Predicting Attack Pattern via Machine Learning by Exploiting Stateful Firewall as Virtual Network Function in an SDN Network

Senthil Prabakaran; Ramalakshmi Ramar; Irshad Hussain; Balasubramanian Prabhu Kavin; Sultan S Alshamrani; Ahmed Saeed AlGhamdi; Abdullah Alshehri

doi:10.3390/s22030709

Predicting Attack Pattern via Machine Learning by Exploiting Stateful Firewall as Virtual Network Function in an SDN Network

Sensors (Basel). 2022 Jan 18;22(3):709. doi: 10.3390/s22030709.

Authors

Senthil Prabakaran¹, Ramalakshmi Ramar², Irshad Hussain³, Balasubramanian Prabhu Kavin⁴, Sultan S Alshamrani⁵, Ahmed Saeed AlGhamdi⁶, Abdullah Alshehri⁷

Affiliations

¹ Department of Computer Science and Engineering, Karpagam College of Engineering, Coimbatore 641032, Tamil Nadu, India.
² Department of Computer Science and Engineering, Kalasalingam Academy of Research and Education, Krishnankoil 626126, Tamil Nadu, India.
³ Faculty of Electrical and Computer Engineering, University of Engineering and Technology, Peshawar 25000, Pakistan.
⁴ Sri Ramachandra Faculty of Engineering and Technology, Sri Ramachandra Institute of Higher Education and Research, Porur, Chennai 600116, Tamil Nadu, India.
⁵ Department of Information Technology, College of Computer and Information Technology, Taif University, P.O. Box 11099, Taif 21944, Saudi Arabia.
⁶ Department of Computer Engineering, College of Computer and Information Technology, Taif University, P.O. Box 11099, Taif 21944, Saudi Arabia.
⁷ Department of Information Technology, Al Baha University, P.O. Box 1988, Al Baha 65431, Saudi Arabia.

Abstract

Decoupled data and control planes in Software Defined Networks (SDN) allow them to handle an increasing number of threats by limiting harmful network links at the switching stage. As storage, high-end servers, and network devices, Network Function Virtualization (NFV) is designed to replace purpose-built network elements with VNFs (Virtualized Network Functions). A Software Defined Network Function Virtualization (SDNFV) network is designed in this paper to boost network performance. Stateful firewall services are deployed as VNFs in the SDN network in this article to offer security and boost network scalability. The SDN controller's role is to develop a set of guidelines and rules to avoid hazardous network connectivity. Intruder assaults that employ numerous socket addresses cannot be adequately protected by these strategies. Machine learning algorithms are trained using traditional network threat intelligence data to identify potentially malicious linkages and probable attack targets. Based on conventional network data (DT), Bayesian Network (BayesNet), Naive-Bayes, C4.5, and Decision Table (DT) algorithms are used to predict the target host that will be attacked. The experimental results shows that the Bayesian Network algorithm achieved an average prediction accuracy of 92.87%, Native-Bayes Algorithm achieved an average prediction accuracy of 87.81%, C4.5 Algorithm achieved an average prediction accuracy of 84.92%, and the Decision Tree algorithm achieved an average prediction accuracy of 83.18%. There were 451 k login attempts from 178 different countries, with over 70 k source IP addresses and 40 k source port addresses recorded in a large dataset from nine honeypot servers.

Keywords: SDNFV; attack prediction; bayesian network; decision table; firewall; machine learning; network function virtualization; software defined network.