Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined Networks
Intrusion detection system (IDS) and deep packet inspection (DPI) are widely used to detect network attacks and anomalies, thereby enhancing cyber-security. Conventional traffic analyzers such as IDS have fixed locations and a limited capacity to perform DPI on large volumes of network traffic. Nowa...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2021-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9385142/ |
| _version_ | 1819141279346327552 |
|---|---|
| author | Sunghwan Kim Seunghyun Yoon Hyuk Lim |
| author_facet | Sunghwan Kim Seunghyun Yoon Hyuk Lim |
| author_sort | Sunghwan Kim |
| collection | DOAJ |
| description | Intrusion detection system (IDS) and deep packet inspection (DPI) are widely used to detect network attacks and anomalies, thereby enhancing cyber-security. Conventional traffic analyzers such as IDS have fixed locations and a limited capacity to perform DPI on large volumes of network traffic. Nowadays, software-defined networking (SDN) technology, which provides flexibility, elasticity, and programmability by decoupling the network control and data planes, makes it possible to capture entire or a certain portion of data traffic flows on SDN-capable switches and steer the captured network traffic to one of the traffic analyzers on the network. Therefore, how to sample network traffic and where to steer the sampled traffic among multiple traffic analyzers are critical problems facing cyber-security. Since there is a possibility that potentially useful information will be lost in not-captured traffic, deciding the sampling points and sampling rates of network traffic remains important. Additionally, after determining the sampling points and rates, sampled traffic must be sent to one of the multiple traffic analyzers for traffic inspection, which may incur additional network delivery overheads. We propose a less-intrusive traffic sampling mechanism for multiple traffic analyzers on an SDN-capable network using a deep deterministic policy gradient (DDPG), which is a representative deep reinforcement learning (DRL) algorithm for continuous action control. The proposed system learns sampling resource allocation policy under the uncertainty of flow distribution according to sampled traffic inspection results obtained from multiple traffic analyzers. Through extensive simulations and the SDN-based testbed experiments, we demonstrate that the proposed approach has a high probability of capturing malicious flows while maintaining a balanced load of multiple traffic analyzers and reducing flow monitoring overheads. |
| first_indexed | 2024-12-22T11:51:56Z |
| format | Article |
| id | doaj.art-f3e76ea306964b1fa1270bf2c79ffa24 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-22T11:51:56Z |
| publishDate | 2021-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-f3e76ea306964b1fa1270bf2c79ffa242022-12-21T18:26:57ZengIEEEIEEE Access2169-35362021-01-019478154782710.1109/ACCESS.2021.30684599385142Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined NetworksSunghwan Kim0https://orcid.org/0000-0001-8708-1699Seunghyun Yoon1https://orcid.org/0000-0001-6264-976XHyuk Lim2https://orcid.org/0000-0002-9926-3913School of Electrical Engineering and Computer Science, Gwangju Institute of Science and Technology (GIST), Gwangju, Republic of KoreaSchool of Electrical Engineering and Computer Science, Gwangju Institute of Science and Technology (GIST), Gwangju, Republic of KoreaAI Graduate School, Gwangju Institute of Science and Technology (GIST), Gwangju, Republic of KoreaIntrusion detection system (IDS) and deep packet inspection (DPI) are widely used to detect network attacks and anomalies, thereby enhancing cyber-security. Conventional traffic analyzers such as IDS have fixed locations and a limited capacity to perform DPI on large volumes of network traffic. Nowadays, software-defined networking (SDN) technology, which provides flexibility, elasticity, and programmability by decoupling the network control and data planes, makes it possible to capture entire or a certain portion of data traffic flows on SDN-capable switches and steer the captured network traffic to one of the traffic analyzers on the network. Therefore, how to sample network traffic and where to steer the sampled traffic among multiple traffic analyzers are critical problems facing cyber-security. Since there is a possibility that potentially useful information will be lost in not-captured traffic, deciding the sampling points and sampling rates of network traffic remains important. Additionally, after determining the sampling points and rates, sampled traffic must be sent to one of the multiple traffic analyzers for traffic inspection, which may incur additional network delivery overheads. We propose a less-intrusive traffic sampling mechanism for multiple traffic analyzers on an SDN-capable network using a deep deterministic policy gradient (DDPG), which is a representative deep reinforcement learning (DRL) algorithm for continuous action control. The proposed system learns sampling resource allocation policy under the uncertainty of flow distribution according to sampled traffic inspection results obtained from multiple traffic analyzers. Through extensive simulations and the SDN-based testbed experiments, we demonstrate that the proposed approach has a high probability of capturing malicious flows while maintaining a balanced load of multiple traffic analyzers and reducing flow monitoring overheads.https://ieeexplore.ieee.org/document/9385142/Cyber-securitynetwork traffic monitoringintrusion detection systemsoftware-defined networkingdeep reinforcement learning |
| spellingShingle | Sunghwan Kim Seunghyun Yoon Hyuk Lim Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined Networks IEEE Access Cyber-security network traffic monitoring intrusion detection system software-defined networking deep reinforcement learning |
| title | Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined Networks |
| title_full | Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined Networks |
| title_fullStr | Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined Networks |
| title_full_unstemmed | Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined Networks |
| title_short | Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined Networks |
| title_sort | deep reinforcement learning based traffic sampling for multiple traffic analyzers on software defined networks |
| topic | Cyber-security network traffic monitoring intrusion detection system software-defined networking deep reinforcement learning |
| url | https://ieeexplore.ieee.org/document/9385142/ |
| work_keys_str_mv | AT sunghwankim deepreinforcementlearningbasedtrafficsamplingformultipletrafficanalyzersonsoftwaredefinednetworks AT seunghyunyoon deepreinforcementlearningbasedtrafficsamplingformultipletrafficanalyzersonsoftwaredefinednetworks AT hyuklim deepreinforcementlearningbasedtrafficsamplingformultipletrafficanalyzersonsoftwaredefinednetworks |