# Federated Learning-Based Security Attack Detection for Multi-Controller Software-Defined Networks
## 2 Related Works  
Recently, several works have been developed to provide SDN security using DL models and have listed the advantages and limitations of the SDN protocols, especially from the security perspective, including DoS and illegal intrusion attacks on SDN control nodes. This section reviews the DL model-based SDN security approach. Table 1 comparatively reviews several DL-based SDN security research works. The research work in [10] presented a Deep Learning-based Intrusion Detection and Prevention (DL-IDPS) Scheme that protects an SDN against brute-force and DDoS attacks. Moreover, by obtaining the SDN packet length, the DL-IDPS identifies the malicious packets and the attacker by analyzing the gathered evidence. Temporal pattern or feature analysis is vital in investigating the attack behaviors in the network traffic. Hence, security researchers have increasingly applied RNN-based deep learning models in addition to spatial analysis. For instance, the SDN security approach uses the GRU model [11] to protect the flow records within the SDN by identifying intrusions and DDoS attacks. The impact of the attackers on the SDN is reduced by the GRU-based lightweight SDN security model design and the direct flow inspection. The work in [12] detects the DDoS attacks in the IoT network with the design of the data plane and control plane in the SDN. Initially, the deployedsFlow and adaptive polling-based sampling enforce the minimization of processing and network overheads in the data plane switches. Subsequently, the Snort IDS integrated with the Stacked Autoencoders model improves the detection accuracy in the control plane. The adversarial training-based detection and defense system [13] employs the Generative Adversarial Network to detect DDoS attacks in SDN. Continuously monitoring the network traffic from the IP flow analysis ensures real-time anomaly detection. The SDN-enabled secure approach [14] employs the Deep Neural Network and LSTM models to identify new cyber risks in the Internet of Things (IoT). In an IoT network, the hybrid deep learning model identifies frequent and rarely occurred cyber threats like botnet attacks, port scanning attacks, DDoS attacks, and brute-force attacks. The work in [15] determines and classifies the DDoS attacks over a multi-controller SDN environment. In addition to detecting the attacks, it traces the paths utilized by the attackers. It initiates a mitigation step to safeguard the network devices with the assistance of feature selection and hybrid deep learning algorithms. Moreover, the work in [16] ensures accurate attack detection in the large-scale SDN, particularly for a flow-based intrusion detection system, by applying the GRU-LSTM and feature selection. Also, the SDN-enabled attack detection approach [17] utilizes the hybrid deep learning models involving the Cuda-Deep Neural Network GRU and Cuda-Bidirectional LSTM for a highly scalable and affordable solution for accurate defense mechanisms in an IoT context. The research in [18] presents an online attack detection and mitigation system for the SDN infrastructure. To detect the anomalies in the network traffic, it designs a lightweight hybrid DL model, namely CNN and Extreme Learning Machine, and then, to filter the abnormal traffic during the flow table update, it exploits the IP traceback that locates the attacker in the SDN. To improve the intrusion detection accuracy in SDN, the work in [19] initially performs the hybrid feature selection for the large-scale network traffic data and applies the hybrid DL model, CNN and BiLSTM, for the binary and multiclass classification. The abnormal traffic detection approach [20] initially utilizes the port information to detect the abnormal traffic roughly and applies the wavelet transform along with the hybrid DL model in the hierarchical model to detect the intrusions in the SDN switches precisely.