# Federated Learning-Based Security Attack Detection for Multi-Controller Software-Defined Networks
## 5 Experimental Results
### Evaluation of Traffic Classification
In addition, learning the small perturbations in the network traffic patterns by fine-tuning the local model based on the global update ensures the adaptability and robustness of the proposed intrusion detection without retraining on the entire data, even when there are diversified network traffic patterns. Moreover, the proposed security scheme learns the different attack patterns with the enhanced hybrid deep learning model's assistance in weight dispersion regularization in GCNN during feature extraction and adaptive ownership weight in GRU during traffic classification. Moreover, the FedSec enriches the NSL-KDD dataset with the additional impact of the SDN-focused attributes of trust value, TTL, selected node ID, flow duration, and malicious patterns possible in SDN, which tends to improve the accurate classification of multiple attacks in the enriched NSL-KDD. The proposed FedSec yields higher accuracy in detecting the malicious and normal traffic from the network traffic samples, even when testing on the UNSW_NB15 and InSDN datasets. The adjacency matrix construction varies for each dataset based on the malicious \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**SDN Security Models**} & \multicolumn{2}{c}{**Enriched NSL-KDD**} & \multicolumn{2}{c}{**UNSW\_NB15**} & \multicolumn{2}{c}{**InSDN**} \\ \cline{2-7}  & **DR (\%)** & **Accuracy (\%)** & **DR (\%)** & **Accuracy (\%)** & **DR (\%)** & **Accuracy (\%)** \\ \hline Hybrid DL [19] & 96.39 & 95.11 & 89.36 & 83.19 & 95.18 & 93.07 \\ \hline Graph-based [21] & 95.27 & 92.13 & 89.15 & 87.22 & 95.02 & 92.49 \\ \hline Federated-based [24] & 97.67 & 96.51 & 87.36 & 84.13 & 96.14 & 95.01 \\ \hline Proposed & 98.01 & 97.78 & 94.31 & 92.15 & 97.56 & 96.12 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparative Traffic Classification Performance. behavior analysis. In particular, highly influencing features in the dataset are utilized for the rule generation during edge weight calculation for the adjacency matrix. In particular, the intricate relationships and interactions within the network are captured by the graph-based representation in the proposed work, which enables the intrusion detection model to learn the malicious behavior from the network traffic patterns. Moreover, the SDN-specific data enrichment phase does not apply to implementing UNSW_NB15 and InSDN datasets. However, the potential advantages of federated learning, hybrid heuristic feature selection, and the GCNN-GRU model leverage the security system towards improved performance compared to the existing security solutions. Thus, the comparison among the different datasets proved the ability of proposed intrusion detection on the diversified attack behaviors and network traffic patterns by the potential modeling of the hybrid heuristic algorithm-based feature selection and graph construction. In Table 6, the proposed SDN security model outperforms the existing federated work [24] and the proposed approach without implementing federated concepts. The detection rate of the proposed approach has a 5.7% performance improvement compared to the centralized proposed approach (without FL), which executes the GCNN-GRU model in a centralized manner for each local network traffic dataset. It is because the collaboratively trained global model in the FL optimally fine-tunes the local model with the global parameters after the federated aggregation, which enforces the accurate discrimination of normal and malicious traffic even when there are new types of attacks in the SDN. Moreover, the federated model in the proposed intrusion detection is associated with the GCNN-GRU model, facilitating the adaptability in the attack detection regarding the spatial and temporal dynamics in the network traffic, and tends to improve detection rate compared to the federated model. Also, the decentralized model updates in the federated settings allow intrusion detection by collective intelligence regardless of centralized data sharing.