# Federated Learning-Based Security Attack Detection for Multi-Controller Software-Defined Networks
## 3 The Proposed Methodology
### Model Training and Attack Classification
#### 3.4.1 GCNN-GRU-Based Model Training  
In the FedSec, the GCNN-GRU relies on the features of an enriched NSL-KDD dataset for model training. The enriched NSL-KDD comprises an intelligent extraction of spatial and temporal features in the large-scale and dynamic SDN network traffic. The enriched NSL-KDD input features and local model construction of FedSec are depicted in Figure 2.  
The FedSec implements the GCNN model at the network-centric nodes of various domains managed by controllers. Each node has its local dataset. They initially train their learning models using the local dataset information and construct a local model. The MC-SDN environment is modeled as a graph G = <V, E> in which 'V' denotes the records and 'E' denotes the type of flows that are either legitimate or malicious based on the nodes' interactions. To analyze the data flow between the nodes, the source and destination IP address and ports are the potential indicators for transmitting packets or flow traffic. To provide the input to the GCNN model, the feature matrix and adjacency matrix are created from the 'T' number of traffic samples or records and the 'F' number of feature dimensions. The construction of the input or feature matrix comprises the standardized network traffic values with the dimension of XT \(\times\) F that is referring the standardized format of the input-enriched dataset with the impact of selected features by the hybrid heuristic algorithm. With the target of establishing the edge relationship between the network traffic flows, the proposed approach considers the source IP address, destination IP address, source port, and destination port as the key elements. For instance, in the NSL-KDD dataset,'same_srv_rate', 'diff_srv_rate', and'srv_diff_host_rate' features are utilized as the key indicators to create the edge relationships between the traffic flows, indicating the port and IP address in the aspect \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Learning Parameters**} & \multicolumn{3}{c}{**Models**} \\ \cline{2-3}  & **GCNN** & **GRU** \\ \hline Dropout Rate & 0.2 & 0.4 \\ \hline Hidden Units & 32 & 64 \\ \hline Learning Rate & 0.01 & 0.001 \\ \hline Activation & GeLU, Tanh & ReLU \\ \hline Optimizer & Adam & adadelta \\ \hline Loss Function & \multicolumn{2}{c}{Categorical Cross-Entropy} \\ \hline Epochs & 100 \\ \hline Batch Size & 64 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Model Parameters. of service (srv) and hosts. As per the hypothetical rules, the proposed approach constructs the graph with the connection establishment between two traffic flows, TF1 and TF2. \(1\rightarrow\text{TF1}[\text{Source IP}]=\text{TF2}[\text{Source IP}]\) and \(\text{TF1}[\text{Source Port}]=\text{TF2}[\text{Source Port}]\)  
\(2\rightarrow\text{TF1}[\text{Source IP}]=\text{TF2}[\text{Dest IP}]\) and \(\text{TF1}[\text{Source Port}]=\text{TF2}[\text{Dest Port}]\)  
\(3\rightarrow\text{TF1}[\text{Dest IP}]=\text{TF2}[\text{Source IP}]\) and \(\text{TF1}[\text{Dest Port}]=\text{TF2}[\text{Source Port}]\)  
\(4\rightarrow\text{TF1}[\text{Dest IP}]=\text{TF2}[\text{Dest IP}]\) and \(\text{TF1}[\text{Dest Port}]=\text{TF2}[\text{Dest Port}]\)  
Similarly, the connection between the traffic flows is built for the graph model in which the connection is established if any one of the rules is true. In the subsequence of feature matrix construction and connection establishment, the adjacency matrix is constructed based on the edge weight computations. Instead of building the adjacency matrix from the connection establishment, the proposed approach computes the edge weight based on the attack behavior analysis. For any traffic flows in the graph connection, if the minimum three criteria are satisfied, the proposed approach assigns the edge weight as '1'; otherwise, '0' in the adjacency matrix in which '1' refers to the malicious entry.