Yang Liyan

Many efforts have been devoted to the development of efficient Network Intrusion Detection Systems (NIDS) using machine learning approaches in Software-defined Networking (SDN). Unfortunately, existing solutions failed to detect real-time and zero-day attacks due to their limited throughput and prior knowledge-based detection. To this end, we propose Griffin, a NIDS that uses unsupervised machine learning to detect both known and zero-day intrusion attacks in real time with high accuracy. Griffin uses an efficient feature extraction framework to capture the sequential features of traffic packets, cluster analysis to reduce the feature scale, and an ensemble of autoencoders to extract features with low complexity and high precision. Evaluations on open datasets show that Griffin’s complexity is about 40% lower, and its accuracy is at most 19% higher than existing NIDS. Even under evasion, the decrease in AUC is at most 9%. The paper also uses differential privacy while training the autoencoders to protect the privacy of the datasets.