{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T17:14:55Z","timestamp":1778346895043,"version":"3.51.4"},"reference-count":46,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2023,1,9]],"date-time":"2023-01-09T00:00:00Z","timestamp":1673222400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Owing to the prevalence of the Internet of things (IoT) devices connected to the Internet, the number of IoT-based attacks has been growing yearly. The existing solutions may not effectively mitigate IoT attacks. In particular, the advanced network-based attack detection solutions using traditional Intrusion detection systems are challenging when the network environment supports traditional as well as IoT protocols and uses a centralized network architecture such as a software defined network (SDN). In this paper, we propose a long short-term memory (LSTM) based approach to detect network attacks using SDN supported intrusion detection system in IoT networks. We present an extensive performance evaluation of the machine learning (ML) and deep learning (DL) model in two SDNIoT-focused datasets. We also propose an LSTM-based architecture for the effective multiclass classification of network attacks in IoT networks. Our evaluation of the proposed model shows that our model effectively identifies the attacks and classifies the attack types with an accuracy of 0.971. In addition, various visualization methods are shown to understand the dataset\u2019s characteristics and visualize the embedding features.<\/jats:p>","DOI":"10.3390\/info14010041","type":"journal-article","created":{"date-parts":[[2023,1,9]],"date-time":"2023-01-09T05:57:14Z","timestamp":1673243834000},"page":"41","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":145,"title":["Deep Learning Approach for SDN-Enabled Intrusion Detection System in IoT Networks"],"prefix":"10.3390","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5341-6729","authenticated-orcid":false,"given":"Rajasekhar","family":"Chaganti","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of Texas at San Antonio, San Antonio, TX 78249, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3344-413X","authenticated-orcid":false,"given":"Wael","family":"Suliman","sequence":"additional","affiliation":[{"name":"Center for Artificial Intelligence, Prince Mohammad Bin Fahd University, Khobar 34754, Saudi Arabia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6873-6469","authenticated-orcid":false,"given":"Vinayakumar","family":"Ravi","sequence":"additional","affiliation":[{"name":"Center for Artificial Intelligence, Prince Mohammad Bin Fahd University, Khobar 34754, Saudi Arabia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8391-5841","authenticated-orcid":false,"given":"Amit","family":"Dua","sequence":"additional","affiliation":[{"name":"Department of Algorithmics and Software, Silesian University of Technology, 44-100 Gliwice, Poland"}]}],"member":"1968","published-online":{"date-parts":[[2023,1,9]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"97","DOI":"10.1016\/j.comcom.2020.05.020","article-title":"Green communication in IoT networks using a hybrid optimization algorithm","volume":"159","author":"Maddikunta","year":"2020","journal-title":"Comput. Commun."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"431","DOI":"10.1016\/j.bushor.2015.03.008","article-title":"The Internet of Things (IoT): Applications, investments, and challenges for enterprises","volume":"58","author":"Lee","year":"2015","journal-title":"Bus. Horizons"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1016\/j.comnet.2015.02.014","article-title":"Software-defined networking: A survey","volume":"81","author":"Farhady","year":"2015","journal-title":"Comput. Netw."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Boppana, R.V., Chaganti, R., and Vedula, V. (2019). Analyzing the vulnerabilities introduced by ddos mitigation techniques for software-defined networks. National Cyber Summit, Springer.","DOI":"10.1007\/978-3-030-31239-8_14"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Kaur, N., Singh, A.K., Kumar, N., and Srivastava, S. (2017, January 13\u201315). Performance impact of topology poisoning attack in SDN and its countermeasure. Proceedings of the 10th International Conference on Security of Information and Networks, Jaipur, India.","DOI":"10.1145\/3136825.3136881"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"11065","DOI":"10.1109\/ACCESS.2022.3142508","article-title":"A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions","volume":"10","author":"Javed","year":"2022","journal-title":"IEEE Access"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"7156420","DOI":"10.1155\/2021\/7156420","article-title":"Genetic CFL: Hyperparameter optimization in clustered federated learning","volume":"2021","author":"Agrawal","year":"2021","journal-title":"Comput. Intell. Neurosci."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"346","DOI":"10.1016\/j.comcom.2022.09.012","article-title":"Federated learning for intrusion detection system: Concepts, challenges and future directions","volume":"195","author":"Agrawal","year":"2022","journal-title":"Comput. Commun."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"139","DOI":"10.1016\/j.comcom.2020.05.048","article-title":"An effective feature engineering for DNN using hybrid PCA-GWO for intrusion detection in IoMT architecture","volume":"160","author":"RM","year":"2020","journal-title":"Comput. Commun."