{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,28]],"date-time":"2026-02-28T04:31:40Z","timestamp":1772253100419,"version":"3.50.1"},"reference-count":45,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2019,12,18]],"date-time":"2019-12-18T00:00:00Z","timestamp":1576627200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>Recent advancements in software-defined networking (SDN) make it possible to overcome the management challenges of traditional networks by logically centralizing the control plane and decoupling it from the forwarding plane. Through a symmetric and centralized controller, SDN can prevent security breaches, but it can also bring in new threats and vulnerabilities. The central controller can be a single point of failure. Hence, flow-based anomaly detection system in OpenFlow Controller can secure SDN to a great extent. In this research, we investigated two different approaches of flow-based intrusion detection system in OpenFlow Controller. The first of which is based on machine-learning algorithm where NSL-KDD dataset with feature selection ensures the accuracy of 82% with random forest classifier using the gain ratio feature selection evaluator. In the later phase, the second approach is combined with a deep neural network (DNN)-based intrusion detection system based on gated recurrent unit-long short-term memory (GRU-LSTM) where we used a suitable ANOVA F-Test and recursive feature elimination selection method to boost classifier output and achieve an accuracy of 88%. Substantial experiments with comparative analysis clearly show that, deep learning would be a better choice for intrusion detection in OpenFlow Controller.<\/jats:p>","DOI":"10.3390\/sym12010007","type":"journal-article","created":{"date-parts":[[2019,12,23]],"date-time":"2019-12-23T03:23:12Z","timestamp":1577071392000},"page":"7","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":41,"title":["Effects of Machine Learning Approach in Flow-Based Anomaly Detection on Software-Defined Networking"],"prefix":"10.3390","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7999-8576","authenticated-orcid":false,"given":"Samrat Kumar","family":"Dey","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, Dhaka International University (DIU), Dhaka 1205, Bangladesh"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6525-2274","authenticated-orcid":false,"given":"Md. Mahbubur","family":"Rahman","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Military Institute of Science and Technology (MIST), Dhaka 1216, Bangladesh"}]}],"member":"1968","published-online":{"date-parts":[[2019,12,18]]},"reference":[{"key":"ref_1","unstructured":"(2017, May 16). Software Defined Networking Definition. Available online: https:\/\/www.opennetworking.org\/sdn-definition."},{"key":"ref_2","unstructured":"(2018, February 25). ONF SDN Evolution. Available online: http:\/\/3vf60mmveq1g8vzn48q2o71a-wpengine.netdna-ssl.com\/wp-content\/uploads\/2013\/05\/TR-535_ONF_SDN_Evolution.pdf."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1145\/1355734.1355746","article-title":"Openflow: Enabling innovation in campus networks","volume":"38","author":"McKeown","year":"2008","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1145\/2534169.2486019","article-title":"B4: Experience with a globally-deployed software defined wan","volume":"43","author":"Jain","year":"2013","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_5","unstructured":"(2018, February 28). C.t. Huawei Press Centre and H. Unveil World\u2019s First Commercial Deployment of SDN in Carrier Networks. Available online: http::\/\/pr.huawei.com\/en\/news\/ hw-332209-sdn.htm."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"105","DOI":"10.1145\/1384609.1384625","article-title":"Nox: Towards an operating system for networks","volume":"38","author":"Gude","year":"2008","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_7","unstructured":"(2018, March 11). Ryu. Available online: http:\/\/osrg.github.io\/ryu."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Erickson, D. (2013, January 16). The beacon openflow controller. Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, (HotSDN \u201913), Hong Kong, China.","DOI":"10.1145\/2491185.2491189"},{"key":"ref_9","unstructured":"(2018, March 06). Opendaylight: A Linux Foundation Collaborative Project. Available online: http:\/\/www. opendaylight.org."},{"key":"ref_10","unstructured":"(2018, March 15). Floodlight. Available online: http:\/\/www.projectfloodlight.org."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Kreutz, D., Ramos, F.M., and Verissimo, P. (2013, January 16). Towards Secure and Dependable Software-Defined Networks. Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, (HotSDN \u201913), Hong Kong, China.","DOI":"10.1145\/2491185.2491199"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"493","DOI":"10.1007\/s12083-017-0630-0","article-title":"Survey on SDN based network intrusion detection system using machine learning approaches","volume":"12","author":"Sultana","year":"2019","journal-title":"Peer-to-Peer Netw. Appl."