A Lightweight Deep Learning-Based Split Learning Scheme for Intrusion Detection in Multi-Controller Software-Defined Networking Internet of Things Environments

Software-Defined Networking (SDN) is an attractive network technology paradigm. It has overcome various obstacles and constraints of the conventional networking infrastructures. SDN is a management framework that offers various advantages and represents a significant development in network management [1]. The development of Internet-connected devices is only increasing network traffic. The changing demands and requirements of the modern computer networks have been fulfilled through SDN. SDN has helped improve the security and operational efficiency of computer networks. It facilitated the management of networks. It provides a software-centric, centralized network management strategy that renders computer networks dynamic, easily configurable, programmable, efficient, and dependable. SDN enables efficient network and traffic monitoring. Despite its numerous advantages, SDN also presents several weaknesses. The weaknesses are in the centralized methodology. SDN comprises a tiered architecture divided across three planes. The initial layer of SDN is the application plane. The second layer is the control plane, also referred to as the control layer. The third plane of SDN is the data plane, commonly referred to as the infrastructure layer [2]. Every layer of SDN is susceptible to hackers. SDN is a significant technology that separates the forwarding process of network packets from the routing process. The SDN control plane is often referred to as the brain, so attackers frequently attempt to compromise it. If adversaries successfully compromise the control plane, they can manipulate the entire network.

Machine learning (ML) has demonstrated efficacy in combating cyberattacks over the past couple of decades. Currently, ML is a significant solution in cybersecurity. In this period, the quantity of devices has proliferated and continues to grow significantly. With the expansion of the digital realm, the incidence of cyberattacks also increases. We require an automobile solution to combat cyberattacks. ML offers this type of solution [3]. ML algorithms can identify an illegal device attempting to connect to the network. They can detect the presence of a compromised device and identify a new form of malware based on existing signatures [4]. The centralized server cannot audit device data due to privacy constraints, as such an audit would require transferring sensitive data across the network. The inherent data distribution in ionic applications can significantly degrade distributed training performance, leading to reduced model accuracy and training instability. The second important reason for the heterogeneous learning environment in the context of IoT systems is the variability in the computing and connectivity resources of IoT devices. This heterogeneity manifests in various dimensions, including differences in processor capabilities, memory capacity, network connectivity, and bandwidth. The vast range of computational capabilities presents considerable hurdles for training a universal model. Devices with constrained processing capabilities or memory, commonly referred to as stragglers, might significantly impede the overall training process. Moreover, devices with inadequate network connectivity or limited bandwidth struggle to efficiently transfer data or model updates [5].

In this work, an IDS-based SL framework has been proposed as a lightweight deep neural network (DNN)-based multi-controller SDN environment. The proposed system is designed and tested for three clients, each containing two layers of the DNN model, while the other six layers are implemented on the SDN controller server. The main contribution of this work is its ability to detect different types of IoT attacks, such as distributed denial-of-service (DDoS), Prob, web attacks, and others, with high accuracy while maintaining minimal client-side layers. The problem is specified as a multi-class intrusion detection challenge on the InSDN data set, which is focused on nine categories of cyber-attacks. The main limitations that we discuss are the lack of edge computing resources and the necessity to avoid uploading any raw data by IoT devices, hence maintaining privacy. We have clearly defined our baseline models, i.e., a centralized DNN, a small on-box model, and an SL architecture, to allow a clear comparative analysis.

The rest of this paper is organized as follows: Section two demonstrates the state-of-the-art related work. Section three shows the methodology and theoretical background for the proposed method in this work. Section four illustrates the proposed IDS-based SDN system, while section five presents the main results and their analysis. Finally, section six introduces the main conclusion and future work.

Before discussing the suggested model, one must understand the main strategy and approach to be implemented in this work. These choices were made based on a review of past studies that investigated the process of building an efficient IDS system and evaluated the methodologies used. The next section outlines the technologies and procedures involved in deploying a NIDS on an SDN network.

