# Federated Learning-Based Security Attack Detection for Multi-Controller Software-Defined Networks
## 3 The Proposed Methodology
### SDN-Specific Dataset Enrichment  
The proposed approach intends to enrich the benchmark NSL-KDD dataset in the context of SDN characteristics to assess the quality of attack detection in the federated environment. The study of work in [11] found that testing the context of flow-based attack detection from the packet-based generic network dataset, such as the NSL-KDD [28], is inappropriate. For the SDN environment, the Time-To-Live (TTL) and flow duration are essential to identify attacks, which is lacking in the benchmark NSL-KDD dataset. Hence, it is imperative to incorporate SDN-specific features into publicly available datasets to ensure accurate and consistent attack detection because the generic network dataset lacks features to reflect real-world network traffic in the SDN accurately. Accordingly, the proposed approach incorporates the dataset enrichment process as one of the objectives of improving intrusion detection accuracy. It aims to append prospective attributes that influence the attack detection ability in the benchmark NSL-KDD dataset from the influence of available attributes. The NSL-KDD dataset [28] has been increasingly examined by attack and intrusion detection to develop and assess security solutions. It comprises the network traffic for the attacks, such as DoS, Probe, U2R, and R2L. In essence, the number of additional packets or traffic flows generated for the attacks with the additional SDN-specific features of the Node ID, Flow duration, TTL, and Trust Value for all the instances are presented in the paper published in the IEEE International Conference on Consumer Electronics [29]. In addition to the DoS, Probe, U2R, and R2L attack categories in the NSL-KDD dataset, the FedSec mechanism appends one additional attack category as other categories with the attacks of time jack and peer flooding attack.  
In the enriched dataset, Node ID refers to the identity of the connection for a specific service between the hosts and switches in the controller, indicating the IP address and Port identity. The flow duration and TTL values are updated for the normal and malicious traffic from the study of several existing SDN systems. Moreover, trust value implies the ability of traffic flow fluctuations for each node in its historical activities based on the immediate trust measurement. Accordingly, the trust value measurement is vital for detecting the attacks in the SDN data plane based on evaluating flow rules, as presented in Equations (6) and (7).  
\[\Pi_{\text{LFR}}=\sum_{k=1}^{\left|\text{LFR}\right|}\Phi_{\text{k}}\Big{/} \left|\text{LFR}\right| \tag{6}\]  
\[\Pi_{\text{LFR}}=\sum_{k=1}^{\left|\text{LFR}\right|}\Phi_{\text{k}}\Big{/} \left|\text{LFR}\right| \tag{7}\]  
To enrich the NSL-KDD dataset with the trust value, FedSec designs the computation of the immediate trust value for the SDN nodes based on the flow rules to improve the classification accuracy in the dynamic network environment. The estimation of Immediate Trust (IT) measurement determines the average number of matching fields of all Legitimate Flow Rules (LFR) and Malicious Flow Rules (MFR) to the Suspected Flow (SF). If SF matches with many fields in legitimate flow entries, it is categorized as legitimate, compared to malicious flows. In Equations (6) and (7), \(\Phi_{\text{k}}\) denotes the number of matched fields between the suspected flow, LFR, and MFR. Thus, the FedSec enriches the NSL-KDD dataset with additional features and samples. The enriched dataset is provided to the GCNN-GRU model for attack classification, wherein the graph-based features are computed and classification is performed.