# Federated Learning-Based Security Attack Detection for Multi-Controller Software-Defined Networks
## 1 Introduction  
In the digital world, SDN is emerging as a promising network paradigm that offers flexibility to the network infrastructure by clearly decoupling the data and control planes [1]. SDN simplifies the vertically integrated complex network by separating centralized network control and data forwarding. This process significantly enhances network flexibility and management by decomposing the components. The SDN revolutionizes network technology, and its inherent architecture offers enormous benefits. For instance, it enables global network visibility in a centralized control manner and can cost-effectively offer better coverage and capacity. Due to the rapid advancement of SDN technology, innovative SDN solutions are being developed and deployed, such as the Open Networking Automation Platform (ONAP), VMware NSX-based network virtualization platform, and Cisco ACI (Application Centric Infrastructure), to name a few. SDN has been adopted recently by many networks, such as the Internet of Things (IoT) and Wireless Sensor Networks (WSN), to improve their communication remarkably [2; 3]. However, the main problem associated with the SDN is its centralized architecture, which leads to the possibility of a single point of failure and scalability issues. To avoid a single point of controller failure and efficiently handle large multi-domain networks, the MC-SDN is a promising solution, as each controller is responsible for managing a domain [4]. The robust MC-SDN design provides a powerful architecture that offers scalability, flexibility, and resilience to failures, making it a potential choice for large and complex network environments. The capabilities of SDN controllers are criticized for network availability, performance, and scalability. Thus, enabling multiplecontrollers is imperative for managing large-scale networks to improve the above issues, even though it increases network complexity and management [5; 6]. The rapid deployment of SDN applications by multiple entities leads to complex network environments, which are highly vulnerable to several attacks. The data plane attacks pose potential threats to the SDN, such as the DoS and side-channel attacks, and belong to a data-to-control plane saturation attack and time delay based on the network configurations, respectively. Most conventional research utilizes machine learning-based solutions [7; 8] that can potentially analyze the network traffic and classify the attacks under different categories. Generally, machine learning solutions [9] necessitate large traffic to learn the environment for attack detection and classification. Among the ML-based solutions, federated DL algorithms have significant potential to improve classification accuracy, as they can obtain global attack knowledge with the assistance of federated model parameters from large-scale multi-domain networks [9]. Utilizing single DL-based attack detection algorithms leads to inaccurate classification in many scenarios due to inconsistent and erroneous dataset information. Hence, making attack detection decisions based on hybrid learning models is essential to improve classification accuracy. Moreover, federated DL improves the cybersecurity posture by gaining the patterns from different attempts of flow table manipulation with minimal communication overhead. Therefore, the main research goal of the proposed FedSec attack detection is to utilize the advantages of key enabling technologies federated learning (FL) to improve the security level of MC-SDN against various attacks in data planes. The main contributions of the proposed work are given as follows:  
* The primary intention of the proposed system is to enhance the MC-SDN security and efficiency against various attacks by adopting a federated learning paradigm. * Implementing the FedSec only on the network-centric nodes reduces the system complexity and overhead without affecting the intrusion detection accuracy.