GAN-Based IDS System for Imbalanced Datasets in SDN Environments With Offline and Real-Time Traffic Analysis

Abstract

Software-defined networks (SDNs) provide centralized and programmable management of network resources, offering flexibility and scalability. However, their centralized nature makes them highly vulnerable to threats that can exhaust resources and disrupt control-plane operations. Therefore, securing SDN environments requires robust intrusion detection systems (IDS); however, the reliance on traditional signature-based approaches often restricts their ability to detect new and evolving threats. Machine learning-based IDSs are frequently limited by imbalanced datasets, where the prevalence of either normal or attack traffic biases models and reduces detection accuracy for minority classes. Furthermore, the high dimensionality of network features introduces noise and redundancy, leading to increased computational load and reduced model performance. This study proposes a deep learning-based IDS framework that integrates generative adversarial networks (GANs) to generate synthetic samples for addressing class imbalance, and utilizes a chi-square test for effective feature selection to reduce redundancy and enhance efficiency. The framework is evaluated using the InSDN dataset with multiple classifiers, including Naive Bayes (NB), Extra Trees (ET), Random Forest (RF), and Extreme Gradient Boosting (XGB). Among these, XGB achieved superior results with 99.95% accuracy, 99.99% precision, 99.91% recall, and an AUC of 99.99%, while maintaining a low false alarm rate and faster training/testing times. The practical viability and effectiveness of the framework are demonstrated through both offline and real-time traffic analysis. The results validate its robustness and highlight its suitability for deployment in realistic network conditions.