The expansion of network boundaries and the rise of hybrid work environments have significantly widened the modern attack surface. Traditional rule-based monitoring struggles to scale, leading to the adoption of automated Artificial Intelligence for IT Operations powered by Deep Learning. However, while these models handle higher data volumes, their black-box nature lacks accountability, which prevents network managers from confidently triaging alarms without risking legitimate traffic disruption. While eXplainable AI techniques like SHapley Additive exPlanations are increasingly employed for regulatory compliance, research often fails to go beyond explicability and to leverage XAI insights to mitigate bias or enhance performance. This paper proposes a transparent conceptual model for the cyclical explanation and optimization of black-box Intrusion Detection Systems, along with a novel, unsupervised, cluster-based undersampling strategy. By leveraging SHAP to create an explainable pipeline and final product, we optimized an existing GAN-based IDS across two benchmark datasets. For the CIC-DDoS2019 dataset, we achieved a 4.7

The evolution of computer networks for service provision, through new devices and architectures, renders past traffic patterns obsolete. The shift in the statistical properties of data is known as concept drift (CD) and is bound to affect automated pattern recognition-based systems. Network intrusion detection systems (NIDS) are widely studied security solutions that model and monitor network traffic behavior, alerting when malicious activities are detected. The lack of adaptability to evolving networks renders NIDS ineffective over time, leading to operational instability and increased vulnerability. In this survey, we aim to present an empirical literature review on state-of-the-art CD-resilient NIDS. The essential steps involved in developing such systems are comprehensively examined: benchmark datasets, NIDS development, drift detection and adaptation, and dynamic performance evaluation. An increasing trend in academic output has underscored the critical importance of this evolving field since 2022. We support its research by identifying open issues and highlighting future investigation directions.

Network anomaly detection is an active field of research due to the adverse influence that anomalous traffic has on end-user experience. Such systems have recently applied reconstruction-based deep neural networks to build models of network benign behavior and identify contrasting patterns as anomalies. Anomaly detection performance may degrade over time if the learned model becomes outdated due to concept drift (i.e., the evolution of network legitimate behavior). In this paper, we present a case study to investigate the impact of drift in legitimate network behavior on the false alarm rate of an anomaly detection system based on an autoencoder neural network. We create a representative benchmark setup by collecting real traffic data from benign users of a subnetwork of the Polytechnic University of Valencia, Spain, over a three-month period. The experimental results show that the number of false alarms decreases by approximately 10 times when the neural network model is updated after drift occurs, reducing the false alarm rate from 2.14% to 0.17%. Finally, we outline specific future research directions to further improve the robustness of anomaly detection systems.

Network management solutions remain essential for proper network service delivery. The software-defined networking (SDN) paradigm brought flexibility and programmability to today's large-scale networks, easing their governance. Another critical factor in the quality of network services is network security for protection against cyberattacks. This work proposes an unsupervised volume anomaly detection and mitigation system for securing SDN environments. We implement a fast AnoGAN (f-AnoGAN) to model legitimate user behavior and identify outlier samples. The generative network is trained on a low-dimensional representation of network traffic to reduce computational overhead. The f-AnoGAN model performance is further investigated through hyperparameter tuning and ablation study. The security system is evaluated on four public datasets: Orion, CIC-DDoS2019, CIC-IDS2017, and TON_IoT. We implement state-of-the-art alternative models for comparison analysis, namely Autoencoder, BiGAN, and FID-GAN. The f-AnoGAN presents improved class separation capacity and anomaly identification performance compared to the other models. The anomaly mitigation module can drop between 95% and 99% of malign traffic, supporting network resilience and correct functioning.

