# Federated Learning-Based Security Attack Detection for Multi-Controller Software-Defined Networks
## 5 Experimental Results
### Evaluation of Traffic Classification  
The comparative works [19; 21] have employed the hybrid deep learning models to investigate the network traffic flows from the spatial and temporal dimensions. However, the lack of examining the spatial node connectivity and its packet transmission instead of feature dependencies leverages the inaccurate discrimination of the normal and malicious traffic. Even though the outcome of the feature selection algorithm leverages the learning of abstractive features by the hybrid model [19], the deployment of a security mechanism on the attacker node or low-coverage node further degrades the intrusion detection performance. Also, the comparative work [21] fails to cope with the diversified malicious attack behaviors when applying multiple centralized security mechanisms on distributed networks due to the lack of collaborative training knowledge. In addition, the existing research [24] applies weighted federated learning to collaboratively examine the heterogeneous network traffic patterns to detect malicious network traffic in SDN accurately. Although research studies [21; 24] have targeted detecting the DDoS attacks in the SDN, the suggested security solution is inappropriate for emerging SDN data plane attacks. Also, the graph-based security solution fails to build the feature matrix and adjacency matrix with the awareness of the malicious representative behaviors, misguiding the spatial feature analysis and inaccurate attack detection. To overcome these shortcomings in the comparative works, the proposed FedSec selects the representative features with  
Figure 6: Feature Importance in Enriched NSL-KDD Dataset. minimal computation time and constructs the graph from the potentially reduced and enriched SDN-specific features with collaborative learning among the multiple controllers in the federated SDN. In the experiment, hyperparameters play a paramount role in the decision-making to build and train the GCNN-GRU model. In addition to the enriched NSL-KDD dataset, the traffic classification and SDN security performance are tested on two other datasets, the UNSW_NB15 dataset [30] and the InSDN dataset [31]. * UNSW_NB15: The generation of raw network packets in the UNSW-NB 15 dataset is based on the combination of real modern normal activities and synthetic contemporary attack behaviors, developed by the IXIA PerfectStorm tool in the Cyber Range Lab of the Australian Centre for Cyber Security (ACCS). This dataset includes the nine attack types: fuzzers, analysis, backdoors, denial-of-service, exploits, generic, reconnaissance, shellcode, and worms. Twelve algorithms are built, and 49 features with the class label are generated using the Argus and Bro-IDS tools. * InSDN Dataset: The InSDN dataset contains threats specific to SDNs and SDN-specific assaults on different types of standard traffic. The attacks include DoS, DDoS, web, botnet, probing, exploiting, and brute force. Furthermore, various external and internal attack routes are incorporated into the InSDN dataset to replicate real-time attack situations. To examine the performance improvement of the GCNN-GRU in the FedSec on each performance metric, the results are briefly presented as follows. Table 5 evaluates the proposed attack detection algorithm with three existing SDN security solutions [19; 21; 24] for three different datasets. The proposed FedSec approach accomplishes a Detection Rate (DR) of 98.01%, and the DR of the works [21; 24] are 95.27% and 96.67%, respectively, while testing on the enriched NSL-KDD dataset. It is because, even though the federated learning model collaboratively learns the diversified attack knowledge from the multiple domains, the lack of investigating the intrusion-aware spatial correlations in the traffic flows degrades the attack detection performance [24] compared to the proposed approach.