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Jadidi, Z., Muthukkumarasamy, V., Sithirasenan, E., and Sheikhan, M. (2013, January 8\u201311). Flow-Based Anomaly Detection Using Neural Network Optimized with Gsa Algorithm. Proceedings of the 2013 IEEE 33rd International Conference on Distributed Computing Systems Workshops, Philadelphia, PA, USA.","DOI":"10.1109\/ICDCSW.2013.40"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Winter, P., Hermann, E., and Zeilinger, M. (2011, January 7\u201310). Inductive Intrusion Detection in Flow-Based Network Data Using One-Class Support Vector Machines. Proceedings of the 2011 4th IFIP International Conference on New Technologies, Mobility and Security, Paris, France.","DOI":"10.1109\/NTMS.2011.5720582"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Mehdi, S.A., Khalid, J., and Khayam, S.A. (2011). Revisiting Traffic Anomaly Detection Using Software Defined Networking. Lecture Notes in Computer Science, Proceedings of the 14th International Conference on Recent Advances in Intrusion Detection, (RAID\u201911), Menlo Park, CA, USA, 20\u201321 September 2011, Springer.","DOI":"10.1007\/978-3-642-23644-0_9"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Braga, R., Mota, E., and Passito, A. (2010, January 10\u201314). Lightweight Ddos Flooding Attack Detection Using Nox\/Openflow. Proceedings of the IEEE Local Computer Network Conference, Denver, CO, USA.","DOI":"10.1109\/LCN.2010.5735752"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Kokila, R.T., Selvi, S.T., and Govindarajan, K. (2014, January 17\u201319). DDoS Detection and Analysis in SDN-Based Environment Using Support Vector Machine Classifier. Proceedings of the 2014 Sixth International Conference on Advanced Computing (ICoAC), Chennai, India.","DOI":"10.1109\/ICoAC.2014.7229711"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Phan, T.V., van Toan, T., van Tuyen, D., Huong, T.T., and Thanh, N.H. (2016, January 27\u201329). OpenFlowSIA: An Optimized Protection Scheme for Software-Defined Networks from Flooding Attacks. Proceedings of the 2016 IEEE Sixth International Conference on Communications and Electronics (ICCE), Ha Long, Vietnam.","DOI":"10.1109\/CCE.2016.7562606"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Mousavi, S.M., and St-Hilaire, M. (2015, January 16\u201319). Early Detection of Ddos Attacks Against Sdn Controllers. Proceedings of the 2015 International Conference on Computing, Networking and Communications (ICNC), Garden Grove, CA, USA.","DOI":"10.1109\/ICCNC.2015.7069319"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Niyaz, Q., Sun, W., and Javaid, A.Y. (2016). A deep learning based ddos detection system in software-defined networking (sdn). arXiv.","DOI":"10.4108\/eai.28-12-2017.153515"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2016, January 26\u201329). Deep Learning Approach for Network Intrusion Detection in Software Defined Networking. Proceedings of the 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), Fez, Morocco.","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2018, January 25\u201329). Deep Recurrent Neural Network for Intrusion Detection in SDN-based Networks. Proceedings of the 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, Canada.","DOI":"10.1109\/NETSOFT.2018.8460090"},{"key":"ref_23","unstructured":"Uddin, M., and Bansal, J. (2020). Leveraging Machine Learning Approach to Setup Software-Defined Network(SDN) Controller Rules During DDoS Attack. Algorithms for Intelligent Systems, Proceedings of the International Joint Conference on Computational Intelligence, Dhaka, Bangladesh, 4 July 2019, Springer."},{"key":"ref_24","unstructured":"Kumar, A., and Mozar, S. (2019). Two-Level Intrusion Detection System in SDN Using Machine Learning. ICCCE 2018, Proceedings of the Lecture Notes in Electrical Engineering, Hyderabad, India, 24 January 2018, Springer."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Elsayed, M.S., Le-Khac, N.A., Dev, S., and Jurcut, A.D. (2019). Machine-Learning Techniques for Detecting Attacks in SDN. arXiv.","DOI":"10.1109\/ICCSNT47585.2019.8962519"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Dey, S.K., and Rahman, M.M. (2018, January 13\u201315). Flow based anomaly detection in software de-fined networking: A deep learning approach with feature selection method. Proceedings of the 2018 4th International Conference on Electrical Engineering and Information Communication Technology (iCEEiCT), Dhaka, Bangladesh.","DOI":"10.1109\/CEEICT.2018.8628069"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Dey, S.K., Rahman, M.M., and Uddin, M.R. (2018, January 13\u201315). Detection of Flow Based Anomaly in Openflow Controller: Machine Learning Approach in Software Defined Networking. Proceedings of the 2018 4th International Conference on Electrical Engineering and Information Communication Technology (iCEEiCT), Dhaka, Bangladesh.","DOI":"10.1109\/CEEICT.2018.8628105"},{"key":"ref_28","unstructured":"Uddin, M.S., and Bansal, J.C. (2020). Performance Analysis of SDN-Based Intrusion Detection Model with Feature Selection Approach. Algorithms for Intelligent Systems, Proceedings of the International Joint Conference on Computational Intelligence, Dhaka, Bangladesh, 4 July 2019, Springer."