# DIAMOND: A Structured Coevolution Feature Optimization Method for LDDoS Detection in SDN-IoT

Authors: Wencheng Yin; Yunhe Cui; Qing Qian; Guowei Shen; Chun Guo; Saifei Li
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

Software-defined networking for IoT (SDN-IoT) has become popular owing to its utility in smart applications. However, IoT devices are limited in computing resources, which makes them vulnerable to Low-rate Distributed Denial of Service (LDDoS). It is worth noting that LDDoS attacks are extremely stealthy and can evade the monitoring of traditional detection methods. Therefore, how to choose the optimal features to improve the detection performance of LDDoS attack detection methods is a key problem. In this paper, we propose DIAMOND, a structured coevolution feature optimization method for LDDoS detection in SDN-IoT. DIAMOND is consisted of a reachable count sorting clustering algorithm, a group structuring method, a comutation strategy, and a cocrossover strategy. By analysing the information of SDN-IoT network features in the solution space, the relationship between different SDN-IoT network features and the optimal solution is explored in DIAMOND. Then, the individuals with associated SDN-IoT network features are divided into different subpopulations, and a structural tree is generated. Further, multiple structural trees evolve in concert with each other. The evaluation results show that DIAMOND can effectively select optimal low-dimension feature sets and improve the performance of the LDDoS detection method, in terms of detection precision and response time.


---

## Body

## 1. Introduction

Internet of Things (IoT) ecosystem is one of the most critical aspects of human lives, which facilitates a wide variety of applications in different domains such as smart homes, agriculture, healthcare, smart cities, smart grids, industrial automation (Industry 4.0), smart driving, and elderly assistance [1]. Hence, guaranteeing communication quality for IoT devices is an issue worth exploring. In this work, WiFi is utilized as the communication protocol between IoT devices and access points (APs), which are implemented through Mininet-wifi. In fact, WiFi provides low latency and low latency jitter necessary for IoT applications such as industrial production lines, IP telephony, video conferencing, and virtual desktop infrastructures. However, the computing resources, storage resources, and network capacity of IoT devices are limited to carry high-speed data transmission.Recently, SDN-IoT is proposed to improve transmission quality [2]. Figure 1 shows the SDN-IoT architecture. In SDN-IoT, SDN changes the limitation of the network infrastructure, gives the network more flexibility, and simplifies policy implementation and network configuration [3]. SDN-IoT is anticipated to smartly route traffic and use underutilized network resources to deliver IoT data to the Internet. However, due to the stronger flexibility that SDN gives to the network, SDN-IoT faces many security threats [4].Figure 1
The SDN-IoT architecture.LDDoS (Low-rate Distributed Denial of Service) attack is a serious threat for SDN-IoT, which exploits the vulnerabilities in network protocols to launch attacks and often realizes superior attack effects at a smaller attack cost. LDDoS attacks can elude the monitor of the traditional detection approach by sending low-rate packets in the way of periodic pulse to a victim [5]. Hence, how to effectively detect LDDoS is a huge challenge [6]. Feature selection makes an outstanding contribution to overcoming the invisibility of LDDoS, exploring LDDoS-related features, and improving the efficiency of LDDoS detection.In recent years, feature optimization algorithms based on Evolutionary Algorithms (EAs) are popular [7–13]. However, the existing studies have suffered from the following limitations.
(1)
Existing EA-based feature optimization methods usually evolve individuals in a population, leading to the loss of diversity when evolving individuals(2)
The existing methods do not consider the coevolution of similar individuals during evolution, which leads to the reduction of convergence ratioIn order to overcome the shortcomings mentioned above, a structured coevolution feature optimization method for LDDoS detection in SDN-IoT (DIAMOND) is proposed. The main contributions are concluded as below:(1)
By dividing the population into several subpopulations based on the proposed reachable count sorting clustering algorithm and a group structuring method and executing coevolution based on the designed comutation strategy and cocrossover strategy, DIAMOND is proposed(2)
A reachable count sorting clustering algorithm (BONNET) is designed to divide the population into subpopulations with different SDN-IoT network feature information, and each subpopulation is considered as a suboptimal solution set in the solution space(3)
A group structuring method is designed to further structure a subpopulation into structural trees in order to sort the individuals in the subpopulation orderly based on SDN-IoT network information, where multiple structural trees evolve in concert(4)
A comutation strategy is proposed based on the optimal subpopulation guidance direction, amount of information on SDN-IoT network features, and the evolutionary trajectory of the subpopulation, to move the individual towards the optimal solution in an orderly manner(5)
A cocrossover strategy is designed to facilitate information exchange between different structural trees by exchanging individuals between different structural trees and the genes of individuals in the same tree


## 2. Related Works

This section presents a review of intrusion detection systems for malicious traffic detection in SDN-IoT networks as well as the deployment of malicious network attack detection technologies for feature selection tasks.Mafarj and Mirjalili [7] proposed a new wrapper feature selection approach based on whale optimization algorithm (WOA). In this work, two binary variants of the WOA algorithm are proposed to search the optimal feature subsets for classification. Emary et al. [8] proposed a new grey wolf optimization (GWO) algorithm. In that approach, the sigmoidal function is responsible for squeezing the continuously updated position; then, these values are stochastically compared with a threshold to find the updated binary grey wolf position. Abdel-Basset et al. [9] proposed a new grey wolf optimizer algorithm integrated with a two-phase mutation to solve the feature selection for classification problems based on the wrapper methods. Mafarja and Mirjalili [10] used two hybridization models to design different feature selection techniques based on WOA. In the first model, simulated annealing (SA) algorithm is embedded in WOA, while it is used to improve the best solution found after each iteration of WOA in the second model.Roopak et al. [11] have implemented the nondominated sorting algorithm with its adapted jumping gene operator to solve the optimization problem. The proposed method exploits an extreme learning machine as the classifier for feature selection based on six important objectives for an IoT network. Mafarja et al. [12] presented a novel wrapper feature selection approach based on augmented WOA, which was adopted in the context of IoT attacks detection. Transfer functions (sigmoid function and tanh function) are applied in the real-value step vector such that a high probability of change is given to the dimension with a large value. Haddadpajouh et al. [13] proposed a multikernel support vector machine (SVM) for IoT cloud-edge gateway malware hunting, using the GWO technique.Table1 describes the advantages and limitations of the related works. As shown in Table 1, the common limitations in these literatures are the high complexity of the models and the tendency of falling into local optimal solutions. This is because the existing methods do not consider the coevolution of similar individuals during evolution, leading to a complex model, which in turn leads to the decrease of the convergence rate. Likewise, existing methods lose diversity in populations during evolution, due to the fact that they usually evolve individuals in only one population, leaving the model trapped in a local optimum solution. The performance of the algorithm is limited by these problems. Therefore, DIAMOND is designed to solve these problems in this work.Table 1
Comparison with related works.
ReferenceTechniqueAdvantageLimitation[7]Whale optimization algorithm, binary variantsThe two binary variants avoid a large number of local solutions.More time and resources are consumed.[8]Binary grey wolf optimizationIt is efficient in exploration and development.This highly complex method potentially occupies more time and resource consuming.[9]Grey wolf optimizer algorithm, two-phase mutationThe two-stage mutation operator contributes to enhanced exploration.More parameters need to be determined.[10]Hybrid whale optimization algorithm, simulated annealingThe algorithm reaches high accuracy by using a fewer number of features.It has a high complexity and a tendency to fall into local optimal solutions.[11]Nondominated sorting algorithm adapted jumping gene operatorThe jumping gene operator contributes to improve the detection accuracy.Falling into local optimal solutions is a possible limitation.[12]The augmented whale optimization algorithmIt can search a more comprehensive range.The convergence speed may be a little slow.[13]Multikernel SVM, gray wolf optimizationThe multikernel SVM enhances the accuracy of the algorithm.The multi-kernel SVM method may lead to overfitting.DIAMONDA structured coevolution feature optimization method for LDDoS detection in SDN-IoTThe model enables ordered individuals and coevolution of multiple subpopulations, reducing redundant computations.How to coevolve subpopulations is an issue need to be addressed.