3.1 Software-Defined Network

To build connections among network nodes and enable data exchange across the network, traditional networking architectures use switches and routers. The technology is a conventional networking system that is prone to confidentiality breaches and external attacks. SDN is another networking model that isolates the data delivery process from specific devices to improve the efficiency of a centralized system [13]. The organizational structure of this paradigm is split into multiple planes, the purpose of which were: (i) data plane, which handles the forwarding of packets; (ii) control plane, which defines routing using a flow table which outlines rules that are followed when packets are to be effectively handled; and the application plane, which is a set of services offered to the users.

Although that, the decentralization of SDN can spawn new vulnerabilities. The controller may be weakened by minimizing the communication bandwidth between its layers of infrastructure, including the OpenFlow switch and the SDN controller. However, SDN has the potential to improve network security by enabling the installation of security applications, such as IDS, which can detect potential threats. Furthermore, it is important to understand that the flow rules can be dynamically changed in response to changing demands by virtue of the programmability and control that SDN provides, which are absent in traditional networking systems [14]. This is an issue that should be included in any in-depth analysis. The traditional SDN architecture is shown in Figure 1.

1.png

Figure 1. Software-Defined Network (SDN) network architecture [15]

3.2 Intrusion detection systems

IDSs are crucial for safeguarding systems by monitoring and analyzing network traffic to identify security breaches and threats using signature-based or anomaly-based approaches. The original method relies on existing network patterns and thus fails to identify fresh threats. In contrast, the latter technique analyzes certain characteristics of network traffic, facilitating the detection of anomalies from standard network behavior that may indicate possible attacks; a concise comparison is shown in Table 2 [16]. Nonetheless, certain drawbacks were noted, such as the inability to detect encrypted packets and a possibly elevated rate of false positives, requiring human intervention to adjust the anomaly indicators, which eventually resulted in an inefficient security solution [17].

Table 2. Detection technique comparison [16]

3.3 Split Learning

The neural network is divided into components, with one portion retained by a client and the other by a server. The client executes the early layers using its local data and transmits only the intermediate activations, referred to as smashed data, to the server. The server continues the computation and loss evaluation, then performs backpropagation. The resultant gradient data is transmitted to the client to refresh its local layers. Formally, a model ƒ can be split into two functions [18].

$\mathrm{f}(x)=f_s\left(f_c(x)\right)$        (1)

where,

• $\mathrm{f}_c(\cdot)$ represents the layers executed on the client side.
• $\mathrm{f}_s(\cdot)$ represents the layers executed on the server side.
• $x$ is the input data.

During the forward pass:

$a=f_c(x)$              (2)

Here, a (the smash data) is transmitted to the server, which computes the prediction:

$\hat{y}=f_s(a)$              (3)

This gradient $\nabla_{a \mathcal{L}}$ is sent back to the client, which updates its local parameters via:

$w_{c \leftarrow} w_{c-} \eta \nabla_{w_c} \mathcal{L}(y, \hat{y})$                  (4)

While the server updates its parameters as:

$w_{s \leftarrow} w_{s-} \eta \nabla_{w_s} \mathcal{L}(y, \hat{y})$              (5)

$w_c$ and $w_s$ indicate the client and the server weights, respectively, and e signifies the learning rate. On the one hand, SL helps reduce the computational costs of resourceconstrained devices; on the other hand, it also presents risks such as activation leakage and privacy breaches caused by unwanted data disclosure, and communication overhead due to the transfer of activations and gradients.

The model was advanced using TenFlow on Linux operating through Mininet network emulator. To reduce the imbalance in the classes, we used Shannon entropy-based stratified sampling, thus having a statistically balanced training sample in all three client subsets. We have also recorded the total training time and hardware requirements, namely, a GPU with 12GB of memory, of the IoT hosts and the SDN controller. Figure 4 shows the proposed supervised learning architecture for an IDS in an SDN-enabled IoT context. This configuration distributes the computational load of the 8-layer DNN across limited-resource IoT devices and a centralized SDN controller. The technology works through a cooperative four-step procedure that protects data privacy while limiting the processing load on IoT devices. The hosts, including IoT devices such as sensors, as well as cellphones and PCs, manage their own databases, called local databases. They only handle the first two layers of the DNN rather than the full eight-layer model. Each host performs the preliminary forward pass on its own processor for local unprocessed data. This results in "smashed data," an intermediate representation (in the form of a feature map) that obscures the original input data, thereby increasing privacy. The hosts pass the corrupted data to the SDN Controller via the northbound interface. This is much lighter than sending the raw datasets or the entire model parameters and, thus, best suited for low-power IoT devices. The SDN controller is the main processing center that fits in the other six layers of the DNN. This part dealt with the results of training and testing model performance. To assess the effectiveness of a classification model, the confusion matrix and classification report compare actual target values with expected results.

