Multiple datasets have been proposed to create Machine Learning (ML)-based Network Intrusion Detection Systems (NIDS). However, many of these datasets suffer from sub-optimal performance and inadequate tail class representation. In this paper, we propose the University of Nevada - Reno Intrusion Detection Dataset (UNR-IDD), which utilizes network port statistics for fine-grained analysis of intrusions. Evaluation results show that UNR-IDD is better than existing NIDS datasets with an Fμ, score of 94% and a minimum F-score of 86%. This is mainly because of sufficient and equal representation of various anomaly types in the UNR-IDD dataset.

An increasing number of science projects rely on sensors to gather data from remote areas. For example, a wildfire detection project deploys video cameras to various high-risk areas to identify wildfires as quickly as possible. These projects typically depend on hybrid networks that are composed of a combination of wireless and wired links to stream data from sensors to data centers. The management of such hybrid networks is a burdensome task as both link capacities and traffic rates of flows are dynamic and unpredictable. In this paper, we introduce a BAndwidth- and Congestion Aware Routing (BACAR) for hybrid networks using Software Defined Networks. We use active delay measurements to identify congested links and update their capacity to measure traffic rate to detect any link capacity degradation events. We test BACAR in Mininet and show that it offers a robust solution to detect bandwidth fluctuations that can happen in long-distance wireless links and find alternative routes for rate-sensitive flows to improve overall network utilization and enhance flow performance.

As software-defined network (SDN) adoption increases, it becomes increasingly important to develop effective solutions to defend them against cyber attacks. A prominent cyberattack that can compromise SDNs is TCP-SYN floods, which can exhaust network resources by initiating too many fraudulent TCP connections. Previous efforts to detect SYN Flood attacks mainly rely on statistical methods to process mirrored traffic or flow statistics. Thus, they either incur high overhead (in the case of port mirroring) or lead to low accuracy (in the case of using flow statistics). In this paper, we propose a machine learning (ML)-enabled TCP-SYN flood detection framework using Openflow port statistics. We demonstrate that ML models such as Random Forest classifiers can differentiate normal traffic from SYN flood traffic with up to 98% accuracy. We also introduce a novel threat localization technique that can pinpoint where the attack traffic originates from in the network.