## 3. DIAMOND: A Structured Coevolution Feature Optimization Method for LDDoS Detection in SDN-IoT

### 3.1. Motivation

As a result of the rapid increase in the number of mobile-connected devices such as smartphones and tablets, SDN-IoT is attracting more and more attention from industry and academia. Therefore, the security of SDN-IoT becomes a serious issue [14]. Feature selection methods for network attack detection methods have been a hot research topic among researchers in recent years. However, the existing feature selection methods have some limitations such as follows:
(1)
Existing EA-based feature optimization methods usually evolve individuals in a population, leading to the loss of diversity when evolving individuals(2)
The existing methods do not consider the coevolution of similar individuals during evolution, which leads to the reduction of convergence ratioExisting feature selection methods all have the common limitations of high model complexity and the tendency to fall into local optimal solutions. Therefore, in order to solve these problems, this work enables multiple subpopulations to coevolve and makes subpopulations into ordered populations. In this way, multiple subpopulations can tract each other to avoid falling into local optimal solutions. At the same time, individuals within subpopulations are clearly distinguished to reduce the consumption of computational resources.


### 3.2. Overall Structure

Figure2 shows the overall structure of DIAMOND in SDN-IoT. DIAMOND is deployed on the SDN controller and collects network traffic by sending collect traffic instructions to the switch. Generally, DIAMOND includes the following steps:
(i)
Step 1. DIAMOND sends the instruction to collect network traffic information.(ii)
Step 2. Once the SDN controller receives the instruction, it sends OFPT_STATS_REQUEST messages to the switches to get the statistics of flow entries.(iii)
Step 3. The switches will reply OFPT_STATS_REPLY messages to the SDN controller. These messages contain the stream data in the flow entries of the switches.(iv)
Step 4. After the controller receives the OFPT_STATS_REPLY messages, it deencapsulates these messages and sends the collected statistic data to DIAMOND.(v)
Step 5. In DIAMOND, the statistic data of flow entries collected from switches are used to calculate the initial SDN-IoT network features. Subsequently, these features will be coded using the binary coding method to generate the initial population that is consisted of some individuals.(vi)
Step 6. The population is divided into several subpopulations by BONNET.(vii)
Step 7. The structuring factor is calculated based on the fitness factor and the membership factor, which structures the individuals in the subpopulation into a structural tree.(viii)
Step 8 and Step 9. Multiple structural trees evolve collaboratively with each other through the mutation and crossover strategies.(ix)
Step 10 and Step 11. After evaluation and selection, the dominant individuals are retained to the next generation.(x)
Step 12, Step 13, and Step 14. After several iterations, the individual with maximum fitness will be identified as the best individual. Subsequently, the best individual will be decoded into the corresponding feature set.Figure 2
The overall structure of DIAMOND in SDN-IoT.As described above, we use binary coding to translate the original SDN-IoT network feature set to the individual used in DIAMOND. We assume that the original feature setxi includes d-dimensional gene sequences. Hence, we set d-dimensional gene sequences as follows:
(1)xi=xi,1,xi,2,⋯,xi,d.xi is an individual, which presents a network feature set of SDN-IoT. When gene xi,j=1, it means j-numbered feature is selected. Conversely, when gene xi,j=0, it means j-numbered feature is not selected.


### 3.3. BONNET: Reachable Count Sorting Clustering Algorithm

In SDN-IoT, the subset SDN-IoT network features are encoded as binary individuals. The initialized individuals are defined as data points that are distributed in the solution spaceℝn. When individuals share the same or similar SDN-IoT network features, the distribution of these data points in the solution space is relatively aggregated. Then, when individuals distributed in the solution space are clustered into a subpopulation, it means that SDN-IoT network features in individuals are related to the solution closest to the subpopulation. Therefore, we divide the individuals into several subpopulations in order to extract information about SDN-IoT network features in subpopulations and explore the relationship between SDN-IoT network features and optimal solutions. As a result, we design a reachable count sorting clustering algorithm (BONNET) to divide the population into several subpopulations. In BONNET, the following definition is proposed:
(1)
A data pointxi,ϵ is defined as a reachable point, which is within the hypersphere region with a certain data point xi. Here, xi is defined as the center of the sphere, and the length ϵ is recognized as the radius of the neighborhood(2)
A subpopulation centrosomeҡ is defined as an individual located at the center of the subpopulation ҠFurther, the distance distribution between individuals in the population is denoted asSs=si∣i∈NN−1/2. Subsequently, ϵ=μ−3σ means neighborhood radius of S, μ means the mean value of S, andσ stands for the variance of S.We measure the distribution density of the population in terms of the number of times each individual is utilized as a reachable point. Hence,xi∗ is defined as the number of times that xi is utilized as a reachable point. Then, Fxi∗ means the set of descending order of xi∗, and Mxi∗ stands for obtaining the corresponding individual. Further, the initial queue Qx is defined as follows, where xi∗ of the individuals decreases sequentially.
(2)xi=Mxi∗,(3)Qx=x1,x2,⋯,xNxi∗>xi+1∗.Subsequently, the individualxi is selected as the subpopulation centrosome ҡi~ which is removed from Qx in turn, and the reachable points within the neighborhood radius ϵ of the individual ҡi~ are formed as a subpopulation {ҡi~}. Then, the reachable points of ҡi~ are removed from Qx. Finally, {ҡi~} is joined to the subpopulation queue ҡҡ~. As shown in Equation (4), c is the number of subpopulations.
(4)ҡҡ=ҡ1~,ҡ2~,⋯,ҡc~∣ҡi~∩ҡj~∩Qx=Ø.An example is shown in Figure3, where x1∗=3, x2∗=2. When x1 is removed from the initial queue and denoted the subpopulation centrosome ҡ~1, the reachable points x3, x4, and x5 in x1,ϵ are joined to the subpopulation ҡ~1. It is worth noting that there are still outliers and smaller subpopulations around the main subpopulations. Therefore, we merge these outliers and smaller subpopulations into the surrounding main subpopulations. Algorithm 1 describes the detailed steps of BONNET.Figure 3
The neighborhood radius of individuals.


