# Federated Learning-Based Security Attack Detection for Multi-Controller Software-Defined Networks
## 3 The Proposed Methodology
### Model Training and Attack Classification
#### 3.4.1 GCNN-GRU-Based Model Training
The proposed approach computes the edge weight based on the factors of 'number of compromised', 'number of failed logins', 'logged in', loss computation from'source bytes' and 'destination bytes', and false injection computation from'source bytes' and 'destination bytes', 'TTL',  
Figure 2: Federated Local Model in FedSec. and 'Trust Value'. Equation (8) computes the edge weight to emphasize legitimate and malicious behaviors. \[\left(\text{EW}\right)_{1,2}=\left\{ \begin{array}{ll}1,&\text{if}\;\text{num }_{\text{compromised}}\geq 1\\ 1,&\text{if}\;\text{num}_{\text{tailed}_{\text{logins}}}\geq 3\\ 1,&\text{if}\;\text{logged}_{\text{in}}==0\\ 1,&\text{if}\;\text{src}_{\text{bytes}}>\text{dst}_{\text{bytes}}\\ 1,&\text{if}\;\text{src}_{\text{bytes}}<\text{dst}_{\text{bytes}}\\ 1,&\text{if}\;\text{TTL}>80\\ 1,&\text{if}\;\text{Trust}\;\text{Value}<0.5\end{array} \right. \tag{8}\]  
In the SDN, the attack detection heavily relies on the trust of the nodes in the transmission path. Hence, the adjacency matrix computation primarily focuses on the trust-based approach during packet transmission. In Equation (8), '1' indicates malicious activity, whereas '0' indicates normal behavior. To build the adjacency matrix, computing the trust relationship between the pair of nodes is vital for the implementation of the graph model. Hence, to highlight the malicious behavior in the network traffic patterns, the proposed approach assigns the edge weight as '1' for the adjacency matrix when there are malicious risks in the various factors of trust-based assessment. For the trust-based approach, the examination of compromised nodes indicates that there is the existence of malicious activity, particularly the DDoS attacks. Hence, this work explores the 'number of compromised nodes' as one of the significant factors for trust-based attack detection. In Equation (8), if the number of compromised nodes is greater than 1, there is the possibility of attack. Within the network, too many failed logins, and also transmitting or accessing packets without a logged-in state, emphasize the occurrence of the malicious activity. Moreover, the number of source and destination bytes are to be equal in the scenario of legitimate traffic; otherwise, there is the occurrence of either 'packet drop' or 'packet flood' attacks. Hence, if there are increased or decreased quantities between the source and destination bytes, the proposed approach assigns the edge weight as '1', which indicates the malicious behavior in terms of 'packet drop' or 'packet flood' attacks associated with any one of the connected nodes in the graph network. Similarly, TTL and trust values are formulated for the edge weight modeling based on the standard value range of the node with attack behaviors. The proposed intrusion detection aims to diminish the false positives by fulfilling at least three criteria of the seven, resulting in the balancing of sensitivity, that is, actual attack detection and specificity in false alarm mitigation. Moreover, the selection of only three criteria instead of seven diversified criteria leverages the detection of known patterns without failing to detect the unknown anomaly patterns. Accordingly, the TTL criteria modeling in this work is referred from several previous research works to fix TTL values for normal and attack categories. For instance, in the work in [30], the TTL value is described for normal and attack behaviors with the unit as number of hops passed by the packets before discard, irrespective of time during the IP packet transmission in the SDN rather than the Domain Name System (DNS), which indicates the TTL value in seconds. Among multiple factors, the proposed approach concludes that a minimum of three criteria provide nearly half of the importance of the seven factors. The attack detection emphasizes the attack's existence when any one of the factors is violated. Hence, to optimally balance and strengthen the tracing of attack behavior, this work formulates the attack behavior with the satisfaction of three minimum factors.