Detecting Intrusion Using Multiple Datasets in Software-Defined Networks

Software-defined network (SDN) is an emerging technology that is being used widely to reduce the complexity of programming network functions. However, by splitting the control and data layers, the SDN architecture also attracts different types of attacks such as Distributed Denial of Service (DDoS). In recent years, several research studies addressed the security problem by introducing open datasets and classification techniques to detect attacks on SDN. The state-of-the-art techniques perform very well in a single dataset, i.e. when the training and testing datasets are from the same source. However, their performance reduces significantly in the presence of concept drift, i.e. if the testing dataset is collected from a different source than the training dataset. In this paper, we address this cross-dataset predictive issue by several concept drift detection techniques. The experimental results show that our techniques can improve performance in the cross-dataset scenario.