### 3.4. Group Structuring Method

In the subpopulations divided by BONNET, individuals are relatively close together, butAlgorithm 1: BONNET.
Input: Population number:N; Individuals: x; Sub-populations number: cOutput: The sub-population:Ҡҡ~Qx,Ҡҡ~,Ss⟵, ϵ=0⟵: the add element operation.xi,ϵ: the reachable points of xi.R: the distance function.T: the function that take out first element.Fxi∗: the set of descending order of xi∗.Mxi∗: the function that obtain the corresponding individual.HҠҡ~,c: the function that get the largest c sub-populations in Ҡҡ~.1 fori<N−1 do2 fori+1<j<N do3Ss⟵Rxi,xj4 end for5 end for6μ,σ=S¯,varS7ϵ=μ−3σ8 fori<N do9xi∗ =010 foreachsjaboutxi do11 ifsj<ϵ then12xi∗ +=113 end if14 end for15Fxi∗⟵xi∗16 end for17 foreachxi∗ do18xi=Mxi∗19Qx⟵xi20 whileQx≠∅ do21xi=TQx22ҡi~=xi,ҡi~⟵xi,ϵ23Ҡҡ~⟵ҡi~24Qx=Qx−xi,ϵ25 end while26 whilecluster_countҠҡ~>c do27ҡ~min=minҠҡ~,ҡ~main=HҠҡ~,c28ҡ~min,ҡ~cloest=argminRҡ~min,ҡ~main29ҡ~cloest⟵ҡ~min30Ҡҡ~=Ҡҡ~−ҡ~min31 end while32 returnҠҡ~it lacks group coordination during evolution. In order to distinguish the importance of different SDN-IoT network features among common individuals and enable important SDN-IoT network features to provide guidance to individuals in a subpopulation, we propose a group structuring method. During the group structuring, we combine the fitness and membership of the individuals construct the structural tree.(5)ρi=fi∑j=1nfj,(6)γi=1/sj,i2∑k=1n1/sj,k2.As shown in Equation (5), fi stands for the fitness of individual xi, and the fitness factor ρi reflects the guidance ability of the individual xi in the subpopulation. When the individual xi is close to the optimal solution, ρi of xi has a larger value. As shown in Equation (6), sj,i means the distance from the individual xi to the subpopulation centrosome ҡj~. Then, n means the number of individuals in the subpopulation, and the membership factor γi means the degree to which the individual belongs to the subpopulation centrosome ҡ~j. As shown in Figure 4, γi stratifies individuals in the subpopulation {ҡi~} by distance, and there is some genetic similarity between individuals at the same level. However, individuals in the same layer have different ρ values depending on whether they have the SDN-IoT network features associated with the optimal solution.Figure 4
The structural factor of individuals.Generally, the optimal solution is distributed on one side of the subpopulation rather than inside the subpopulation, and individuals close to the optimal solution are provided with greater fitness. Hence, we design fitness factor minus membership factor as a structural factor.(7)ζi=−γi+ρi.As shown in Figure5, the individuals at the same level share an identical degree of membership and gene similarity. The closer an individual is to the optimal solution, the stronger the ability to guide. As a result, the structured factor ζi integrates individual guidance ability and gene similarity. We build a structural tree Li based on the value of ζi in descending order, and the individuals with the same score are sibling nodes. As shown in Equation (8), c is the number of structural trees.
(8)L=L1,L2,⋯,Lc.Figure 5
The structural trees of population.When the structural tree coevolves, the sibling nodes have equivalent evolutionary guidance ability and similar genes. Therefore, only partial individuals of sibling nodes are randomly selected to calculate the fitness to reduce the consumption of computing resources and accelerate the convergence rate.Figure5 shows the diversity of different structural trees. Δf indicates the gradient change of fitness. Δf3>Δf2 indicates that the SDN-IoT network features in the individuals of information h−1 and h layers are more different. Due to the width of the structural tree b is greater than the width of the structural tree a, there are more individuals in the same layer, indicating that the gene pool of the structural tree b is rich in network feature information. In the process of the iterative evolution of the population, when the fitness of an individual in the h layer is greater than the average fitness of the node in the h−1 layer, the individual will transition to the h−1 layer.To evaluate the convergence and stability of the structural tree, we define Equation (9) for the diversity of the structural tree:
(9)β=log∑h=1Hfh−1¯−fh¯f0¯−fh¯w/H−h.As shown in Equation (9), w presents the number of nodes in the h layer, H means the depth of the tree, and fh¯ stands for the average fitness of the nodes in the h layer. When the width of the structural tree and fitness gradient change greatly, the structural tree has stronger diversity.


### 3.5. Comutation Strategy

In DIAMOND, the balance between global search and local optimization is extremely important. Therefore, we design a comutation strategy to guide the evolution of the population. In this strategy, we define the movement trajectory of the subpopulation centrosomeγ, the disturbance factor δ, and the diversity factor β of the population structural tree. It is worth noting that the subpopulation centrosome ҡ~ is characterized as the evolutionary benchmark of the individuals in the subpopulation ҡ~. Therefore, the evolutionary trajectory and evolutionary route of the subpopulation centrosome ҡ~ have important contributions to the evolution of the subpopulation ҡ~. The movement trajectory of the subpopulation centrosome ҡ~ is defined as Equation (10). In Equation (10), γt−1 means the last predictedposition, andҡ~t stands for the current position, and then, for ϕ, we design it as the weight ϕ=ϕ0/e−t. Finally, t is the population generation.
(10)γt=ϕγt−1+1−ϕҡ~t1−ϕt,(11)uig+1=1+βxigγҡ~+χҡbest2γҡ~+χҡbest2+δxig.In Equation (11), uig+1 means that the mutation individual generated by xig. g denotes the g-th generation of the population. γҡ~ stands for the movement trajectory of the subpopulation centrosome ҡ~. χҡbest is designed as the direction of the winning subpopulation. Furthermore, δxig presents the disturbance factor generated by the xig. The comutation strategy ensures global search capability while accelerating convergence.As shown in Figure6, the movement trajectory γҡ~ of the subpopulation centrosome ҡ~ and the winning subpopulation χҡbest guides the search direction for the individual xig. Further, xig projects the direction that is the sum of direction with the subpopulation centrosome movement trajectory γҡ and the winning subpopulation χҡbest. The diversity factor β regulates the evolutionary step length of individual xg. The larger the diversity of the structural tree is, the stronger the overall optimization ability will be, and each individual in the structural tree should be given a larger explore step size. However, the weaker the diversity of the structural tree is, the stronger the local optimization ability will be, and each individual in the structural tree should be given a smaller step size. The disturbance factor ϱxig produced by xig can prevent the population from falling into a locally optimal solution.Figure 6
The comutation strategy.In summary, the mutation individualuig+1 is directed to the direction of the optimal solution, which contains a large amount of network feature information related to the optimal solution. It is worth noting that the SDN-IoT network features related to the optimal solution in uig+1, which carries more information than the SDN-IoT network feature unrelated to the optimal solution. Therefore, in order to reduce redundant features, we retain features closest to the optimal solution according to the network feature information carried by the mutation individual uig+1.
(12)vig+1=ui,jg+1ui,jg+1>u¯ig+1,(13)vig+1=Hvig+1,k,k=randlenvig+1,(14)ui,jg+1=1,ifui,jg+1invig+1,ui,jg+1=0otherwise.As in Equation (12), u¯ig+1 refers to the average amount of information carried by each feature in the mutation individual uig+1. vig+1 is composed of SDN-IoT network features ui,jg+1 whose information content is greater than u¯ig+1, and vig+1 is more closely related to the SDN-IoT network features of the optimal solution. Further, k features with the largest information value in vig+1 are selected through Hvig+1,k. As in Equation (14), if the network feature ui,jg+1 is in vig+1, then ui,jg+1=1. Otherwise, ui,jg+1=0. This method can retain important SDN-IoT network features and filter out redundant SDN-IoT network features.


### 3.6. Cocrossover Strategy

We propose a cocrossover strategy to facilitate information exchange between different structural trees. The cocrossover strategy includes a crossover strategy between multiple subpopulations and a crossover strategy for structural trees within a subpopulation. As shown in Equations (15) and (16), wg is a crossover intermediate set that contains all individuals generated by the crossover operation.
(1)
As shown in Equation (15), individuals at the same level in multiple structural trees are randomly selected for exchange. For instance, individual xk and individual xm are randomly selected from the h-th level individuals of structural tree Li and Lj for exchange, which can increase the information interaction between subpopulations and avoid falling into local optimum(15)wg⟵xk,xm∣xk↔xm,xk∈Lih,xm∈Ljh(2)
Individuals at theh−1 layer and h layer of the structural tree Li are randomly selected for single-point crossover. For instance, the k-th gene of the xi individual is exchanged with the allele of the xj individual(16)wg⟵xi,xj∣xi,k↔xj,k,xi∈Lih−1,xj∈Lih


