XAI-SDN：一种用于软件定义网络中实时DDoS检测的可解释熵引导机器学习框架
XAI-SDN: An Explainable Entropy-Guided Machine Learning Framework for Real-Time DDoS Detection in Software Defined Networks
- Islamic University of Madinah（麦地那伊斯兰大学）
- King Fahd University of Petroleum and Minerals（法赫德国王石油与矿业大学）
- Islamia University of Bahawalpur（巴哈瓦尔布尔伊斯兰大学）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
提出XAI-SDN框架，利用熵引导和随机森林结合SHAP实现SDN中实时可解释DDoS检测，在CIC-DDoS2019上达到99.9987%准确率，兼顾性能与透明度。
AI中文摘要：
软件定义网络（SDN）面临的最大风险之一是分布式拒绝服务（DDoS）攻击，在这种攻击中，被攻陷的控制器可能使整个网络无法使用。为了应对这些挑战，我们提出了一种名为XAI-SDN的熵引导机器学习框架，用于SDN环境中的实时DDoS检测，该框架轻量级且可解释。该框架扩展了由CICFlowMeter提取的流特征，增加了通过$\mathcal{O}(1)$滚动算法获得的八个香农熵指标，并使用随机森林分类器与SHAP TreeExplainer在预测层面提供透明度。在固定的时间划分上，XAI-SDN在CIC-DDoS2019 SYN基准的完整359万条流上达到了99.9987%的准确率、99.9621%的宏F1分数和1.0000的AUC-ROC。在不使用SHAP的情况下，该流水线维持每流0.0165毫秒（60,606流/秒）的处理速度，而在DDoS流量占比99.14%的情况下，完全支持SHAP时每流处理时间为0.5122毫秒（1,953流/秒），这朝着在下一代SDN安全中实现检测性能与运营透明度之间的平衡迈出了一步。
英文摘要：
One of the biggest risks faced by Software Defined Networks (SDN) is the Distributed Denial of Service (DDoS) attack in which a compromised controller can make an entire network unusable. To address these challenges, we suggest an entropy-guided machine learning framework, called XAI-SDN, for real-time DDoS detection in SDN environments which is lightweight and explainable. The framework extends the flow features extracted by CICFlowMeter with eight Shannon entropy metrics obtained by an $\mathcal{O}(1)$ rolling algorithm and uses a Random Forest classifier with SHAP TreeExplainer for providing transparency at the prediction level. On a fixed temporal split, XAI-SDN achieves an accuracy of 99.9987\%, a macro F1-score of 99.9621\%, and an AUC-ROC of 1.0000 on the full 3.59 million flows of the CIC-DDoS2019 SYN benchmark. The pipeline sustains 0.0165~ms per flow (60{,}606 flows/s) without the use of SHAP and 0.5122~ms per flow (1{,}953 flows/s) with full support of SHAP under the 99.14\% prevalence of DDoS traffic, which is a step towards achieving a balance between the detection performance and operational transparency in next-generation SDN security.
