AI-Powered Anomaly Detection in Software-Defined Networking (SDN) for Real-Time Threat Mitigation

Abstract

Software Defined Networking (SDN) revolutionizes network control by separating control plane from data plane, which allows centralized control, programmability and better visibility. While these capabilities improve agility and scalability, they also create very serious security holes, particularly in a central control plane, that contribute to making SDN environments a high-profile target for advanced threats. The issue is that Traditional security methods are unable to keep up with modern attacks as they are not behaving on a point-in-time mindset; it’s static and signature-based. In this regard, Artificial Intelligence, particularly Machine Learning and Deep Learning, stands out as a relevant tool to detect anomalies in real-time deploying and to anticipate threats in SDN. We can apply AI to learn patterns from network traffic, identify anomalies that are indicative of malicious activity, and automatically evolve to counter new threats with negligible human supervision. The research is organized by integrating Control Theory, Activity Theory and Anomaly Detection Theory to study the AI contribution to the security of software defined network as a comprehensive perspective. 54 papers were included in this qualitative review that presents a literature and a theoretical survey on Artificial Intelligence-driven anomaly detection in SDN. Obstacles include: the paucity of varied and good-quality datasets, the ability to generalise detection models over diverse SDN topologies, and the lack of common frameworks for evaluating detection models. The goal of this work is to motivate future research and to aid in the construction of intelligent, adaptive and resilient SDN infrastructures with real-time threat defense mechanisms.