Hybrid Deep Autoencoder with Random Forest in Native SDN Intrusion Detection Environment

This paper introduces a hybrid deep autoencoder with a random forest classifier model to enhance intrusion detection performance in a native SDN environment. A deep learning architecture combining a deep autoencoder with random forest learning feature representation of traffic flows natively collected from the SDN environment. Publicly available packet Capture (PCAP) files of recorded traffic flows were used in the SDN network for flow feature extraction and real-time implementation. The results show very high and consistent performance metrics, with an average of 0.9 receiver-operating characteristics area under curve (ROC AUC) recorded. Furthermore, we compared the performance achieved using the original dataset with previous research to investigate the performance achieved using the same model developed. The flow-based intrusion model presented outperforms other publicly available methods, with a traffic anomaly detection rate of 98% accuracy and precision.