[Paper Review] A Machine Learning Based Intrusion Detection System for Software Defined 5G Network

Jiaqi Li, Zhifeng Zhao+1 more|arXiv (Cornell University)|Jul 10, 2017

Internet Traffic Analysis and Secure E-voting6 references21 citations

TL;DR

This paper proposes an intelligent intrusion detection system (IDS) for Software Defined 5G networks that integrates machine learning with SDN architecture to enable centralized, adaptive, and collaborative threat detection. By combining Random Forest for feature selection and k-means++ with Adaboost for flow classification, the system achieves high detection accuracy—especially for rare attack types—through data balancing and cross-validation, outperforming traditional signature-based and isolated IDS approaches.

ABSTRACT

As an inevitable trend of future 5G networks, Software Defined architecture has many advantages in providing central- ized control and flexible resource management. But it is also confronted with various security challenges and potential threats with emerging services and technologies. As the focus of network security, Intrusion Detection Systems (IDS) are usually deployed separately without collaboration. They are also unable to detect novel attacks with limited intelligent abilities, which are hard to meet the needs of software defined 5G. In this paper, we propose an intelligent intrusion system taking the advances of software defined technology and artificial intelligence based on Software Defined 5G architecture. It flexibly combines security function mod- ules which are adaptively invoked under centralized management and control with a globle view. It can also deal with unknown intrusions by using machine learning algorithms. Evaluation results prove that the intelligent intrusion detection system achieves a better performance.

Motivation & Objective

• To address the limitations of traditional, signature-based IDS in detecting novel and evolving cyberattacks within 5G networks.
• To enable collaborative, centralized intrusion detection across distributed network elements in a Software Defined 5G environment.
• To enhance detection performance for low-frequency attack types (e.g., U2R, R2L) through data balancing techniques.
• To integrate adaptive machine learning models for real-time feature selection and flow classification under centralized control.
• To evaluate the system’s effectiveness in detecting diverse attack classes with improved accuracy and reduced false positive rates.

Proposed method

• The system employs a three-layer architecture: Forwarding Layer (OFs) for traffic monitoring and packet blocking, Management & Control Layer for initial anomaly detection and strategy generation, and Data & Intelligence Layer for deep analysis.
• Feature selection is performed using Random Forest to identify the most discriminative traffic features from network flow data.
• Flow classification combines k-means++ for initial clustering and Adaboost for ensemble learning, enabling accurate detection of both known and unknown attack patterns.
• Data balancing techniques—down-sampling normal/DoS traffic and up-sampling U2R/R2L attacks—are applied to mitigate class imbalance in training data.
• Cross-validation (CV) is used to validate model generalization, with 90% of data for training and 10% for testing to assess robustness.
• The system dynamically invokes security modules under centralized control, enabling real-time adaptation and coordinated response.

Experimental results

Research questions

• RQ1 Can a machine learning-based IDS effectively detect novel and previously unseen attacks in Software Defined 5G networks?
• RQ2 How does data balancing improve detection performance for low-frequency attack classes such as U2R and R2L?
• RQ3 What is the optimal combination of feature selection and classification algorithms for high-accuracy, low-overhead intrusion detection in 5G SDN environments?
• RQ4 To what extent does centralized, coordinated detection outperform isolated, local IDS deployments in 5G networks?
• RQ5 How does cross-validation improve the generalization capability of the intrusion detection model across diverse attack types?

Key findings

• The system achieves a detection accuracy of 99.9% for normal traffic and 97.04% for probe attacks when using cross-validation, significantly outperforming the normal process without CV.
• The detection rate for U2R attacks increases from 5.8% to 88.46% in training and 65.5% in testing when cross-validation is applied, demonstrating strong generalization.
• The balanced dataset improves minority class detection—especially for U2R and R2L attacks—without degrading performance on majority classes (normal and DoS).
• The combination of Random Forest for feature selection and k-means++ with Adaboost for classification yields the highest F-score (91.02%) and lowest false positive rate (0.54%) among tested configurations.
• Using 23 features selected via Random Forest, the system achieves 94.48% precision and 92.62% recall, indicating strong overall detection capability.
• The system strikes a balance between performance and computational cost, with NT=5 (number of trees) chosen as optimal for efficiency and accuracy.