The present code presents an end-to-end machine learning process that can be applied to an
SDN dataset. The analysis commences with data loading and exploration where the data set is
read from a csv file by the name ‘dataset_sdn.csv’. To start with, the code prints the first few
rows of the dataset, the structure of the columns and their data types and also provides
statistical summary. It also includes validation for null values and addresses them by
removing rows with the null values in order to provide clean data for further analysis.
Continuing with the data visualization, the code uses matplotlib and seaborn to plot relevant
graphs. Distribution plots are generated for three key features: We identified three variables
namely ‘pktcount’, ‘bytecount’ and ‘dur’, and the following figures show the pattern of the
above variables. Furthermore, for numerical columns, a correlation matrix heatmap is
generated that can show dependencies of the features that can affect the model’s performance
or presence of multicollinearity.
The first model applied involves the use of Random Forest Classifier. Before applying the
modeling process, the categorical features such as ‘src’, ‘dst’ and ‘Protocol’ are encoded to
convert them into a form that is understandable to the algorithm. The data set is then divided
into training and testing data set. Once the Random Forest model is trained on the training
dataset, the performance of the model is tested on the test dataset by using various parameters
like accuracy, confusion matrix, classification report, precision, recall, and F1 score. These
metrics provide a holistic outlook on the model’s proficiency in prediction.
After that, the code proceeds to the deep learning with a recurrent neural network, including
Long Short-Term Memory layers. The steps of data preprocessing are the same as in the case
of Random Forest model, with the only difference being the transformation of the target
variable into categorical format. To do it, the input data is reshaped to fit LSTM’s input shape
which is (num_timesteps, num_features, 1). Sequential model is developed using LSTM layer
and a Dense output layer. Thus, the model is compiled with categorical cross-entropy loss
and Adam optimizer and trained on the data. After the training process, the performance of
the model is evaluated by the same indicators that were used for the Random Forest.
Now, progressing to the next level of deep learning, a Convolutional Neural Network (CNN)
is used next. CNNs possess a high ability to learn the localized features that are very
beneficial especially for sequential data like the network traffic. It is then reorganized in a
way that will fit the input of the CNN. This network includes a Conv1D layer for feature
extraction, a MaxPooling1D layer for feature down sampling, a Flatten layer for transforming
the output from 2D to 1D and Dense layers for classification. As with LSTM, the model is
compiled, trained and evaluated.
1
Last but not the least, the code also contains a classification using Support Vector Machine
with the linear kernel. In addition, feature scaling is also done using StandardScaler to make
the range of the features to be one in order to normalize the features especially for distance-
based algorithms like the SVM. Same as in the case of training and prediction, the same set
of measures is considered for the evaluation of the SVM.
In conclusion, this code reveals the complete workflow of using machine learning with an
SDN dataset. Data loading, data exploration, data pre-processing, feature selection (tree
based, neural network, kernel based), model building and very rigorous model testing. The
study therefore employs the use of a number of algorithms so as to arrive at the best results
possible and at the same time appreciate the characteristics of the dataset that is being used in
modeling. Such comprehensive analysis is very important for areas such as network security
where the classification or identification of an anomaly can greatly affect the stability and
efficiency of the system.