### 3.7. Detailed Design of DIAMOND

The IoT devices may include cameras, smartwatches, smartphones, various activity sensors, smart speakers, and so on. These IoT devices are connected to SDN switches, which are the endpoints of the service provider’s network [15].In SDN-IoT, the LDDoS detection method needs to highly adaptively, fast, and accurately detect LDDoS. Hence, in DIAMOND, the AUC of detector performance, detection time (time), accuracy (ACC), and feature dimensions (DIM) are considered as the optimization objective, which is defined as follows:(17)Fx=AUC2+ACC2−time2+DIM2.Each individual within the population has its binary coded genotype. In Equation (18), g is the number of iterations. N is the population number. d is the feature dimension.
(18)xig=xi,1,xi,2,⋯,xi,d,xi,j∈1,0,i∈1,N.After encoding the individuals, DIAMOND executes BONNET and group structuring method using Equations (2)–(8). Then, the comutation strategy is executed through Equations (11)–(14), and the cocrossover strategy is executed through Equations (15) and (16). In addition, by comparing the corresponding advantages and disadvantages of the new generation of the individual with the contemporary population, individuals who are more suitable for survival are selected as the new generations. As shown in Algorithm 2, individuals are encoded in lines 1~4. BONNET and group structuring in lines 6 and 7. The comutation strategy in lines 7~11. The cocrossover strategy and optimal individuals selecting strategy are implemented in lines 12~20.Algorithm 2: DIAMOND.
Input: Network feature:f; Population Number: N; Feature Dimension: d; Iterations Number: G;Output: The best individual and best fitness:△, F△1 fori<N do2xig=codingf3 CalculateFxig4 end for5△=xig6 Execute BONNET7 Execute group structuring6 forg≤G do7 Updateβ using Eq. 98 Updateγҡ~ using Eq. 109 fori≤N do10 Execute mutation using Eq. 11–1411 end for12 fori≤N do13 Execute crossover using Eq. 15–1614 ifFwig>Fxig then15xig=wig16 ifFwig>F△ then17△=xig18 end if19 end if20 end for21g=g+122 end for23 return△, F△The flow features are shown in Table2. These features are extracted and calculated for each flow. Here, a flow is defined as traffic with the same source/destination MAC/IP address and the same source/destination port number.Table 2
The flow features.
FeatureDescriptionBand_ratioThe bandwidth ratio occupied by the flowByte_asymThe convective byte asymmetry rate of a flowByte_countThe total number of bytes in the flowByte_rateThe byte growth rate of a flowByte_pktThe average number of bytes of a packet in a flowDurationThe duration of floweth_typeThe Ethernet type of the flowdst_host_srv_diff_host_ratioThe percentage of connections with different source hosts in the same service and the same target hostsrc_byte_ratioThe percentage of the number of bytes transferred by the current connection in that of bytes transferred by the same source host connectionsrv_diff_host_ratioThe percentage of connection number of different target hosts in that of the same serviceByte_asym_interThe convective byte asymmetry rate in the cycleInputThe entering portdst_ipThe serial number of destination IPsrc_ipThe serial number of source IPpkt_count_interThe total number of packets of flow in the cycleOutputThe forwarding portPacket_countThe total number of packets in the flowpkt_asymThe convective packet asymmetry ratePacket_rateThe packet growth ratePriorityThe flow prioritySame_dst_countThe total number of same destination IP connectionssrc_pkt_ratioThe percentage of the number packets in packets of same source host connectionSame_src_countThe total number of same source IP connectionspkt_asym_interThe convective packet asymmetry rate in the cycleSame_srv_ratioThe percentage of connections that have the same target hosts and the same services as the current connectionbyt_count_interThe total number of bytes in the flow in the cyclediff_srv_ratioThe percentage that connects different services in which is the connection of the same target hostsByte_pkt_interThe average number of bytes of a packet in the cycleByte_rate_interThe growth rate of the byte in the cyclepkt_rate_interThe growth rate of the packet in the cyclesrc_port_countThe total number of same source port connectionsdst_port_countThe total number of same destination port connectionsip_protoThe protocol typetcp_srcThe serial number of source TCPtcp_dstThe serial number of destination TCPudp_srcThe serial number of source UDPudp_dstThe serial number of destination UDP


## 3.1. Motivation

As a result of the rapid increase in the number of mobile-connected devices such as smartphones and tablets, SDN-IoT is attracting more and more attention from industry and academia. Therefore, the security of SDN-IoT becomes a serious issue [14]. Feature selection methods for network attack detection methods have been a hot research topic among researchers in recent years. However, the existing feature selection methods have some limitations such as follows:
(1)
Existing EA-based feature optimization methods usually evolve individuals in a population, leading to the loss of diversity when evolving individuals(2)
The existing methods do not consider the coevolution of similar individuals during evolution, which leads to the reduction of convergence ratioExisting feature selection methods all have the common limitations of high model complexity and the tendency to fall into local optimal solutions. Therefore, in order to solve these problems, this work enables multiple subpopulations to coevolve and makes subpopulations into ordered populations. In this way, multiple subpopulations can tract each other to avoid falling into local optimal solutions. At the same time, individuals within subpopulations are clearly distinguished to reduce the consumption of computational resources.


## 3.2. Overall Structure

Figure2 shows the overall structure of DIAMOND in SDN-IoT. DIAMOND is deployed on the SDN controller and collects network traffic by sending collect traffic instructions to the switch. Generally, DIAMOND includes the following steps:
(i)
Step 1. DIAMOND sends the instruction to collect network traffic information.(ii)
Step 2. Once the SDN controller receives the instruction, it sends OFPT_STATS_REQUEST messages to the switches to get the statistics of flow entries.(iii)
Step 3. The switches will reply OFPT_STATS_REPLY messages to the SDN controller. These messages contain the stream data in the flow entries of the switches.(iv)
Step 4. After the controller receives the OFPT_STATS_REPLY messages, it deencapsulates these messages and sends the collected statistic data to DIAMOND.(v)
Step 5. In DIAMOND, the statistic data of flow entries collected from switches are used to calculate the initial SDN-IoT network features. Subsequently, these features will be coded using the binary coding method to generate the initial population that is consisted of some individuals.(vi)
Step 6. The population is divided into several subpopulations by BONNET.(vii)
Step 7. The structuring factor is calculated based on the fitness factor and the membership factor, which structures the individuals in the subpopulation into a structural tree.(viii)
Step 8 and Step 9. Multiple structural trees evolve collaboratively with each other through the mutation and crossover strategies.(ix)
Step 10 and Step 11. After evaluation and selection, the dominant individuals are retained to the next generation.(x)
Step 12, Step 13, and Step 14. After several iterations, the individual with maximum fitness will be identified as the best individual. Subsequently, the best individual will be decoded into the corresponding feature set.Figure 2
The overall structure of DIAMOND in SDN-IoT.As described above, we use binary coding to translate the original SDN-IoT network feature set to the individual used in DIAMOND. We assume that the original feature setxi includes d-dimensional gene sequences. Hence, we set d-dimensional gene sequences as follows:
(1)xi=xi,1,xi,2,⋯,xi,d.xi is an individual, which presents a network feature set of SDN-IoT. When gene xi,j=1, it means j-numbered feature is selected. Conversely, when gene xi,j=0, it means j-numbered feature is not selected.


