MMNAD: A Generalized Multi-Scenario Attack Detection Method for Software Defined Networking

Software Defined Networking (SDN) enhances programmability via centralized control but increases exposure to attacks such as configuration information sniffing attack, flow table overflow attack, and controller saturation attack, which target at the SDN architecture. However, existing SDN attack detection methods are usually designed for a single attack, and a model trained on one attack often cannot detect other attacks. At present, there is still a lack of a general model that can simultaneously detect multiple types of SDN attacks under a unified training framework. To address that issue, this paper proposes MMNAD, a Meta-learning based Multi-scenario Network Attack Detection method, aiming to achieve effective detection of these three SDN attacks at the same time. MMNAD includes an attack flow detector trained on different attack datasets and a meta-learning adaptive optimizer. Experimental results show that MMNAD achieves high accuracy in detecting flow table overflow and controller saturation attacks, as well as strong performance in detecting emerging configuration information sniffing attack.