Computer networks facilitate regular human tasks, providing services like data streaming, online shopping, and digital communications. These applications require more and more network capacity and dynamicity to accomplish their goals. The networks may be targeted by attacks and intrusions that compromise the applications that rely on them and lead to potential losses. We propose a semi-supervised systematic methodology for developing a detection system for traffic volume anomalies in IP flow-based networks. The system is implemented with a vanilla Generative Adversarial Network (GAN). The mitigation module is triggered whenever an anomaly is detected, automatically blocking the suspect IPs and restoring the correct network functioning. We implemented three versions of the proposed solution by incorporating Long Short-Term Memory (LSTM), 1D-Convolutional Neural Network (1D-CNN), and Temporal Convolutional Network (TCN) into the GAN internal structure. The experiments are conducted on three public benchmark datasets: Orion, CIC-DDoS2019, and CIC-IDS2017. The results show that the three considered deep learning models have distinct impacts on the GAN model and, consequently, on the overall system performance. The 1D-CNN-based GAN implementation is the best since it reasonably solves the mode collapse problem, has the most efficient computational complexity, and achieves competitive Matthews Correlation Coefficient scores for the anomaly detection task. Also, the mitigation module can drop most anomalous flows, blocking only a slight portion of legitimate traffic. For comparison with state-of-the-art models, we implemented 1D-CNN, LSTM, and TCN separately from the GAN. The generative networks show improved overall results in the considered performance metrics compared to the other models.

Network management is a crucial task to maintain modern systems and applications running. Some applications have become vital for society and are expected to have zero downtime. Software-defined networks is a paradigm that collaborates with the scalability, modularity and manageability of systems by centralizing the network’s controller. However, this creates a weak point for distributed denial of service attacks if unprepared. This study proposes an anomaly detection system to detect distributed denial of service attacks in software-defined networks using generative adversarial neural networks with gated recurrent units. The proposed system uses unsupervised learning to detect unknown attacks in an interval of 1 second. A mitigation algorithm is also proposed to stop distributed denial-of-service attacks from harming the network’s operation. Two datasets were used to validate this model: the first developed by the computer networks study group Orion from the State University of Londrina. The second is a well-known dataset: CIC-DDoS2019, widely used by the anomaly detection community. Besides the gated recurrent units, other types of neurons are also tested in this work, they are: long short-term memory, convolutional and temporal convolutional. The detection module reached an F1-score of 99% in the first dataset and 98% in the second, while the mitigation module could drop 99% of malicious flows in both datasets.

Software-Defined Networks (SDN) represent an adaptable paradigm for dealing with network users’ dynamic demands. Confidentiality, integrity, and availability are fundamental pillars for the security of the networks, which are often targeted by cyberattacks. The scientific community has been recently exploring deep learning to implement Network Intrusion Detection Systems (NIDS) against network attacks. In this survey, we aim to present an empirical literature review on state-of-the-art NIDS based on deep learning for defending SDNs. The essential steps to develop such systems are carefully examined: benchmark datasets, data preprocessing, deep learning modeling, hyperparameter tuning, and performance evaluation. There has been a growing trend in published works since 2021, underpinning the importance of the research field, which is still active and under investigation. We support the development of the area by discussing the identified open issues and future research directions.

The software-defined network paradigm has reduced the cost of network management. Protecting the availability of such networks is critical to promoting the quality of their services. In this work, we introduce an unsupervised system for detecting and mitigating distributed denial of service attacks, a recurrent threat to network availability. The solution uses address and port entropy features along with the f-AnoGAN model. The proposed system achieves higher detection efficiency in the public benchmark dataset CIC-DDoS2019 compared to state-of-the-art alternatives, such as BiGAN and FID-GAN. The mitigation module drops most DDoS flows, forwarding the majority of legitimate packets.

With the rapid expansion of global networks and the proliferation of IoT devices, the complexity and scale of traffic have grown exponentially. This surge in connectivity demands larger, faster, and more serviceable architectures, like Software Defined Networks (SDNs). Motivated by various interests, malicious agents seek to compromise services within the network with different attacks. Intrusion Detection Systems (IDSs) are solutions often implemented in SDN using Deep Learning algorithms. These methods are more challenging to explain as they grow in complexity and become less trustworthy for handling sensitive issues like cyber security. This work uses SHapley Additive exPlanations (SHAP) to explain a consolidated IDS that combines Gated Recurrent Units (GRU) with Generative Adversarial Network’s discriminator. We conducted a feature selection based on the SHAP explanation and used its insights to better tune the time series’s window size hyperparameter. The optimized model performed similarly to the original, with a margin for improvement upon further hyperparameter tuning. It was also more stable in the training phase and faster to execute. This new version of the model was also explained by SHAP and presented a more consistent behavior.

