Software Defined Network Assisted Network Anomaly Detection using Graph Neural Network

Abstract

In the modern era, the complexity and scale of the network are increasing rapidly so it is required to do anomaly detection in the network. SDN and GNN have emerged as viable technologies for this purpose, capturing dynamic network behavior and learning complicated patterns from large-scale data. The evaluation of the literature divides network anomalies into classical, SDN-based, GNN-based, and Hybrid detection approaches, demonstrating the limitations of machine learning algorithms and the shift toward deep learning. The GraphSAGE model is used in this work to create an anomaly detection system for the SDN data plane. Despite the fact that SDN separates the control and data planes, the data plane remains vulnerable to anomalies such as DoS attacks. In the dynamic and distributed SDN environment, traditional approaches struggle to detect anomalies accurately. The proposed framework employs GraphSAGE to capture the data plane's graph structure for comprehensive anomaly detection, including DoS attacks and network abnormalities, by comparing the current state with learned patterns.