## 3.3. BONNET: Reachable Count Sorting Clustering Algorithm

In SDN-IoT, the subset SDN-IoT network features are encoded as binary individuals. The initialized individuals are defined as data points that are distributed in the solution spaceℝn. When individuals share the same or similar SDN-IoT network features, the distribution of these data points in the solution space is relatively aggregated. Then, when individuals distributed in the solution space are clustered into a subpopulation, it means that SDN-IoT network features in individuals are related to the solution closest to the subpopulation. Therefore, we divide the individuals into several subpopulations in order to extract information about SDN-IoT network features in subpopulations and explore the relationship between SDN-IoT network features and optimal solutions. As a result, we design a reachable count sorting clustering algorithm (BONNET) to divide the population into several subpopulations. In BONNET, the following definition is proposed:
(1)
A data pointxi,ϵ is defined as a reachable point, which is within the hypersphere region with a certain data point xi. Here, xi is defined as the center of the sphere, and the length ϵ is recognized as the radius of the neighborhood(2)
A subpopulation centrosomeҡ is defined as an individual located at the center of the subpopulation ҠFurther, the distance distribution between individuals in the population is denoted asSs=si∣i∈NN−1/2. Subsequently, ϵ=μ−3σ means neighborhood radius of S, μ means the mean value of S, andσ stands for the variance of S.We measure the distribution density of the population in terms of the number of times each individual is utilized as a reachable point. Hence,xi∗ is defined as the number of times that xi is utilized as a reachable point. Then, Fxi∗ means the set of descending order of xi∗, and Mxi∗ stands for obtaining the corresponding individual. Further, the initial queue Qx is defined as follows, where xi∗ of the individuals decreases sequentially.
(2)xi=Mxi∗,(3)Qx=x1,x2,⋯,xNxi∗>xi+1∗.Subsequently, the individualxi is selected as the subpopulation centrosome ҡi~ which is removed from Qx in turn, and the reachable points within the neighborhood radius ϵ of the individual ҡi~ are formed as a subpopulation {ҡi~}. Then, the reachable points of ҡi~ are removed from Qx. Finally, {ҡi~} is joined to the subpopulation queue ҡҡ~. As shown in Equation (4), c is the number of subpopulations.
(4)ҡҡ=ҡ1~,ҡ2~,⋯,ҡc~∣ҡi~∩ҡj~∩Qx=Ø.An example is shown in Figure3, where x1∗=3, x2∗=2. When x1 is removed from the initial queue and denoted the subpopulation centrosome ҡ~1, the reachable points x3, x4, and x5 in x1,ϵ are joined to the subpopulation ҡ~1. It is worth noting that there are still outliers and smaller subpopulations around the main subpopulations. Therefore, we merge these outliers and smaller subpopulations into the surrounding main subpopulations. Algorithm 1 describes the detailed steps of BONNET.Figure 3
The neighborhood radius of individuals.


## 3.4. Group Structuring Method

In the subpopulations divided by BONNET, individuals are relatively close together, butAlgorithm 1: BONNET.
Input: Population number:N; Individuals: x; Sub-populations number: cOutput: The sub-population:Ҡҡ~Qx,Ҡҡ~,Ss⟵, ϵ=0⟵: the add element operation.xi,ϵ: the reachable points of xi.R: the distance function.T: the function that take out first element.Fxi∗: the set of descending order of xi∗.Mxi∗: the function that obtain the corresponding individual.HҠҡ~,c: the function that get the largest c sub-populations in Ҡҡ~.1 fori<N−1 do2 fori+1<j<N do3Ss⟵Rxi,xj4 end for5 end for6μ,σ=S¯,varS7ϵ=μ−3σ8 fori<N do9xi∗ =010 foreachsjaboutxi do11 ifsj<ϵ then12xi∗ +=113 end if14 end for15Fxi∗⟵xi∗16 end for17 foreachxi∗ do18xi=Mxi∗19Qx⟵xi20 whileQx≠∅ do21xi=TQx22ҡi~=xi,ҡi~⟵xi,ϵ23Ҡҡ~⟵ҡi~24Qx=Qx−xi,ϵ25 end while26 whilecluster_countҠҡ~>c do27ҡ~min=minҠҡ~,ҡ~main=HҠҡ~,c28ҡ~min,ҡ~cloest=argminRҡ~min,ҡ~main29ҡ~cloest⟵ҡ~min30Ҡҡ~=Ҡҡ~−ҡ~min31 end while32 returnҠҡ~it lacks group coordination during evolution. In order to distinguish the importance of different SDN-IoT network features among common individuals and enable important SDN-IoT network features to provide guidance to individuals in a subpopulation, we propose a group structuring method. During the group structuring, we combine the fitness and membership of the individuals construct the structural tree.(5)ρi=fi∑j=1nfj,(6)γi=1/sj,i2∑k=1n1/sj,k2.As shown in Equation (5), fi stands for the fitness of individual xi, and the fitness factor ρi reflects the guidance ability of the individual xi in the subpopulation. When the individual xi is close to the optimal solution, ρi of xi has a larger value. As shown in Equation (6), sj,i means the distance from the individual xi to the subpopulation centrosome ҡj~. Then, n means the number of individuals in the subpopulation, and the membership factor γi means the degree to which the individual belongs to the subpopulation centrosome ҡ~j. As shown in Figure 4, γi stratifies individuals in the subpopulation {ҡi~} by distance, and there is some genetic similarity between individuals at the same level. However, individuals in the same layer have different ρ values depending on whether they have the SDN-IoT network features associated with the optimal solution.Figure 4
The structural factor of individuals.Generally, the optimal solution is distributed on one side of the subpopulation rather than inside the subpopulation, and individuals close to the optimal solution are provided with greater fitness. Hence, we design fitness factor minus membership factor as a structural factor.(7)ζi=−γi+ρi.As shown in Figure5, the individuals at the same level share an identical degree of membership and gene similarity. The closer an individual is to the optimal solution, the stronger the ability to guide. As a result, the structured factor ζi integrates individual guidance ability and gene similarity. We build a structural tree Li based on the value of ζi in descending order, and the individuals with the same score are sibling nodes. As shown in Equation (8), c is the number of structural trees.
(8)L=L1,L2,⋯,Lc.Figure 5
The structural trees of population.When the structural tree coevolves, the sibling nodes have equivalent evolutionary guidance ability and similar genes. Therefore, only partial individuals of sibling nodes are randomly selected to calculate the fitness to reduce the consumption of computing resources and accelerate the convergence rate.Figure5 shows the diversity of different structural trees. Δf indicates the gradient change of fitness. Δf3>Δf2 indicates that the SDN-IoT network features in the individuals of information h−1 and h layers are more different. Due to the width of the structural tree b is greater than the width of the structural tree a, there are more individuals in the same layer, indicating that the gene pool of the structural tree b is rich in network feature information. In the process of the iterative evolution of the population, when the fitness of an individual in the h layer is greater than the average fitness of the node in the h−1 layer, the individual will transition to the h−1 layer.To evaluate the convergence and stability of the structural tree, we define Equation (9) for the diversity of the structural tree:
(9)β=log∑h=1Hfh−1¯−fh¯f0¯−fh¯w/H−h.As shown in Equation (9), w presents the number of nodes in the h layer, H means the depth of the tree, and fh¯ stands for the average fitness of the nodes in the h layer. When the width of the structural tree and fitness gradient change greatly, the structural tree has stronger diversity.