The accuracy and loss curves in Figures 5(a) and (b) indicate an excellent training process. The model has an exceptional accuracy of more than 99.5% percent. The similarity between the training and validation accuracy curves indicates that the allocation of 2 client layers and 6 server layers is an effective way to express the essential characteristics without overfitting. Notwithstanding the intricacies of SL (where gradients have to be transmitted from the server to the client), the training loss reduces continually and converges to a minimum value (below 0.02). There is a huge rise in validation loss at epoch 17. In an SDN-based SL situation, this is often blamed on a transient mismatch in feature-extraction synchronization or on an atypical, unrepresentative dataset. Nonetheless, the model shows rapid recovery, demonstrating its robustness.

(a)

(b)

Figure 5. (a) Split Learning (SL) DNN model accuracy; (b) Split Learning (SL) DNN model loss

Figure 6 shows the IDS's effectiveness in distinguishing between different forms of network traffic, as shown in the confusion matrix. Most predictions fall on the diagonal, indicating accurate classifications across all attack categories. The model displays excellent performance in the face of common high-traffic attacks in SDN systems, such as Probe (29,319 correct) and DDoS (more than 36,000 correct across two categories). The Web-Attack class has worse performance (27 valid classifications vs. 31 misclassifications as DoS). This indicates an unbalanced dataset, with insufficient Web-Attack samples during the training phase.

Figure 6. Multiclass confusion matrix

This specific setup is exceptionally appropriate to an SDN context. By keeping only two layers on the client, presumably the SDN switches or the lightweight agents, the computational load on the data plane has been reduced. SL ensures that network traffic data from the edge (client side) is not lost or deleted, and that only "smashed data" (output from the 2nd layer) is sent to the SDN controller (server). The high accuracy indicates that these two layers are sufficient for feature abstraction without losing crucial security information. The 6 levels of the server (SDN controller) perform the crucial work of identifying complex patterns such as Botnets and Probes while keeping network visibility at the center.

The classification report demonstrates that the model has impressive performance in most of the classes, that is, DDoS, DoS, Normal, and Probe, with almost perfect precision, recall, and F1-scores, which is due to the high level of training aid that the classes have. On the other hand, the report presents excessive challenges with the minority classes, the Web-Attack class recalls a score of 0.44, which means that over half of the real attacks were not captured, and the U2R class fails completely, with a score of 0.00, which can be explained by a small number of supports the class has (only four instances), which is not enough to make the model internalize the discriminative patterns. This disparity is seen in the aggregate measures, as accuracy and weighted average nominally are perfect, but they are skewed by the high-performing majority classes, and the macro-averaged score of 0.83 provides a more honest assessment of how this model performs heterogeneously across all groups. In addition, the two distinct entries of DDoS, adding to a support of 36,692, concurs the anomaly of duplication of labels as shown in the distribution chart; they should be combined to ensure a single and consistent evaluation of the relevant attack vector.

Table 6. Models size and trainable parameters

The results present cutting-edge performance for an IDS. The model is extraordinarily accurate and stable, and it also achieves the SL paradigm, balancing privacy with detection effectiveness. The split between a 2-layer client and a 6-layer server is carefully optimized to defend against and mitigate volumetric attacks (DDoS/DoS), a major threat to SDN controllers. Nevertheless, the principal U2R and Web-Attack findings imply that the "smashed data" sent from the client may lack the granular packet information required to detect low-volume and application-layer attacks. Table 6 shows the models size and number of parameters where the model has been split into three partions (heads) with two layers and single model in the server (tail) with six layers.