Unsupervised anomaly detection in software-defined networks via BiGAN-based traffic reconstruction and explainable artificial intelligence

The increasing reliance on computer networks across various environments underscores the critical need for effective intrusion detection mechanisms. In this manner, this paper presents an unsupervised anomaly detection system for Software-Defined Networks (SDN) based on traffic reconstruction using Bidirectional Generative Adversarial Networks (BiGAN). The proposed system operates in three phases: data collection and preprocessing, anomaly detection through traffic reconstruction and thresholding, and mitigation by blocking malicious IP addresses via dynamic updates to trust and blocklist entries. The system was evaluated using two public datasets, achieving high accuracy and robustness, particularly when utilizing the most significant traffic feature identified via SHapley Additive exPlanations (SHAP) explainability technique. Results demonstrated our IDS’s capability to differentiate between normal and anomalous traffic. Additionally, the system’s effectiveness in mitigating attacks reached more than 93% of malicious flows, while ensuring minimal or no impact on legitimate traffic in both datasets. These findings highlight the system’s effectiveness in SDN environments, offering a consistent solution for proactive network anomaly detection and response.