基于BERT大语言模型的软件定义网络未知攻击检测
Unseen Attack Detection in Software-Defined Networking Using a BERT-Based Large Language Model
AI总结：
针对软件定义网络的安全挑战与现有攻击检测的缺口，提出结合随机森林特征选择、多流判定与BERT base模型的检测方法，可检测未知攻击，在已知与未知攻击场景下均达99.96%准确率。
摘要：
软件定义网络（SDN）通过将控制平面与数据平面解耦，实现了网络资源的集中化、灵活化管理，代表着网络架构领域的一次变革性转变。然而，这种架构转变也带来了严峻的安全挑战，因为SDN的集中式控制层成为各类攻击的高价值目标。尽管现有研究已在SDN攻击检测方面取得了不少有价值的成果，但仍存在关键缺口：解决特征选择难题、将检测范围从DDoS攻击拓展至更多攻击类型、基于多流分析强化攻击判定、构建能够检测未经过显式训练的未知攻击的模型，这些都是提升SDN安全性的核心必要步骤。\n本文提出了一种创新方法，借助自然语言处理（NLP）与预训练BERT base模型提升SDN的攻击检测能力。该方法将网络流数据转换为语言模型可解读的格式，使BERT能够捕捉网络流量中的复杂模式与关联关系。我们通过Random Forest（随机森林）进行特征选择，优化了模型性能并降低了计算开销，保障检测的准确性。攻击判定基于多条流的信息完成，可更可靠、更有力地检测恶意流量。此外，该方法专门针对未知攻击检测设计，可识别模型未经过显式训练的威胁。\n为严格验证该方法的有效性，我们在两种场景下开展了实验：一种聚焦已知攻击检测，准确率达99.96%；另一种针对未知攻击检测，模型同样取得99.96%的准确率，证明了该方法在检测演化型威胁、提升SDN网络安全性方面的鲁棒性。
英文摘要：
Software defined networking (SDN) represents a transformative shift in network architecture by decoupling the control plane from the data plane, enabling centralized and flexible management of network resources. However, this architectural shift introduces significant security challenges, as SDN's centralized control becomes an attractive target for various types of attacks. While current research has yielded valuable insights into attack detection in SDN, critical gaps remain. Addressing challenges in feature selection, broadening the scope beyond DDoS attacks, strengthening attack decisions based on multi flow analysis, and building models capable of detecting unseen attacks that they have not been explicitly trained on are essential steps toward advancing security in SDN. In this paper, we introduce a novel approach that leverages Natural Language Processing (NLP) and the pre trained BERT base model to enhance attack detection in SDN. Our approach transforms network flow data into a format interpretable by language models, allowing BERT to capture intricate patterns and relationships within network traffic. By using Random Forest for feature selection, we optimize model performance and reduce computational overhead, ensuring accurate detection. Attack decisions are made based on several flows, providing stronger and more reliable detection of malicious traffic. Furthermore, our approach is specifically designed to detect previously unseen attacks, offering a solution for identifying threats that the model was not explicitly trained on. To rigorously evaluate our approach, we conducted experiments in two scenarios: one focused on detecting known attacks, achieving 99.96% accuracy, and another on detecting unseen attacks, where our model achieved 99.96% accuracy, demonstrating the robustness of our approach in detecting evolving threats to improve the security of SDN networks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