## 3.5. Comutation Strategy

In DIAMOND, the balance between global search and local optimization is extremely important. Therefore, we design a comutation strategy to guide the evolution of the population. In this strategy, we define the movement trajectory of the subpopulation centrosomeγ, the disturbance factor δ, and the diversity factor β of the population structural tree. It is worth noting that the subpopulation centrosome ҡ~ is characterized as the evolutionary benchmark of the individuals in the subpopulation ҡ~. Therefore, the evolutionary trajectory and evolutionary route of the subpopulation centrosome ҡ~ have important contributions to the evolution of the subpopulation ҡ~. The movement trajectory of the subpopulation centrosome ҡ~ is defined as Equation (10). In Equation (10), γt−1 means the last predictedposition, andҡ~t stands for the current position, and then, for ϕ, we design it as the weight ϕ=ϕ0/e−t. Finally, t is the population generation.
(10)γt=ϕγt−1+1−ϕҡ~t1−ϕt,(11)uig+1=1+βxigγҡ~+χҡbest2γҡ~+χҡbest2+δxig.In Equation (11), uig+1 means that the mutation individual generated by xig. g denotes the g-th generation of the population. γҡ~ stands for the movement trajectory of the subpopulation centrosome ҡ~. χҡbest is designed as the direction of the winning subpopulation. Furthermore, δxig presents the disturbance factor generated by the xig. The comutation strategy ensures global search capability while accelerating convergence.As shown in Figure6, the movement trajectory γҡ~ of the subpopulation centrosome ҡ~ and the winning subpopulation χҡbest guides the search direction for the individual xig. Further, xig projects the direction that is the sum of direction with the subpopulation centrosome movement trajectory γҡ and the winning subpopulation χҡbest. The diversity factor β regulates the evolutionary step length of individual xg. The larger the diversity of the structural tree is, the stronger the overall optimization ability will be, and each individual in the structural tree should be given a larger explore step size. However, the weaker the diversity of the structural tree is, the stronger the local optimization ability will be, and each individual in the structural tree should be given a smaller step size. The disturbance factor ϱxig produced by xig can prevent the population from falling into a locally optimal solution.Figure 6
The comutation strategy.In summary, the mutation individualuig+1 is directed to the direction of the optimal solution, which contains a large amount of network feature information related to the optimal solution. It is worth noting that the SDN-IoT network features related to the optimal solution in uig+1, which carries more information than the SDN-IoT network feature unrelated to the optimal solution. Therefore, in order to reduce redundant features, we retain features closest to the optimal solution according to the network feature information carried by the mutation individual uig+1.
(12)vig+1=ui,jg+1ui,jg+1>u¯ig+1,(13)vig+1=Hvig+1,k,k=randlenvig+1,(14)ui,jg+1=1,ifui,jg+1invig+1,ui,jg+1=0otherwise.As in Equation (12), u¯ig+1 refers to the average amount of information carried by each feature in the mutation individual uig+1. vig+1 is composed of SDN-IoT network features ui,jg+1 whose information content is greater than u¯ig+1, and vig+1 is more closely related to the SDN-IoT network features of the optimal solution. Further, k features with the largest information value in vig+1 are selected through Hvig+1,k. As in Equation (14), if the network feature ui,jg+1 is in vig+1, then ui,jg+1=1. Otherwise, ui,jg+1=0. This method can retain important SDN-IoT network features and filter out redundant SDN-IoT network features.


## 3.6. Cocrossover Strategy

We propose a cocrossover strategy to facilitate information exchange between different structural trees. The cocrossover strategy includes a crossover strategy between multiple subpopulations and a crossover strategy for structural trees within a subpopulation. As shown in Equations (15) and (16), wg is a crossover intermediate set that contains all individuals generated by the crossover operation.
(1)
As shown in Equation (15), individuals at the same level in multiple structural trees are randomly selected for exchange. For instance, individual xk and individual xm are randomly selected from the h-th level individuals of structural tree Li and Lj for exchange, which can increase the information interaction between subpopulations and avoid falling into local optimum(15)wg⟵xk,xm∣xk↔xm,xk∈Lih,xm∈Ljh(2)
Individuals at theh−1 layer and h layer of the structural tree Li are randomly selected for single-point crossover. For instance, the k-th gene of the xi individual is exchanged with the allele of the xj individual(16)wg⟵xi,xj∣xi,k↔xj,k,xi∈Lih−1,xj∈Lih


## 3.7. Detailed Design of DIAMOND

The IoT devices may include cameras, smartwatches, smartphones, various activity sensors, smart speakers, and so on. These IoT devices are connected to SDN switches, which are the endpoints of the service provider’s network [15].In SDN-IoT, the LDDoS detection method needs to highly adaptively, fast, and accurately detect LDDoS. Hence, in DIAMOND, the AUC of detector performance, detection time (time), accuracy (ACC), and feature dimensions (DIM) are considered as the optimization objective, which is defined as follows:(17)Fx=AUC2+ACC2−time2+DIM2.Each individual within the population has its binary coded genotype. In Equation (18), g is the number of iterations. N is the population number. d is the feature dimension.
(18)xig=xi,1,xi,2,⋯,xi,d,xi,j∈1,0,i∈1,N.After encoding the individuals, DIAMOND executes BONNET and group structuring method using Equations (2)–(8). Then, the comutation strategy is executed through Equations (11)–(14), and the cocrossover strategy is executed through Equations (15) and (16). In addition, by comparing the corresponding advantages and disadvantages of the new generation of the individual with the contemporary population, individuals who are more suitable for survival are selected as the new generations. As shown in Algorithm 2, individuals are encoded in lines 1~4. BONNET and group structuring in lines 6 and 7. The comutation strategy in lines 7~11. The cocrossover strategy and optimal individuals selecting strategy are implemented in lines 12~20.Algorithm 2: DIAMOND.
Input: Network feature:f; Population Number: N; Feature Dimension: d; Iterations Number: G;Output: The best individual and best fitness:△, F△1 fori<N do2xig=codingf3 CalculateFxig4 end for5△=xig6 Execute BONNET7 Execute group structuring6 forg≤G do7 Updateβ using Eq. 98 Updateγҡ~ using Eq. 109 fori≤N do10 Execute mutation using Eq. 11–1411 end for12 fori≤N do13 Execute crossover using Eq. 15–1614 ifFwig>Fxig then15xig=wig16 ifFwig>F△ then17△=xig18 end if19 end if20 end for21g=g+122 end for23 return△, F△The flow features are shown in Table2. These features are extracted and calculated for each flow. Here, a flow is defined as traffic with the same source/destination MAC/IP address and the same source/destination port number.Table 2
The flow features.
FeatureDescriptionBand_ratioThe bandwidth ratio occupied by the flowByte_asymThe convective byte asymmetry rate of a flowByte_countThe total number of bytes in the flowByte_rateThe byte growth rate of a flowByte_pktThe average number of bytes of a packet in a flowDurationThe duration of floweth_typeThe Ethernet type of the flowdst_host_srv_diff_host_ratioThe percentage of connections with different source hosts in the same service and the same target hostsrc_byte_ratioThe percentage of the number of bytes transferred by the current connection in that of bytes transferred by the same source host connectionsrv_diff_host_ratioThe percentage of connection number of different target hosts in that of the same serviceByte_asym_interThe convective byte asymmetry rate in the cycleInputThe entering portdst_ipThe serial number of destination IPsrc_ipThe serial number of source IPpkt_count_interThe total number of packets of flow in the cycleOutputThe forwarding portPacket_countThe total number of packets in the flowpkt_asymThe convective packet asymmetry ratePacket_rateThe packet growth ratePriorityThe flow prioritySame_dst_countThe total number of same destination IP connectionssrc_pkt_ratioThe percentage of the number packets in packets of same source host connectionSame_src_countThe total number of same source IP connectionspkt_asym_interThe convective packet asymmetry rate in the cycleSame_srv_ratioThe percentage of connections that have the same target hosts and the same services as the current connectionbyt_count_interThe total number of bytes in the flow in the cyclediff_srv_ratioThe percentage that connects different services in which is the connection of the same target hostsByte_pkt_interThe average number of bytes of a packet in the cycleByte_rate_interThe growth rate of the byte in the cyclepkt_rate_interThe growth rate of the packet in the cyclesrc_port_countThe total number of same source port connectionsdst_port_countThe total number of same destination port connectionsip_protoThe protocol typetcp_srcThe serial number of source TCPtcp_dstThe serial number of destination TCPudp_srcThe serial number of source UDPudp_dstThe serial number of destination UDP