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Rathore, H., Agarwal, S., Sahay, S.K., and Sewak, M. (2018, January 18\u201321). Malware detection using machine learning and deep learning. Proceedings of the International Conference on Big Data Analytics, Warangal, India.","DOI":"10.1007\/978-3-030-04780-1_28"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"2227","DOI":"10.1016\/j.comcom.2011.07.001","article-title":"Practical real-time intrusion detection using machine learning approaches","volume":"34","author":"Sangkatsanee","year":"2011","journal-title":"Comput. Commun."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"108156","DOI":"10.1016\/j.compeleceng.2022.108156","article-title":"Recurrent deep learning-based feature fusion ensemble meta-classifier approach for intelligent network intrusion detection system","volume":"102","author":"Ravi","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"24","DOI":"10.1109\/IOTM.003.2200001","article-title":"Deep Learning Feature Fusion Approach for an Intrusion Detection System in SDN-Based IoT Networks","volume":"5","author":"Ravi","year":"2022","journal-title":"IEEE Internet Things Mag."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Khan, R.U., Zhang, X., Kumar, R., Sharif, A., Golilarz, N.A., and Alazab, M. (2019). An adaptive multi-layer botnet detection technique using machine learning classifiers. Appl. Sci., 9.","DOI":"10.3390\/app9112375"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"46717","DOI":"10.1109\/ACCESS.2019.2906934","article-title":"Robust intelligent malware detection using deep learning","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"key":"ref_16","first-page":"103306","article-title":"Image-based malware representation approach with EfficientNet convolutional neural networks for effective malware classification","volume":"69","author":"Chaganti","year":"2022","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"102779","DOI":"10.1016\/j.cose.2022.102779","article-title":"Deep Learning based Cross Architecture Internet of Things malware Detection and Classification","volume":"120","author":"Chaganti","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"249","DOI":"10.1109\/TEM.2021.3059664","article-title":"Adversarial defense: DGA-based botnets and DNS homographs detection through integrated deep learning","volume":"70","author":"Ravi","year":"2021","journal-title":"IEEE Trans. Eng. Manag."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Sriram, S., Vinayakumar, R., Alazab, M., and Soman, K. (2020, January 6\u20139). Network flow based IoT botnet attack detection using deep learning. Proceedings of the IEEE INFOCOM 2020-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Toronto, ON, Canada.","DOI":"10.1109\/INFOCOMWKSHPS50562.2020.9162668"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"11041","DOI":"10.1109\/JIOT.2020.2993410","article-title":"Semisupervised-learning-based security to detect and mitigate intrusions in IoT network","volume":"7","author":"Ravi","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"95397","DOI":"10.1109\/ACCESS.2019.2928564","article-title":"A survey of networking applications applying the software defined networking concept based on machine learning","volume":"7","author":"Zhao","year":"2019","journal-title":"IEEE Access"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"493","DOI":"10.1007\/s12083-017-0630-0","article-title":"Survey on SDN based network intrusion detection system using machine learning approaches","volume":"12","author":"Sultana","year":"2019","journal-title":"Peer-to-Peer Netw. Appl."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Mohammed, A.R., Mohammed, S.A., and Shirmohammadi, S. (2019, January 8\u201310). machine learning and deep learning based traffic classification and prediction in software defined networking. Proceedings of the 2019 IEEE International Symposium on Measurements & Networking (M&N), Catania, Italy.","DOI":"10.1109\/IWMN.2019.8805044"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Dey, S.K., Uddin, R., and Rahman, M. (2020, January 2\u20134). Performance analysis of SDN-based intrusion detection model with feature selection approach. Proceedings of the International Joint Conference on Computational Intelligence, Budapest, Hungary.","DOI":"10.1007\/978-981-13-7564-4_41"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"107678","DOI":"10.1109\/ACCESS.2019.2932438","article-title":"Search: A collaborative and intelligent nids architecture for sdn-based cloud iot networks","volume":"7","author":"Nguyen","year":"2019","journal-title":"IEEE Access"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Alzahrani, A.O., and Alenazi, M.J. (2021). Designing a network intrusion detection system based on machine learning for software defined networks. Future Internet, 13.","DOI":"10.3390\/fi13050111"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"71","DOI":"10.1016\/j.jnca.2019.03.005","article-title":"Implementing an intrusion detection and prevention system using software-defined networking: Defending against port-scanning and denial-of-service attacks","volume":"136","author":"Birkinshaw","year":"2019","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"5875","DOI":"10.1007\/s12652-020-02099-4","article-title":"MitM detection and defense mechanism CBNA-RF based on machine learning for large-scale SDN context","volume":"11","author":"Sebbar","year":"2020","journal-title":"J. Ambient. Intell. Humaniz. Comput."