# Federated Learning-Based Security Attack Detection for Multi-Controller Software-Defined Networks
## 3 The Proposed Methodology
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Ref** & **Year** & **Work** & **Learning Model** & **Dataset** & **Limitations** \\ \hline
[16] & 2019 & Flow-based Anomaly detection. & GRU and LSTM & NSL-KDD & Single point of controller failure affects the flow table security. \\  & & Flow-based IDPS for & & & \\
[10] & 2020 & preventing SSH brute-force and DDoS attacks. & MLP & Flow-based SDN dataset & Lack of providing detailed packet details to the SDN controller. \\
[11] & 2021 & GRU-based SDN Attack & GRU & CICIDoS 2019 and CICIDS 2018 & Confronts with a single point of controller failure. \\
[17] & 2021 & Hybrid DL-based IoT Cyber & CuDNNLSTM and CICDDoS 2019 & Lack of examining the spatial features of the network traffic. \\  & & threats detection. & CuDNNGRU & Efficiency is a major constraint due to the lack of feature selection in large-scale networks. \\
[21] & 2021 & Spatial-temporal DL-based DDoS detection. & GCNN & CICDDoS & Fails to learn the spatial features in the network structure. \\
[14] & 2022 & Cyber threat detection for smart environment. & DNN and LSTM & CICIDS2018 & The lack of SDN structural relationship-based attack detection degrades the performance. \\
[15] & 2022 & Multi-controller SDN for DDoS detection. & LSTM & CICIDS-2019 & Fails to learn the diversified attack behaviors. \\
[18] & 2022 & DDoS attack detection and mitigation. & CNN and ELM & CICIDS-2017 and InSDN & The lack of investigating structural relationships in the network traffic flows misleading the spatial feature learning. \\  & & Network traffic & & NSL-KDD, UNSW-NB15, and InSDN & Large-scale network traffic features affect the latency. \\
[19] & 2023 & classification with feature selection. & CNN and BiLSTM & NSLKDD dataset & Data cannot reflect the characteristics of the SDN environment. \\  & & & Weighted & & \\
[24] & 2023 & DDoS attack detection. & Federated Learning & & \\  & & A deep learning technique & & & \\
[22] & 2024 & to detect distributed denial of service attacks in software-defined networks. & AE and BGRU & NSLKDD dataset & Data cannot reflect the characteristics of the SDN environment. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of Learning-based SDN Security Solutions. level of the main controllers. The sub-controllers do not engage in other operations like data plane monitoring but focus only on ensuring that the main controller acts in a reliable and trustworthy manner. Furthermore, the main controller within a domain is responsible for controlling the data plane activities and improving the data transfer efficiency via accurate flow table maintenance. The proposed work implements the federated learning structure among the network-centric nodes selected in the data plane and cloud server in which the nodes share the models with the cloud server through the main controller. The cloud server is responsible for aggregating the local model parameters of various network-centric nodes through FedAvg and shares the global model reversely to the corresponding nodes via the main controller. During the global model training in the Federated SDN, the widely learned normal and malicious traffic patterns facilitate the building of generalized attack detection with collaborative knowledge. By obtaining the global attack knowledge through controllers, the network-centric nodes retrain their learning models and create a wider attack knowledge for attack detection. Thus, it significantly improves attack detection during testing and proves the effectiveness of the proposed FedSec model. To secure the SDN nodes at the data plane, the proposed system designs the FedSec mechanism with four phases: Network-centric node selection, Hybrid heuristic-based feature selection, SDN-specific dataset enrichment, and Attack detection. In particular, attack detection or security mechanism through the classification model refers to the GCNN-GRU model in this work, accomplished by discriminating the normal and malicious traffic. Figure 1: Design Overview of FedSec.