Enhanced Scanning in SDN Networks and its Detection using Machine Learning

Software-Defined Networking (SDN) is a networking approach that is dynamic and programmable, making network configuration easier and improving network efficiency. The separation of the control plane from the network plane and the global visibility of the controller to the whole network make the monitoring and collection of data much easier than in traditional networks. Advanced Persistent Threats (APTs) are notoriously hard to detect and prevent as they have sophisticated characteristics compared to traditional attacks. Little research has been carried out on the detection of APTs in the context of SDNs. In SDN, scanning is a fundamental part of the reconstruction of flow rules maintained at nodes (and underpins many further attacks). In this paper, we propose a more stealthy means of scanning within SDN networks, typical of the "low and slow" approach taken by APTs, and enhance a network scanning tool to implement it. We evaluate how well Machine Learning (ML) algorithms can detect such APT scanning activities inside SDN. We use the XGBoost classifier for the proposed detection model, achieving at least 97.8% in Accuracy, Recall, Precision and F1-measures using just 5 features. Datasets over different network sizes are generated to form the basis for experiments and are offered free public use.