# Federated Learning-Based Security Attack Detection for Multi-Controller Software-Defined Networks
## 3 The Proposed Methodology
### Network-Centric Node Selection  
In the modeling of federated paradigm are 'C' controllers, {C1, \(\ldots\), CK}, in which each controller comprises different network traffic data, {D1, \(\ldots\), DK}. For training the learning model, the local data managed by each SDN controller is provided as the input matrix that consists of 'T' traffic flow samples as a row and features as columns. Hence, the sample ID is X, and the feature space is Y for the horizontal federated learning schema. In essence, the controllers share the same feature space for the different network traffic flows generated by hosts with different services. Wherein, \(X_{a}\
eq X_{b}\), \(Y_{a}=Y_{b}\), \(\forall T_{a},T_{b},a\
eq b\), in which 'a' and 'b' refer to the different clients or controllers in the MC-SDN environment. The proposed approach develops the attack detection mechanism for the data plan security to protect the flow table. Hence, for deploying the proposed model's implementation, the FedSec attack detection algorithm is executed on selected network-centric nodes to ensure security coverage in the overall SDN. In this scenario, it is assumed that the selected network-centric nodes are trusted. These nodes are also federated clients that participate in the model sharing process and perform attack detection. The main objectives behind the node selection for the implementation of the attack detection are that the nodes or switches can analyze the incoming traffic flows, update flow entries in the flow table, and perform actions regarding the traffic flows based on the rules mentioned by the controller. Inspired by the work in [25], the proposed attack detection associated with the deep learning model is executed on the selected nodes that can acquire the network data and leverage the network security. Hence, to minimize energy consumption and maximize communication security, the proposed approach only deploys the attack detection on network-centric nodes rather than executing all the switch nodes for SDN security. Accordingly, the network-centric nodes build the local model based on its local information and send it to the cloud server via the corresponding main controller. In this work, the node selection aims to identify the node that has the ability to protect its connected nodes within the network based on their importance value among all other nodes in the network. By deploying the attack detection mechanism on the selected node, the attack detection algorithm efficiently provides security coverage for the connected nodes in the network, thereby mitigating the security risks even when non-selected nodes are attacked by the intruder in the SDN. The proposed system's significant node selection depends on the number of connected hosts and network traffic within each controller. During the computation of importance value, a higher value indicates that the switch or node 'S' has established their connection with numerous hosts 'H', H \(\in\) N. The measurement of node importance values is the summation of all the connected host importance values. As formulated in Equations (1)-(3), the proposed approach estimates the importance value by combining each node's direct and indirect importance values. In essence, the Direct IMportance (DIM) value of the 'S' node is based on the total number of connected 'H' nodes within the controller network, whereas the Indirect Importance (IIM) value of the 'S' node is the maximum DIM value of node 'S' among all the Connected Nodes (CN).