An Approach to Attack Classification for Programmable Network Infrastructure Using Machine Learning and Deep Learning Solutions

The rapid development of Internet-connected devices has driven the rise of smart cities, where large-scale Internet of Things (IoT) systems require efficient infrastructure management with centralized monitoring and control. In this context, Software-Defined Networking (SDN) architecture offers an effective solution to fulfill centralized management needs and optimize network quality. By decoupling the data plane from the control plane, SDN consolidates control over network traffic, allowing flexible configuration and real-time traffic optimization. However, the separation also exposes SDN to severe attacks, particularly Distributed Denial of Service (DDoS) attacks, along with other exploitation techniques targeting its architecture. In this study, we propose a network traffic classification model for SDN environments that leverages multiple Machine Learning (ML) and Deep Learning (DL) models integrated with Explainable Artificial Intelligence (XAI) technology. This approach enables precise and transparent model decisions while reducing computational costs and improving classification accuracy. The proposed model achieves up to 99% accuracy across various network attack detection and classification scenarios within SDN, both with and without XAI assistance. Notably, the incorporation of XAI allows the model to retain high performance using only approximately 15% of the original feature set, significantly outperforming models without XAI. This feature reduction contributes to substantial decreases in training time, inference time, and model size, demonstrating the method’s feasibility and effectiveness for real-time deployment in SDN-based networks.