Collaborative Anomaly Detection in Distributed SDN

Abstract

To mitigate the issues of scalability and reliability in centralized SDN, distributed SDN has emerged. However, cyber attacks in distributed SDN become increasingly serious. Since each distributed SDN controller can only obtain the network flows of its sub-network, a single controller with the biased flow information cannot detect all types of attacks in the entire network and the overall detection is a challenge. To solve the biased flow problem, we propose a collaborative anomaly detection scheme in distributed SDN, which enables multiple SDN controllers jointly train a global detection model to identify cyber attacks. We evaluate its performance based on a real-world dataset and the results show that our scheme is efficient and accurate in cyber attack detection.