FEAR: Federated Cyber-Attack Reaction in Distributed Software-Defined Networks with Deep Q-Network

In this paper, we propose a FEderated cyber-Attack Reaction (FEAR) system using Deep Q-Network algorithm for distributed software-defined networks. In our recent study [1], we propose a Q-learning based cyber-attack reaction control system, called CARS, for a single SDN. However, for real network deployments that are usually distributed over the Internet, the CARS suffers from two main shortcomings, i.e., a slow-convergence rate of Q-learning algorithm and the scalability issue. Therefore, in this paper, we first develop a Deep Q-Network (DQN) based cyber-attack reaction control algorithm to assist the control agent in obtaining the optimal policy quickly. Next, we propose a federated DQN based cyber-attack reaction control system, which eliminates the scalability problem and improves the learning performance of the DQN algorithm in a distributed manner. As our case study on denial-of-service (DoS) attacks, the obtained results show that the FEAR can effectively protect the victim from malicious packets, i.e., approximately 90% of attack packets are discarded. Furthermore, by deploying the optimal cyber-attack reaction policy, the FEAR can reduce the ratio of QoS (Quality-of-Service) violated traffic flows compared to the CARS (by approx. 44%) and the GATE (by approx. 63%).