## 4. Experimental Design and Result Analysis

### 4.1. Experiment Environment

To verify the logic of the program and evaluate its performance, DIAMOND is implemented on the RYU controller. In this work, Mininet-wifi implements the communication between IoT devices and access points (APs), using WiFi as the communication protocol between them. As shown in Figure7, Mininet-wifi is utilized to simulate an SDN-IoT network that consists of eighty IoT endnotes, eight access points, and eight links, as previous work in [16]. The background traffic is to simulate the traffic environment of the IoT in the campus, which includes 40% HTTPS, 10% HTTP, 10% TCP, 10% SSDP, 5% DNS, and 5% NTP [17]. Specifically, the traffic is generated by applications on some IoT devices that require latency and low latency jitter, such as IP telephony and video conferencing. Further, the attack traffic consists of traffic generated by 20 IoT endnotes to launch LDDoS attacks against IoT servers. The attackers, victims, and service requests are all randomly generated. At the same time, the attack traffic accounts for 20% of normal traffic.Figure 7
The experimental topology in SDN-IoT.Further, in order to verify the detection ability of the optimized feature subset, eight different classifiers including support vector machine (SVM), K-Nearest Neighbor (KNN), Naïve Bayes (NB), Logistic Regress (LR), decision tree (DT), C4.5, Random Forest (RF), and AdaBoost (AB) have been applied to evaluate the feature optimization methods. In addition, DIAMOND is compared with other related state-of-the-art algorithms, which are BDIE [18] and BGDE3 [19]. As shown in Table 3, it describes the initial parameter settings in the DIAMOND.Table 3
Initial parameter settings in the DIAMOND.
Parm.ValueDescriptionG50The number of iterationsN100The number of populationsc3The number of subpopulationsϕ00.5The weight of movement trajectory


### 4.2. Fitness Curve

Figure8 shows the fitness curve of DIAMOND in the first 50 iterations. DIAMOND_FA, DIAMOND_FB, and DIAMOND_FL, respectively, represent the average fitness value, the best fitness value, and the lowest fitness value of DIAMOND. According to Figure 8, it can beFigure 8
Fitness curve in DIAMOND: (a) SVM, (b) KNN, (c) NB, (d) LR, (e) DT, (f) C4.5, (g) RF, and (h) AB.
(a)(b)(c)(d)(e)(f)(g)(h)seen that after several iterations, the average fitness DIAMOND_FA steadily increases and reaches high values in all cases. At the early stage of evolution, the difference between the values of DIAMOND_FA, DIAMOND_FB, and DIAMOND_FL is small because they have not yet found the optimal solution set. In the middle of evolution, the difference between the values of DIAMOND_FB and DIAMOND_FL becomes larger because they have calculated different sets of solutions. At the later stage, almost all the values of DIAMOND_FB and DIAMOND_FL converge again, indicating that they have found out the optimal solution set.


### 4.3. Convergence Performance

Figure9 exposes the convergence curve of DIAMOND. DIAMOND_1-3, respectively, stand for the convergence value of DIAMOND in 3 runs. DIAMOND_FA is the average convergence value of DIAMOND in 3 runs. DIAMOND_FA is the average convergence value. The convergence values of DIAMOND converge rapidly in the first half but gradually stabilize in the second half. The convergence value of DIAMOND decreases rapidly before 20 generations, while it stabilizes and decreases slowly after 20 generations. This indicates that the strong global search ability of DIAMOND leads to the exploration of an excellent solution set before 20 generations. Therefore, the population can converge to the outstanding individual quickly. Then, after 20 generations of iteration, DIAMOND performs an exact local exploration on the outstanding set of solutions that have been explored.Figure 9
Convergence curve.


### 4.4. Dimension Reduction Ratio

Figure10 shows the dimension reduction ratio of DIAMOND using eight classifiers, respectively. From Figure 10, it can be seen that the highest feature reduction ratio was 94.78%. Further, we compared the average feature reduction ratio of DIAMOND with BDIE and BGDE3. As shown in Figure 11, the average feature reduction ratio of BDIE, BGDE3, and DIAMOND are 91.67%, 48.72%, and 56.09%, respectively. The dimension reduction ratio indicates that applying DIAMOND in the actual SDN-IoT environment can effectively reduce the computational resource consumption of SDN controllers subject to LDDoS attacks.Figure 10
Dimension reduction ratio.Figure 11
Average dimension reduction ratio.


### 4.5. Detection Performance

Table4 shows the detection performance of different classifiers when using DIAMOND, BDIE, and BGDE3. AVG and STD represent the average detection performance and standard deviation of the algorithm, respectively. If the AVG values of the algorithms are equal, the algorithm with a smaller STD value is better. Besides, bold values in the table indicate the best value. The main purpose of Table 4 is to verify the robustness of the proposed algorithm on different classifiers. Obviously, DIAMOND performs better than BDIE and BGDE3 in most cases. It means that the features selected by the DIAMOND contain the key classification information. For instance, the average accuracy of DIAMOND is 92.30%, which is higher than 89.11% of BEID and 85.88% of BGDE3. In addition, all STD of DIAMOND is quite better than BDIE and BGDE3, which means that DIAMOND is more stable.Table 4
The detection performance comparison.
Algo.SVMKNNNBLRDTC4.5RFABAVGSTDAccuracyDIAMOND91.3894.3593.6389.7390.5591.3893.7493.6392.301.63BDIE89.2290.7688.3089.1290.3591.1784.3989.5389.111.99BGDE385.7384.9188.1982.0389.3276.6981.9389.5385.884.38PrecisionDIAMOND90.6692.6590.9890.9591.3592.2990.9992.1691.500.70BDIE90.4790.8385.6190.5992.4593.1485.0790.6589.852.76BGDE391.0686.9689.7788.6291.8885.6389.0490.5289.552.16RecallDIAMOND95.5998.4799.3292.1993.2193.5599.4997.7996.202.75BDIE91.8594.2396.9491.5191.5192.1989.9892.1992.551.99BGDE384.7288.2990.8380.6590.3273.8579.9792.3686.726.19F-scoreDIAMOND93.0695.4794.9791.5792.2792.9295.0594.8993.781.39BDIE91.1592.5090.9291.0591.9892.6687.4691.4191.141.52BGDE387.7787.6290.3084.4491.1079.3184.3691.4388.044.09AUCDIAMOND92.9396.6191.2691.7796.9694.9897.2997.0894.862.36BDIE90.9491.6390.6191.0590.0490.9090.6595.1791.371.50BGDE391.4985.7987.9685.8992.0777.5889.3696.5089.245.93FPRDIAMOND15.0611.9515.0614.0313.5111.9515.0612.7313.671.26BDIE14.8114.5524.9414.5511.4310.3924.1614.5516.175.08BGDE312.7320.2615.8415.8412.2118.9615.0614.8115.392.80FNRDIAMOND4.411.530.687.816.796.450.512.213.802.75BDIE8.155.773.068.498.497.8110.027.817.451.99BGDE315.2811.719.1719.359.6826.1520.037.6413.296.19


### 4.6. Detection Time

To evaluate the performance of DIAMOND in terms of detection time, the detection time is calculated in this evaluation. Table5 describes the detection time of eight classifiers when using the BDIE, BGDE3, and DIAMOND. The detection efficiency of DIAMOND is quite better than that of BDIE and BGDE3. For instance, when using SVM, the detection time of DIAMOND is 106.72 ms, which is lower than 174.50 ms of BDIE and 164.59 ms of BGDE3. The detection time of DIAMOND is decreased by 39%, 35% compared to BDIE and BGDE3.Table 5
The classification detection time (ms) comparison.
Algo.SVMKNNNBLRDTC4.5RFABDIAMOND106.7226.930.994.991.981.9913.96146.61BDIE174.5045.851.0012.961.991.9915.96187.50BGDE3164.5965.802.0016.952.993.9913.99162.56