Software-defined Networking (SDN) is a modern network management paradigm that decouples the data and control planes. The centralized control plane offers comprehensive control and orchestration over the network infrastructure. Although SDN provides better control over traffic flow, ensuring network security and service availability remains challenging. This paper presents an anomaly-based intrusion detection system (IDS) for monitoring and securing SDN networks. The system utilizes deep learning models to identify anomalous traffic behavior. When an anomaly is detected, a mitigation module blocks suspicious communications and restores the network to its normal state. Three versions of the proposed solution were implemented and compared: the traditional Generative Adversarial Network (GAN), Deep Convolutional GAN (DCGAN), and Wasserstein GAN with Gradient Penalty (WGAN-GP). These models were incorporated into the system’s detection structure and tested on two benchmark datasets. The first is emulated, and the second is the well-known CICDDoS2019 dataset. The results indicate that the IDS adequately identified potential threats, regardless of the deep learning algorithm. Although the traditional GAN is a simpler model, it could still efficiently detect when the network was under attack and was considerably faster than the other models. Additionally, the employed mitigation strategy successfully dropped over 89% of anomalous flows in the emulated dataset and over 99% in the public dataset, preventing the effects of the threats from being accentuated and jeopardizing the proper functioning of the SDN network.

Non-invasive acoustic analyses of voice disorders have been at the forefront of current biomedical research. Usual strategies, essentially based on machine learning (ML) algorithms, commonly classify a subject as being either healthy or pathologically-affected. Nevertheless, the latter state is not always a result of a sole laryngeal issue, i.e., multiple disorders might exist, demanding multi-label classification procedures for effective diagnoses. Consequently, the objective of this paper is to investigate the application of five multi-label classification methods based on problem transformation to play the role of base-learners, i.e., Label Powerset, Binary Relevance, Nested Stacking, Classifier Chains, and Dependent Binary Relevance with Random Forest (RF) and Support Vector Machine (SVM), in addition to a Deep Neural Network (DNN) from an algorithm adaptation method, to detect multiple voice disorders, i.e., Dysphonia, Laryngitis, Reinke’s Edema, Vox Senilis, and Central Laryngeal Motion Disorder. Receiving as input three handcrafted features, i.e., signal energy (SE), zero-crossing rates (ZCRs), and signal entropy (SH), which allow for interpretable descriptors in terms of speech analysis, production, and perception, we observed that the DNN-based approach powered with SE-based feature vectors presented the best values of F1-score among the tested methods, i.e., 0.943, as the averaged value from all the balancing scenarios, under Saarbrücken Voice Database (SVD) and considering 20% of balancing rate with Synthetic Minority Over-sampling Technique (SMOTE). Finally, our findings of most false negatives for laryngitis may explain the reason why its detection is a serious issue in speech technology. The results we report provide an original contribution, allowing for the consistent detection of multiple speech pathologies and advancing the state-of-the-art in the field of handcrafted acoustic-based non-invasive diagnosis of voice disorders.

Nowadays, it is common for applications to require servers to run constantly and aim as close as possible to zero downtime. The slightest failure might cause significant financial losses and sometimes even lives. For this reason, security and management measures against network threats are fundamental and have been researched for years. Software-defined networks (SDN) are an advancement in network management due to their centralization of the control plane, as it facilitates equipment setup and administration over the local network. However, this centralization makes the controller a target to denial of service attacks (DoS). In this study, we aim to develop a network anomaly detection and mitigation system that uses gated recurrent unit (GRU) neural networks combined with fuzzy logic. The neural network is trained to forecast future traffic, and anomalies are detected when the forecasting fails. The system is designed to operate in software-defined networks since they provide network flow information and tools to manage forwarding tables. We also demonstrate how the neural network’s hyperparameters affect the detection module. The system was tested using two datasets: one with emulated traffic generated by the data communication and networking research group called Orion, from computer science department at state university of Londrina, and CICDDoS2019, a well-known dataset by the anomaly detection community. The results show that GRU networks combined with fuzzy logic are a viable option to detect anomalies in SDN and possibly in other anomaly detection applications. The system was compared with other deep learning techniques.