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1109\/MS.2016.114","article-title":"Machine learning","volume":"33","author":"Louridas","year":"2016","journal-title":"IEEE Softw."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Khan, G.M., Khan, S., and Ullah, F. (2011, January 22\u201324). Short-Term Daily Peak Load Forecasting Using Fast Learning Neural Network. Proceedings of the 2011 11th International Conference on Intelligent Systems Design and Applications, Cordoba, Spain.","DOI":"10.1109\/ISDA.2011.6121762"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8\u201310). A Detailed Analysis of the Kdd Cup 99 Data Set. Proceedings of the Second IEEE International Conference on Computational Intelligence for Security and Defense Applications, (CISDA\u201909), Piscataway, NJ, USA. Available online: http:\/\/dl.acm.org\/citation.cfm?id=1736481.1736489.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Meng, Y. (2011, January 10\u201313). The practice on using machine learning for network anomaly intrusion detection. Proceedings of the 2011 International Conference on Machine Learning and Cybernetics, Guilin, China.","DOI":"10.1109\/ICMLC.2011.6016798"},{"key":"ref_33","unstructured":"Yang, Y., and Pedersen, J.O. (1997, January 8). A Comparative Study on Feature Selection in Text Categorization. Proceedings of the Fourteenth International Conference on Machine Learning, (ICML \u201997), Nashville, TN, USA. Available online: http:\/\/dl.acm.org\/citation.cfm?id=645526.657137."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Ingre, B., and Yadav, A. (2015, January 2\u20133). Performance Analysis of Nsl-Kdd Dataset Using Ann. Proceedings of the 2015 International Conference on Signal Processing and Communication Engineering Systems, Guntur, India.","DOI":"10.1109\/SPACES.2015.7058223"},{"key":"ref_35","unstructured":"Breiman, L. (2001). Machine Learning, Kluwer Academic Publishers."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Mandic, D.P., and Chambers, J. (2001). Recurrent Neural Networks for Prediction: Learning Algorithms, Architectures and Stability, John Wiley & Sons, Inc.","DOI":"10.1002\/047084535X"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Livieris, I.E. (2019). Forecasting Economy-Related Data Utilizing Weight-Constrained Recurrent Neural Networks. Algorithms, 12.","DOI":"10.3390\/a12040085"},{"key":"ref_38","unstructured":"Kolen, J.F., and Kremer, S.C. (2001). Gradient Flow in Recurrent Nets: The Difficulty of Learning LongTerm Dependencies, IEEE. Available online: https:\/\/ieeexplore.ieee.org\/document\/5264952."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long short-term memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Cho, K., van Merrienboer, B., Gulcehre, C., Bahdanau, D., Bougares, F., Schwenk, H., and Bengio, Y. (2014, January 25\u201329). Learning Phrase Representations Using Rnn Encoder Decoder for Statistical Machine Translation. Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), Doha, Qatar. Available online: https:\/\/www.aclweb.org\/anthology\/D14-1179.","DOI":"10.3115\/v1\/D14-1179"},{"key":"ref_41","unstructured":"Chung, J., Gu\u00a8lc\u00b8ehre, C., Cho, K., and Bengio, Y. (2014). Empirical evaluation of gated recurrent neural networks on sequence modeling, CoRR abs\/1412.3555. arXiv."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"ref_43","first-page":"148","article-title":"A subset feature elimination mechanism for intrusion detection system","volume":"7","author":"Nkiama","year":"2016","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"ref_44","unstructured":"(2018, March 22). Weka. Available online: https:\/\/www.cs.waikato.ac.nz\/ml\/weka."},{"key":"ref_45","unstructured":"(2018, March 30). Tensorflow. Available online: https:\/\/github.com\/tensorflow."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/12\/1\/7\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T13:43:33Z","timestamp":1760190213000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/12\/1\/7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,12,18]]},"references-count":45,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2020,1]]}},"alternative-id":["sym12010007"],"URL":"https:\/\/doi.org\/10.3390\/sym12010007","relation":{"has-preprint":[{"id-type":"doi","id":"10.20944\/preprints201911.0113.v1","asserted-by":"object"}]},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,12,18]]}}}