Adaptive Context-Aware Confidence-Weighted Hybrid Ensemble for Real-Time Intrusion Detection in Software-Defined Networks
TL;DR
The proposed ACA-CWHE framework is intended to provide an adaptive, computationally efficient, and explainable intrusion detection solution suitable for real-time SDN security environments.
Abstract
Abstract The rapid adoption of Software-Defined Networking (SDN) has transformed modern network management by providing centralized control, flexible configuration, and efficient traffic management. However, the centralized architecture of SDN also exposes the network controller to a wide range of cyber threats, including Distributed Denial-of-Service (DDoS), brute-force, probing, and botnet attacks. Existing intrusion detection methods often rely on fixed learning strategies or static ensemble models, which struggle to adapt to continuously changing network traffic and attack patterns. To overcome these limitations, this paper presents an Adaptive Context-Aware Confidence-Weighted Hybrid Ensemble (ACA-CWHE) framework for intelligent intrusion detection in SDN. The proposed framework introduces a Context-Aware Adaptive Confidence Weighting (CAACW) mechanism that dynamically determines the contribution of Random Forest, LightGBM, and XGBoost classifiers by considering prediction confidence, network traffic context, and classifier reliability. In addition, an adaptive feature selection technique is employed to eliminate redundant traffic attributes, reducing computational cost while preserving detection capability. To improve the transparency of the detection process, SHapley Additive exPlanations (SHAP) are integrated to identify the network features that have the greatest influence on classification decisions. The framework is assessed using benchmark intrusion detection datasets and evaluated through performance measures such as Accuracy, Precision, Recall, F1-score, ROC-AUC, False Positive Rate (FPR), and Detection Time. The proposed ACA-CWHE framework is intended to provide an adaptive, computationally efficient, and explainable intrusion detection solution suitable for real-time SDN security environments. Keywords— Software-Defined Networking (SDN), Intrusion Detection System (IDS), Adaptive Ensemble Learning, Context-Aware Confidence Weighting, Explainable Artificial Intelligence (XAI), SHAP, Random Forest, LightGBM, XGBoost, Network Security.