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2016, January 26\u201329). Deep learning approach for network intrusion detection in software defined networking. Proceedings of the 2016 IEEE International Conference on Wireless Networks and Mobile Communications (WINCOM), Fez, Morocco.","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"50","DOI":"10.4018\/IJISP.2020070104","article-title":"Neural network-based approach for detection and mitigation of DDoS attacks in SDN environments","volume":"14","author":"Hannache","year":"2020","journal-title":"Int. J. Inf. Secur. Priv. (IJISP)"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Hande, Y., and Muddana, A. (2019, January 27\u201329). Intrusion detection system using deep learning for software defined networks (SDN). Proceedings of the 2019 IEEE International Conference on Smart Systems and Inventive Technology (ICSSIT), Tirunelveli, India.","DOI":"10.1109\/ICSSIT46314.2019.8987751"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., Ghogho, M., and El Moussa, F. (2020). DeepIDS: Deep learning approach for intrusion detection in software defined networking. Electronics, 9.","DOI":"10.3390\/electronics9091533"},{"key":"ref_33","unstructured":"Vailshery, L.S. (2022, September 13). Global IoT and Non-IoT Connections 2010\u20132025|Statista. Available online: https:\/\/www.statista.com\/statistics\/1101442\/iot-number-of-connected-devices-worldwide\/."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"281","DOI":"10.1049\/cit2.12003","article-title":"SDN-based intrusion detection system for IoT using deep learning classifier (IDSIoT-SDL)","volume":"6","author":"Wani","year":"2021","journal-title":"CAAI Trans. Intell. Technol."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"2093","DOI":"10.1109\/JIOT.2018.2883344","article-title":"Ai-based two-stage intrusion detection for software defined iot networks","volume":"6","author":"Li","year":"2018","journal-title":"IEEE Internet Things J."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"10935","DOI":"10.1007\/s00500-021-05809-y","article-title":"A two-stage intrusion detection approach for software-defined IoT networks","volume":"25","author":"Tian","year":"2021","journal-title":"Soft Comput."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"4436","DOI":"10.1109\/TIA.2020.2971952","article-title":"A visualized botnet detection system based deep learning for the internet of things networks of smart cities","volume":"56","author":"Vinayakumar","year":"2020","journal-title":"IEEE Trans. Ind. Appl."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"103160","DOI":"10.1016\/j.jnca.2021.103160","article-title":"A novel hybrid model for intrusion detection systems in SDNs based on CNN and a new regularization technique","volume":"191","author":"ElSayed","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"9804061","DOI":"10.1155\/2018\/9804061","article-title":"A DDoS attack detection method based on SVM in software defined network","volume":"2018","author":"Ye","year":"2018","journal-title":"Secur. Commun. Netw."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"108015","DOI":"10.1016\/j.comnet.2021.108015","article-title":"An SDN-based Intrusion Detection System using SVM with Selective Logging for IP Traceback","volume":"191","author":"Hadem","year":"2021","journal-title":"Comput. Netw."},{"key":"ref_41","unstructured":"Sarica, A.K., and Angin, P. (2020, January 2\u20136). A Novel SDN Dataset for Intrusion Detection in IoT Networks. Proceedings of the 2020 16th IEEE International Conference on Network and Service Management (CNSM), Izmir, Turkey."},{"key":"ref_42","unstructured":"Jafarian, T. (2022, September 13). SDN-NF-TJ|IEEE DataPort. Available online: https:\/\/ieee-dataport.org\/documents\/sdn-nf-tj."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"34","DOI":"10.1186\/s40537-018-0145-4","article-title":"Intrusion detection model using machine learning algorithm on Big Data environment","volume":"5","author":"Othman","year":"2018","journal-title":"J. Big Data"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Aiken, J., and Scott-Hayward, S. (2019, January 12\u201314). Investigating adversarial attacks against network intrusion detection systems in sdns. Proceedings of the 2019 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), Dallas, TX, USA.","DOI":"10.1109\/NFV-SDN47374.2019.9040101"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Abusnaina, A., Khormali, A., Nyang, D., Yuksel, M., and Mohaisen, A. (2019, January 18\u201320). Examining the robustness of learning-based ddos detection in software defined networks. Proceedings of the 2019 IEEE Conference on Dependable and Secure Computing (DSC), Hangzhou, China.","DOI":"10.1109\/DSC47296.2019.8937669"},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"10327","DOI":"10.1109\/JIOT.2020.3048038","article-title":"Adversarial attacks against network intrusion detection in iot systems","volume":"8","author":"Qiu","year":"2020","journal-title":"IEEE Internet Things J."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/14\/1\/41\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T18:04:14Z","timestamp":1760119454000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/14\/1\/41"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,9]]},"references-count":46,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,1]]}},"alternative-id":["info14010041"],"URL":"https:\/\/doi.org\/10.3390\/info14010041","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,1,9]]}}}