Research Of Intrusion Detection Model Based On Deep Learning In SDN

With the rapid expansion of network scale and the massive growth of network traffic data,the problem of network security is becoming more and more serious.Relevant data show that in the past 10 years,the annual global economic losses caused by cyber attacks may be as high as$500 billion.Network security has become a hot topic in academic and business circles.As a new network architecture,software define network(SDN)will gradually replace the traditional network architecture with high maintenance cost because of its advantages of programmable management and strong scalability.It is considered as the development direction of the next generation Internet.As an active network security defense means,intrusion detection system can detect all security threats,and intercept attacks when network devices are detected to be attacked.But the current SDN intrusion detection technology in large-scale traffic attacks still has the defects of narrow detection range,high false alarm rate.In view of the research status of network security and deep learning at home and abroad,this paper proposes an intrusion detection research scheme based on deep learning in SDN environment.Firstly,this paper proposes an intrusion detection model SAVAE-DNN based on deep learning.SAVAE-DNN combines the advantages of Variational Auto-Encoder and Supervised Adversarial Auto-Encoder.The decoder after SAVAE model trained can be used to generate new attack samples with specified tags,which can increase the diversity of training samples and balance the training dataset.The encoder after SAVAE model trained is used to initialize the weight of the DNN hidden layer and automatically extract the advanced feature representation of the original sample,The DNN is used as a classifier.Secondly,comparative experiments are carried out.The experimental results show that compared with Naive Bayes,Random Forest,PCA-ANN and KPCA-SVM,SAVAE-DNN model has higher accuracy,higher F1 score and lower false alarm rate.The balanced training dataset is used to train the intrusion detection model,which greatly improves the recognition rate of unknown attacks and minority attacks.Finally,an SDN intrusion detection architecture is designed,which includes three modules: data collection module,intrusion detection module and data transmission module.The function of each module has been studied in detail.The simulation results on mininet platform show that the proposed SAVAE-DNN intrusion detection algorithm can effectively identify network intrusion in SDN environment.