivation: 27 seconds was the fastest observed interval between initial access and lateral movement, making operator-dependent response cycles too slow.Breakout time is defined as the interval from initial access to movement to a second host.
- Motivation: Manual analysis of large attack-related logs is slow and costly, while even a few minutes of downtime may cause substantial losses.The paper connects manual decision-making and downtime with operational and financial consequences.
- Enabling Technologies: Software-defined networking separates control and forwarding functions, making network management directly programmable and more homogeneous.This programmability supports automated control of forwarding devices and simplifies administration.
- Proposed System: The proposed system automates attack diagnosis, model modeling, training, and evaluation while applying configured countermeasures in real time.It also supports selecting an algorithm using effectiveness and efficiency metrics and specifying automated SDN actions.
- Proposed System: The system seeks to accelerate detection and corrective actions, minimize manual intervention, and support network resilience and service availability.The paper presents these goals as potential benefits of the automated response workflow.
2 Related Work
Prior SDN security studies largely emphasize attack classification or specialized mitigation mechanisms. The paper identifies a less explored integration of automated dataset construction, classifier selection, and controller-level blocking.
- Detection-Focused Studies: Random Forest achieved 99.99% accuracy on the DDoS-SDN dataset, but the evaluated procedure stopped at classification without executing countermeasures.Sawah et al. combined feature selection, Grid Search, and fivefold cross-validation.
- Detection-Focused Studies: A hybrid CNN-GRU model led six deep-learning models, while another framework combined federated and explainable SDN detection with quantum-inspired feature selection.These studies prioritize classifier accuracy rather than automating the complete detection-to-mitigation cycle.
- Mitigation Approaches: Other related work proposes tiered SDN defense, on-demand cloud-native mitigation chains, or slice-oriented DDoS filtering.These approaches address mitigation architectures or network slicing rather than the paper’s complete operational workflow.
- Distributed and Lightweight Approaches: Lightweight, distributed, federated, and IoT-oriented approaches explore attack detection using router statistics, contrastive learning, or feature pruning.The cited studies broaden detection settings but remain focused on detection capabilities.
- Research Gap: Automated construction of flow datasets, assisted classifier selection, and automatic SDN blocking remain little explored as one integrated operational tool.This integration defines the scope of the proposed system.
3 Proposed System
The proposed system reduces administrator complexity by automating network-dataset creation, machine-learning model development, attack detection, and mitigation in an SDN environment.
- System objective: The system automates attack diagnosis and countermeasure execution to reduce the complexity of activities commonly performed manually.Its design targets reduced repair time, analysis and execution errors, and operational cost.
- System architecture: The application uses two main modules: Network Dataset Creation (NDC) and Intrusion Prevention System (IPS).NDC prepares training data, while IPS handles classification and countermeasures.
- Network Dataset Creation: NDC automatically converts network captures into aggregated IP-flow datasets for machine-learning training.Its pipeline splits large pcap files, converts them to nfcapd and CSV formats, selects features, and aggregates flows.
- Network Dataset Creation: The selected IP-flow features are duration in seconds (td), number of packets (pkt), and number of bytes (byt).Source and destination IP addresses are omitted because they are public addresses.
- Intrusion Prevention System: IPS supports configuration, modeling, detection, and mitigation, including dataset selection, preprocessing, algorithm selection, and feature selection.The system can create or load models and automatically begin monitoring when a saved model is loaded.
- Modeling and evaluation: Six classifiers can be selected and compared, with hyperparameters optimized through Grid Search and Stratified n-fold cross-validation.Training uses k-1 splits for evaluation across k iterations, and the best result is selected before test-set prediction.
4 Case Study and Results
The case study evaluates the automated system in an SDN using a SYN flooding attack and shows real-time detection followed by automatic controller-based blocking. KNN was selected for detection, and the attack was detected and blocked after 21 seconds.
- Experimental setup: The validation case study examines the NDC and IPS modules in a software-defined network.The experimental environment and topology are presented as the basis for evaluating system operation.
- Experimental setup: The training data comprise a 95 GB university-campus network dataset containing normal traffic, DoS attacks, and Probe attacks.The DoS class includes SYN flood among other attack types, while the Probe class contains multiple scanning attacks.
- Detection and mitigation pipeline: IP flows are collected every n = 60 s, then preprocessed, feature-extracted, and aggregated by the NDC module.The collection interval is configurable in the system.
- Detection and mitigation pipeline: Detected attacks trigger a blocking rule pushed through the controller’s SFEP REST API into the OpenFlow switch flow tables.The experiments used the Floodlight controller, and event information is stored in the database after detection and resolution.
- Results: KNN achieved 96.7% F1-score, with 96.6% accuracy, 93.7% precision, and 100% recall in the network scenario.KNN was selected because it showed good effectiveness for the experimental network scenario.
- Results: 21 seconds elapsed from attack start to automatic detection and blocking in the SYN flooding experiment.The countermeasure was sent through Floodlight to switch S2 in the attacker network, and the blocking rule stopped the attack.
5 Conclusion
The conclusion presents real-time machine-learning and SDN automation as a response to growing network-management challenges and reports potential for detection and mitigation with minimal human intervention. Future work extends evaluation to additional algorithms, larger networks, and distributed or federated approaches.
- Conclusion: Automated systems are needed to reduce manual operation while adapting to evolving networks and changing attack strategies.The conclusion frames these needs within growing data-security and privacy challenges.
- Conclusion: The proposed system combines classifier selection and evaluation with direct rule delivery to the controller, removing the human operator from the critical detection-to-containment path.This links classification accuracy and response-path timing within one automated cycle.
- Conclusion: The experiments and case study showed the system’s potential to enable automatic attack detection and mitigation with minimal human intervention.The system operates in real time using machine learning and software-defined networking.
- Future work: Future work will analyze additional machine-learning algorithms and conduct experiments in large-scale networks.The authors also plan comparisons with distributed and federated detection approaches in production scenarios.