## 4.1. Experiment Environment

To verify the logic of the program and evaluate its performance, DIAMOND is implemented on the RYU controller. In this work, Mininet-wifi implements the communication between IoT devices and access points (APs), using WiFi as the communication protocol between them. As shown in Figure7, Mininet-wifi is utilized to simulate an SDN-IoT network that consists of eighty IoT endnotes, eight access points, and eight links, as previous work in [16]. The background traffic is to simulate the traffic environment of the IoT in the campus, which includes 40% HTTPS, 10% HTTP, 10% TCP, 10% SSDP, 5% DNS, and 5% NTP [17]. Specifically, the traffic is generated by applications on some IoT devices that require latency and low latency jitter, such as IP telephony and video conferencing. Further, the attack traffic consists of traffic generated by 20 IoT endnotes to launch LDDoS attacks against IoT servers. The attackers, victims, and service requests are all randomly generated. At the same time, the attack traffic accounts for 20% of normal traffic.Figure 7
The experimental topology in SDN-IoT.Further, in order to verify the detection ability of the optimized feature subset, eight different classifiers including support vector machine (SVM), K-Nearest Neighbor (KNN), Naïve Bayes (NB), Logistic Regress (LR), decision tree (DT), C4.5, Random Forest (RF), and AdaBoost (AB) have been applied to evaluate the feature optimization methods. In addition, DIAMOND is compared with other related state-of-the-art algorithms, which are BDIE [18] and BGDE3 [19]. As shown in Table 3, it describes the initial parameter settings in the DIAMOND.Table 3
Initial parameter settings in the DIAMOND.
Parm.ValueDescriptionG50The number of iterationsN100The number of populationsc3The number of subpopulationsϕ00.5The weight of movement trajectory


## 4.2. Fitness Curve

Figure8 shows the fitness curve of DIAMOND in the first 50 iterations. DIAMOND_FA, DIAMOND_FB, and DIAMOND_FL, respectively, represent the average fitness value, the best fitness value, and the lowest fitness value of DIAMOND. According to Figure 8, it can beFigure 8
Fitness curve in DIAMOND: (a) SVM, (b) KNN, (c) NB, (d) LR, (e) DT, (f) C4.5, (g) RF, and (h) AB.
(a)(b)(c)(d)(e)(f)(g)(h)seen that after several iterations, the average fitness DIAMOND_FA steadily increases and reaches high values in all cases. At the early stage of evolution, the difference between the values of DIAMOND_FA, DIAMOND_FB, and DIAMOND_FL is small because they have not yet found the optimal solution set. In the middle of evolution, the difference between the values of DIAMOND_FB and DIAMOND_FL becomes larger because they have calculated different sets of solutions. At the later stage, almost all the values of DIAMOND_FB and DIAMOND_FL converge again, indicating that they have found out the optimal solution set.


## 4.3. Convergence Performance

Figure9 exposes the convergence curve of DIAMOND. DIAMOND_1-3, respectively, stand for the convergence value of DIAMOND in 3 runs. DIAMOND_FA is the average convergence value of DIAMOND in 3 runs. DIAMOND_FA is the average convergence value. The convergence values of DIAMOND converge rapidly in the first half but gradually stabilize in the second half. The convergence value of DIAMOND decreases rapidly before 20 generations, while it stabilizes and decreases slowly after 20 generations. This indicates that the strong global search ability of DIAMOND leads to the exploration of an excellent solution set before 20 generations. Therefore, the population can converge to the outstanding individual quickly. Then, after 20 generations of iteration, DIAMOND performs an exact local exploration on the outstanding set of solutions that have been explored.Figure 9
Convergence curve.


## 4.4. Dimension Reduction Ratio

Figure10 shows the dimension reduction ratio of DIAMOND using eight classifiers, respectively. From Figure 10, it can be seen that the highest feature reduction ratio was 94.78%. Further, we compared the average feature reduction ratio of DIAMOND with BDIE and BGDE3. As shown in Figure 11, the average feature reduction ratio of BDIE, BGDE3, and DIAMOND are 91.67%, 48.72%, and 56.09%, respectively. The dimension reduction ratio indicates that applying DIAMOND in the actual SDN-IoT environment can effectively reduce the computational resource consumption of SDN controllers subject to LDDoS attacks.Figure 10
Dimension reduction ratio.Figure 11
Average dimension reduction ratio.


## 4.5. Detection Performance

Table4 shows the detection performance of different classifiers when using DIAMOND, BDIE, and BGDE3. AVG and STD represent the average detection performance and standard deviation of the algorithm, respectively. If the AVG values of the algorithms are equal, the algorithm with a smaller STD value is better. Besides, bold values in the table indicate the best value. The main purpose of Table 4 is to verify the robustness of the proposed algorithm on different classifiers. Obviously, DIAMOND performs better than BDIE and BGDE3 in most cases. It means that the features selected by the DIAMOND contain the key classification information. For instance, the average accuracy of DIAMOND is 92.30%, which is higher than 89.11% of BEID and 85.88% of BGDE3. In addition, all STD of DIAMOND is quite better than BDIE and BGDE3, which means that DIAMOND is more stable.Table 4
The detection performance comparison.
Algo.SVMKNNNBLRDTC4.5RFABAVGSTDAccuracyDIAMOND91.3894.3593.6389.7390.5591.3893.7493.6392.301.63BDIE89.2290.7688.3089.1290.3591.1784.3989.5389.111.99BGDE385.7384.9188.1982.0389.3276.6981.9389.5385.884.38PrecisionDIAMOND90.6692.6590.9890.9591.3592.2990.9992.1691.500.70BDIE90.4790.8385.6190.5992.4593.1485.0790.6589.852.76BGDE391.0686.9689.7788.6291.8885.6389.0490.5289.552.16RecallDIAMOND95.5998.4799.3292.1993.2193.5599.4997.7996.202.75BDIE91.8594.2396.9491.5191.5192.1989.9892.1992.551.99BGDE384.7288.2990.8380.6590.3273.8579.9792.3686.726.19F-scoreDIAMOND93.0695.4794.9791.5792.2792.9295.0594.8993.781.39BDIE91.1592.5090.9291.0591.9892.6687.4691.4191.141.52BGDE387.7787.6290.3084.4491.1079.3184.3691.4388.044.09AUCDIAMOND92.9396.6191.2691.7796.9694.9897.2997.0894.862.36BDIE90.9491.6390.6191.0590.0490.9090.6595.1791.371.50BGDE391.4985.7987.9685.8992.0777.5889.3696.5089.245.93FPRDIAMOND15.0611.9515.0614.0313.5111.9515.0612.7313.671.26BDIE14.8114.5524.9414.5511.4310.3924.1614.5516.175.08BGDE312.7320.2615.8415.8412.2118.9615.0614.8115.392.80FNRDIAMOND4.411.530.687.816.796.450.512.213.802.75BDIE8.155.773.068.498.497.8110.027.817.451.99BGDE315.2811.719.1719.359.6826.1520.037.6413.296.19


## 4.6. Detection Time

To evaluate the performance of DIAMOND in terms of detection time, the detection time is calculated in this evaluation. Table5 describes the detection time of eight classifiers when using the BDIE, BGDE3, and DIAMOND. The detection efficiency of DIAMOND is quite better than that of BDIE and BGDE3. For instance, when using SVM, the detection time of DIAMOND is 106.72 ms, which is lower than 174.50 ms of BDIE and 164.59 ms of BGDE3. The detection time of DIAMOND is decreased by 39%, 35% compared to BDIE and BGDE3.Table 5
The classification detection time (ms) comparison.
Algo.SVMKNNNBLRDTC4.5RFABDIAMOND106.7226.930.994.991.981.9913.96146.61BDIE174.5045.851.0012.961.991.9915.96187.50BGDE3164.5965.802.0016.952.993.9913.99162.56


## 5. Conclusions

In this paper, we proposed DIAMOND, a structured coevolution feature optimization method for LDDoS detection in SDN-IoT. More specifically, a reachable count sorting clustering algorithm, a group structuring method, a comutation strategy, and a cocrossover strategy are proposed. The evaluation demonstrates that DIAMOND can effectively improve the detection accuracy, reduce the size of feature subsets, and achieve shortened detection time compared with the baseline methods.



---

*Source: 9530274-2021-12-29.xml*