IDPS-SDN-ML: An Intrusion Detection and Prevention System Using Software-Defined Networks and Machine Learning

The recent increase in the amount and precision of cyberattacks necessitates the development of detection and prevention systems that mitigate the risks of these threats. Several studies discussed using Software-Defined Networks (SDNs), Challenge-based collaborative intrusion detection systems, or pattern recognition using machine learning or machine learning. The Intrusion Detection and Prevention Systems (IDPS) monitor traffic to detect unusual traffic and compare the network traffic with known attacks to identify anomalies. As a response, the system alerts the network administrator or controller of the possible attack and blocks (prevents) the attack. It is crucial to detect any attack early to avoid huge damage to the network or the system. This study aims to suggest a new method that combines the pattern recognition of machine learning and the network programmability feature and architecture to better protect and defend the network against Denial of Service (DoS) and Port Scanning attacks. A machine learning algorithm was built using Anova for feature selection and applying the chosen features to multiple machine learning models. The naive Bayes machine learning model achieved the highest accuracy with 86.9% for DoS attacks and 93.5% for Probe attacks.