Abstract:Software Defined Networking (SDN) is an open network approach that has been proposed to address some of the main problems with traditional networks. However, SDN faces cybersecurity issues. To provide a network defense against attacks, an Intrusion Detection System (IDS) needs to be updated and included into the SDN architecture on a regular basis. Machine learning methods have proved effective in detecting intrusions in SDN. Moreover, these techniques pose the problem of significant computational overload and the absence of regular updates when new cyber‐attacks appear. To address these issues, we propose a new SDN‐based cloud intrusion detection system called Continual Federated Learning (CFL). In CFL, we modify the classical federated learning process by granting a more important and dynamic role to each participating client. On the one hand, it can trigger this process whenever a new type of intrusion is detected. On the other hand, once the new model has been identified, the customer can decide whether or not to deploy it in his network. In addition, to verify the accuracy of the CFL system, we have formally specified it by a communication protocol. This specification organizes the exchanges between the different communicating entities involved in the CFL. To verify the accuracy of this specification, we described it using the PROMELA language and checked with the associated SPIN tool. On the experimental side, we deployed this specification of the CFL system in an SDN computing environment. We defined different scenarios, and we proposed that each client decides locally to deploy or not the newly obtained intrusion detection model. The decision is based on a modified metric where we integrate the severity of the intrusions. Experimental results using private local datasets show that the proposed CFL system can efficiently and accurately detect new types of intrusions while preserving client confidentiality. Thus, it can be considered a promising system for SDN‐based edge computing.

Facility for Common Intrusion Detection Framework

A Query Facility for Common Intrusion Detection Framework

DM-CIFA: Detection and Mitigation of Collusion Interesting Flooding Attacks in NDNs

Extending Common Intrusion Detection Framework (CIDF) to Support Queries

Implementation of IDS Generator Based on CIDF

Hybrid Intrusion Detection System for Complicated Network

CBF-IDS: Addressing Class Imbalance Using CNN-BiLSTM with Focal Loss in Network Intrusion Detection System

(Cid)-D-2&r: Cost-Based Intelligent Intrusion Detection and Response System

Cost-based Intelligent Intrusion Detection and Response: Design and Implement

ICDF: Intrusion collaborative detection framework based on confidence

Intrusion Detection in Distributed Systems: An Abstraction-Based Approach

A Common On-board Hardware Architecture for Intrusion Detection System

A cooperative intrusion detection system based on autonomous agents

A collaborative framework for intrusion detection (C-NIDS) in Cloud computing

Collaborative Distributed Intrusion Detection System

IDMEF-Based Architecture of Large-Scale Cooperative IDS System

Common Security and Control Framework in Tri-Network Convergence

Design and Implementation of a Distributed Cooperative Intrusion Detection System

TICPS: A trustworthy collaborative intrusion detection framework for industrial cyber–physical systems

New Continual Federated Learning System for Intrusion Detection in SDN‐Based Edge Computing

Abstraction-based intrusion detection in distributed environments.