Software Defined Networking (SDN) simplifies network management and significantly reduces operational costs. SDN removes the control plane from forwarding devices (e.g., routers and switches) and centralizes this plane in a controller, enabling the management of the network forwarding decisions by programming the control plane with a high-level language. However, its centralized architecture may be compromised by flooding attacks, such as Distributed Denial of Service (DDoS) and portscan. Facing this challenge, we propose an Intrusion Detection System (IDS) based on online clustering to detect attacks in an evolving SDN network taking advantage of the entropy of source and destination IP addresses and ports. Our proposal is focused on avoiding the demand for labeling and previous knowledge to provide a practical and accurate method to address real-life online scenarios. Moreover, our proposal paves the way for a comprehensive analysis by projecting the cluster's structure over the feature space, providing insights on intensity, seasonality, and attack type. Our experiments were carried out with the DenStream algorithm in several databases attacked by DDoS and portscan with different intensities, durations, and overlapping patterns. When comparing DenStream performance to Half-Space-Trees, an accurate online one-class classification algorithm for anomaly detection, it was possible to expose the capacity of our unsupervised proposal, overcoming the one-class solution, and reaching f-measure rates above 99.60%.

Over the last few years, Software Defined Networking (SDN) paradigm has become an emerging architecture to design future networks and to meet new application demands. SDN provides resources for improving network control and management by separating control and data plane, and the logical control is centralized in a controller. However, the centralized control logic can be an ideal target for malicious attacks, mainly Distributed Denial of Service (DDoS) attacks. Recently, Deep Learning has become a powerful technique applied in cybersecurity, and many Network Intrusion Detection (NIDS) have been proposed in recent researches. Some studies have indicated that deep neural networks are sensitive in detecting adversarial attacks. Adversarial attacks are instances with certain perturbations that cause deep neural networks to misclassify. In this paper, we proposed a detection and defense system based on Adversarial training in SDN , which uses Generative Adversarial Network (GAN) framework for detecting DDoS attacks and applies adversarial training to make the system less sensitive to adversarial attacks. The proposed system includes well-defined modules that enable continuous traffic monitoring using IP flow analysis, enabling the anomaly detection system to act in near-real-time. We conducted the experiments on two distinct scenarios, with emulated data and the public dataset CICDDoS 2019. Experimental results demonstrated that the system efficiently detected up-to-date common types of DDoS attacks compared to other approaches.

The management of modern network environments is becoming more and more complex due to new requirements of devices' heterogeneity regarding the popularization of the Internet of Things (IoT), as well as the dynamic traffic required by next-generation applications and services. To address this problem, Software-defined Networking (SDN) emerges as a management paradigm able to handle these problems through a centralized high-level network approach. However, this centralized characteristic also creates a critical failure spot since the central controller may be targeted by malicious users aiming to impair the network operation. This paper proposes an SDN defense system based on the analysis of single IP flow records, which uses the Gated Recurrent Units (GRU) deep learning method to detect DDoS and intrusion attacks. This direct flow inspection enables faster mitigation responses, minimizing the attack's impact over the SDN. The proposed model is tested against several different machine learning approaches over two public datasets, the CICDDoS 2019 and the CICIDS 2018. Furthermore, a lightweight mitigation approach is presented and evaluated through performance tests regarding each detection method. Finally, a feasibility test is performed regarding the throughput of flows per second that each detection method can analyze. This test is accomplished through the use of real IP Flow data collected at a large-scale network. The results point out promising detection rates and an elevated amount of analyzed flows per second, which makes GRU a feasible approach for the proposed system.

In this study, the authors consider the application of machine learning (ML) models in cooperative spectrum sensing of cognitive radio networks (CRNs). Based on a statistical analysis of the classic energy detection scheme, the probability of detection and false alarm is derived, which depends solely on the number of samples and signal-to-noise ratio of the secondary users. The channel occupancy detection obtained from the established analytical techniques such as maximum ratio combining and AND/OR rules is compared to different ML techniques, including multilayer perceptron (MLP), support vector machine, and Naive Bayes, based on receiver operating characteristic and area under the curve metrics. By using standard profiling tools, they obtain the computational performance of the analysed models during the training phase, a critical step for operating in CRNs. Ultimately, the results demonstrate that the MLP ML technique presents a better trade-off between training time and channel detection performance.

