Bringing To Light: Adversarial Poisoning Detection in Multi-controller
Software-defined Networks
Abstract
Machine learning (ML)-based network intrusion detection systems (NIDS)
have become a contemporary approach to efficiently protect network
communications from cyber attacks. However, ML models can become
exploited by adversarial poisonings, like random label manipulation
(RLM), which can compromise multi-controller software-defined network
(MSDN) operations. In this paper, we develop the Trans-controller
Adversarial Perturbation Detection (TAPD) framework for NIDS in
multi-controller SDN setups. The detection framework takes advantage of
the SDN architecture and focuses on the periodic transference of network
intrusion detection models across the SDN controllers in the topology,
and validates the models using the local datasets to calculate errors in
their predictions with the ground truth. We demonstrate the efficacy of
this framework in detecting RLM attacks in an MSDN setup. Results
indicate efficient detection performance achieved by the TAPD framework
in determining the presence of Random Label Manipulation attacks and the
localization of the compromised controllers. We find that the framework
works well even when there is a significant number of compromised agents
in a large multi-controller setting. However, the performance begins to
deteriorate when more than 40% of the SDN controllers in the MSDN have
become compromised.