Performance and Structural Symmetry Evaluation of Machine Learning-Driven Intrusion Detection Systems in Software-Defined Networks

Abstract

Software-Defined Networking (SDN) provides fine-grained control over network architectures, yet integrating intrusion detection systems (IDSs) into the control plane frequently introduces prohibitive computational overhead. This issue is compounded by the fact that existing machine learning models, typically trained on static benchmark datasets, often degrade under real-time polling conditions and unpredictable traffic bursts. To bridge this gap, this paper evaluates an ultra-compact five-feature polling scheme (F1–F5) designed to preserve statistical symmetry between control-plane monitoring and telemetry overhead within a dynamic Mininet–Ryu testbed. The experimental framework incorporates 15% background noise, and a 10% stealth attack overlaps across a 120 s dynamic trace. Four distinct classifiers—Random Forest (RF), Decision Tree (DT), Multi-Layer Perceptron (MLP), and Long Short-Term Memory (LSTM)—were evaluated across frame-by-frame snapshot and windowed prediction tasks. Empirical findings reveal that tree-based ensembles consistently outperform deep learning approaches, with RF attaining an overall accuracy of 97.57% and DT achieving 96.74%, compared to 90.77% for MLP and 90.73% for LSTM. Analysis of the time-series logs demonstrates that RF’s orthogonal decision boundaries successfully isolate transient, high-intensity threats such as WebAttack and PortScan vectors without needing memory-intensive recurrent architectures. Ultimately, pairing minimal feature extraction with lightweight tree ensembles offers an optimal balance between low control-plane latency and high detection efficacy.