A Comparison Study on Federated Learning and Centralized Learning-based Intrusion Detection System for Software Defined Networking

Software-defined networking (SDN) provides significant advantages in network management through its centralized control architecture, which enables programmable network configuration and dynamic flow management. However, this centralized control design also introduces security vulnerabilities that malicious actors can exploit. Intrusion detection systems (IDS) are essential for SDN security, but face critical implementation challenges. Traditional IDS training approaches collect and aggregate network traffic data at a central location (centralized learning), compromising data privacy and potentially creating large, resource-intensive models that can impair controller responsiveness in SDN environments. Instead of centralizing training data, federated learning enables collaborative model training across multiple distributed controllers or administrative domains without sharing raw network data, preserving data privacy and potentially resulting in more compact models. This study explores the implementation and comparative performance of centralized and federated learning approaches for IDS deployment within SDN architecture. Employing a GRU-based machine learning architecture, we conduct a comprehensive evaluation using the balanced InSDN dataset for binary attack classification. The research focuses on assessing detection model accuracy, model size, and loading time deployed within the SDN environment. Our experimental results demonstrate that the federated approach achieved 99.90% model accuracy, with a model size of 1.65 MB compared to the centralized learning model of 4.90 MB. Additionally, the federated learning IDS demonstrated a 12.49% faster loading time compared to the centralized learning approach.