Software-defined Networking (SDN) has been discovered as an architecture that uses applications to make networks flexible and centrally controlled. Although SDN provides innovative management, it still susceptible to attacks daily. Traditional detection approaches may not be sufficient to contain these threats. In this paper, we present an Artificial Immune System based IDS named AIS-IDS, which is inspired by the human body's defense cells. AIS-IDS can detect variations in network behavior and identify attacks without prior knowledge about them. Along with AIS, the fuzzy logic is applied on detection to minimize the uncertainty when there is no clear boundary between anomalous and normal traffic behavior. We have simulated portscan and flooding attacks as well as used a public dataset with several types of DDoS attacks to assess our proposal. We compared the AIS-IDS performance with Naive Bayes, k-nearest neighbors, and the Local Outlier Factor. The AIS-IDS outperformed the compared algorithms, achieving f-measure rates 99.97% and 92.28% when submitted to a simulated and a public dataset, respectively.

Computer networks become complex and dynamic structures. As a result of this fact, the configuration and the managing of this whole structure is a challenging activity. Software-Defined Networks(SDN) is a new network paradigm that, through an abstraction of network plans, seeks to separate the control plane and data plane, and tends as an objective to overcome the limitations in terms of network infrastructure configuration. As in the traditional network environment, the SDN environment is also liable to security vulnerabilities. This work presents a system of detection and mitigation of Distributed Denial of Service (DDoS) attacks and Portscan attacks in SDN environments (LSTM-FUZZY). The LSTM-FUZZY system presented in this work has three distinct phases: characterization, anomaly detection, and mitigation. The system was tested in two scenarios. In the first scenario, we applied IP flows collected from the SDN Floodlight controllers through emulation on Mininet. On the other hand, in the second scenario, the CICDDoS 2019 dataset was applied. The results gained show that the efficiency of the system to assist in network management, detect and mitigate the occurrence of the attacks.

The Internet of Things (IoT) paradigm brings new and promising possibilities for services and products. The heterogeneity of IoT devices highlights the inefficiency of traditional networks' structures to support their specific requirements due to their lack of flexibility. Thus, Software-defined Networking (SDN) is commonly associated with IoT since this architecture provides a more flexible and manageable network environment. As shown by recent events, IoT devices may be used for large scale Distributed Denial of Service (DDoS) attacks due to their lack of security. This kind of attack is commonly detected and mitigated at the destination-end network but, due to the massive volume of information that IoT botnets generate, this approach is becoming impracticable. We propose in this paper a near real-time SDN security system that both prevents DDoS attacks on the source-end network and protects the sources SDN controller against traffic impairment. For this, we apply and test a Convolutional Neural Network (CNN) for DDoS detection, and describe how the system could mitigate the detected attacks. The performance outcomes were performed in two test scenarios, and the results pointed out that the proposed SDN security system is promising against next-generation DDoS attacks. (C) 2020 Published by Elsevier Ltd.

Vehicular networks are emerging as a promising technology that enables reliable and low-cost solutions for intelligent transport systems (ITSs), mainly due to their enormous potential to be considered for multiple purposes and scenarios. These networks are characterized by unique and challenging features such as packet fragmentation, low node density, short contact duration, and network disruption. These features may result in the absence of a path between the source and destination nodes, which is one of the most challenging issues faced by this type of network. To overcome some of these problems, it is necessary to provide vehicular networks with sophisticated tools or methodologies to implement monitoring and management operations. However, designing efficient solutions for this type of network is not an easy task due to its particular characteristics. This paper elaborates on a comprehensive survey focusing on promising proposals to deal with monitoring and management functionalities in vehicular networks. This work aims not only to present the state of the art on monitoring and management solutions but also to analyze their benefits and drawbacks, identify open issues, and provide guidelines for further contributions.