f-AnoGAN for Unsupervised Attack Detection in SDN Environment

Network management solutions remain essential for proper network service delivery. The software-defined networking (SDN) paradigm brought flexibility and programmability to today's large-scale networks, easing their governance. Another critical factor in the quality of network services is network security for protection against cyberattacks. This work proposes an unsupervised volume anomaly detection and mitigation system for securing SDN environments. We implement a fast AnoGAN (f-AnoGAN) to model legitimate user behavior and identify outlier samples. The generative network is trained on a low-dimensional representation of network traffic to reduce computational overhead. The f-AnoGAN model performance is further investigated through hyperparameter tuning and ablation study. The security system is evaluated on four public datasets: Orion, CIC-DDoS2019, CIC-IDS2017, and TON_IoT. We implement state-of-the-art alternative models for comparison analysis, namely Autoencoder, BiGAN, and FID-GAN. The f-AnoGAN presents improved class separation capacity and anomaly identification performance compared to the other models. The anomaly mitigation module can drop between 95% and 99% of malign traffic, supporting network resilience and correct functioning.