GRAN: a SDN intrusion detection model based on graph attention network and residual learning.

This article focuses on developing an advanced intrusion detection system tailored for Software Defined Networking (SDN) environments, addressing the unique security challenges posed by SDN’s architecture. It introduces the Graph Residual Attention Network (GRAN), a novel model that integrates graph attention mechanisms with residual learning to analyze high-dimensional SDN traffic data represented as graph structures. Using the InSDN dataset, which simulates realistic SDN attack scenarios, the GRAN model demonstrates superior performance over traditional machine learning, deep learning, and graph convolutional network models, achieving 97.1% accuracy in multi-class classification and effectively detecting diverse attack types including Distributed Denial of Service (DDoS), Brute Force Attack (BFA), and Web Attacks. Extended experiments on the UNSW-NB15 dataset further validate GRAN’s robustness and applicability to other network environments. The study highlights the importance of leveraging SDN-specific datasets and graph-based deep learning techniques for effective intrusion detection in modern programmable networks.