Griffin: Real-Time Network Intrusion Detection System via Ensemble of Autoencoder in SDN
Liyan Yang, Yubo Song, Shang Gao, Aiqun Hu, and Bin Xiao
IEEE Transactions on Network and Service Management, Sep 2022
Many efforts have been devoted to the development of efficient Network Intrusion Detection Systems (NIDS) using machine learning approaches in Software-defined Networking (SDN). Unfortunately, existing solutions failed to detect real-time and zero-day attacks due to their limited throughput and prior knowledge-based detection. To this end, we propose Griffin, a NIDS that uses unsupervised machine learning to detect both known and zero-day intrusion attacks in real time with high accuracy. Griffin uses an efficient feature extraction framework to capture the sequential features of traffic packets, cluster analysis to reduce the feature scale, and an ensemble of autoencoders to extract features with low complexity and high precision. Evaluations on open datasets show that Griffin’s complexity is about 40% lower, and its accuracy is at most 19% higher than existing NIDS. Even under evasion, the decrease in AUC is at most 9%. The paper also uses differential privacy while training the autoencoders to protect the privacy of the datasets.