A robust and scalable intrusion detection framework for SDN with GAN-CL-STO


Creative Commons License

Al-Sarray N. H. S., DEMİRHAN A., Rahebi J.

JOURNAL OF SUPERCOMPUTING, cilt.81, sa.14, 2025 (SCI-Expanded) identifier identifier

  • Yayın Türü: Makale / Tam Makale
  • Cilt numarası: 81 Sayı: 14
  • Basım Tarihi: 2025
  • Doi Numarası: 10.1007/s11227-025-07821-7
  • Dergi Adı: JOURNAL OF SUPERCOMPUTING
  • Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus, Academic Search Premier, Applied Science & Technology Source, Compendex, Computer & Applied Sciences, INSPEC, zbMATH
  • Gazi Üniversitesi Adresli: Evet

Özet

The study presents GAN-CL-STO, a novel intrusion detection framework that integrates Generative Adversarial Networks (GANs), a 1D Convolutional-Long Short-Term Memory (CL) network, and hyperparameter tuning via the Siberian Tiger Optimization (STO). The model was implemented in Keras and trained over 50 epochs with a batch size of 16, and evaluated on three benchmark datasets (UNSW-NB15, CIC-IDS2017, and NSL-KDD). GAN-CL-STO achieved consistently higher accuracy compared to existing methods such as Transformer, Graph Neural Networks (GNNs), Fuzzy System, Reinforcement Learning, CNN-LSTM, PSO-1D CNN and 1D CNN + BiLSTM, reaching an overall accuracy of 99.91%. Compared to previous approach, the framework improved classification accuracy by 4.06%, mainly due to better feature selection and dynamic hyperparameter adjustment, while keeping computational costs low. During testing, the model showed a fast interface response time of 1.42 ms and an average latency of 33.7 ms, making it suitable for real-time SDN intrusion detection. One-way ANOVA analysis confirmed the reliability of these results, with all p-values below 0.05. The outcomes suggest that GAN-CL-STO could be a practical and reliable solution for strengthening modern network security. Additionally, the framework incorporates a steganography-based blacklist sharing mechanism, ensuring both feasibility and security for real-time SDN deployment.