SDN Controllers and ML-Based Anomaly Detection in Embedded Systems: A Comparative Analysis

Software-defined networking (SDN) is a novel networking paradigm that decouples the control plane from the data plane, thereby offering enhanced network programmability and flexibility. However, the introduction of SDN has brought forth unique security challenges. This study presents a comprehensive comparative analysis that focuses on the classification of network traffic data derived from a realistic network implementation. The dataset acquired via the REST API from three SDN controllers encompasses diverse network features. The main aim of this study is to employ machine learning algorithms, specifically Decision Tree (DT), Support Vector Machines (SVMs), and Neural Networks (NN), to perform classification tasks on network traffic data. Subsequently, the performance of these algorithms was evaluated in real time using collected network data. The results revealed notable accuracy rates for DT and SVMs, while NN showed improved performance compared with recent studies. Nevertheless, the reaction time for detecting anomalous behaviors is notably compromised across the OpenDaylight (ODL) controller. These findings underscore the significance of comprehending SDN controller performance across various attack and target scenarios when deploying machine learning algorithms for traffic data classification in embedded system networks.