Applying modified golden jackal optimization to intrusion detection for Software-Defined Networking

1.   Introduction

Over the past few years, a new type of network architecture called as Software-Defined Networking (SDN) has been introduced. SDN centralizes control in a network controller and divides it from the data plane, which provides a fresh way of looking at network architecture, thus adding more programmability ^[1]. The Computer Numerical Control (CNC) separation can solve the limitations of traditional networks and provide more advanced control and services. Still, it also faces challenges of scalability, consistency, and reliability due to its physically centralized controller ^[2,3].

Because of the convenience that SDN provides to computer networks, its security is getting more and more attention. One of the most important solutions to SDN security issues is network intrusion detection ^[4]. Badotra et al. ^[5] analyzed the vulnerability of two types of SDN controllers that are ONOS and ODL, for DDoS attacks, arranged SDN controllers on a distributed cloud and performed DDoS attacks and analyzed the vulnerability, and finally concluded that the OPL-3 node clusters are the most effective. Nadeem et al. ^[6] conducted a comparative analysis of feature selection classifiers and machine learning classifiers by combining Random Forest with SDN controllers to detect SDN attacks and trained the model by feature elimination pattern to validate the excellence of the proposed method. Wang et al. ^[7] applied Convolutional Neural Networks (CNN) to intrusion detection in SDN, optimizing CNN using the firefly algorithm after increasing population diversity and proposed an SDN with loT (SD-loT) framework which ensured the accuracy of normal traffic because it detected DDoS attacks on SD-loT.

Network Intrusion Detection System (NIDS) involves the detection and mitigation of malicious network intrusions by monitoring and analyzing network traffic, system logs, and other data. As society progresses, there is a rising emphasis on network security, leading to the growing significance of NIDS as a research focal point within the area of network security ^[8]. Traditional NIDS and SDN Intrusion Detection Systems, also referred to as non-SDN-IDS and SDN-IDS, makeup NIDS.

For both non-SDN-IDS and SDN-IDS, there are many redundant or irrelevant features in high-dimensional data, which may affect the classification speed or even reduce the classification accuracy, so data dimension is a necessary part of NIDS ^[9]. As a result, feature selection emerges as a significant approach to enhance the performance of NIDS, which aims to decrease the dimension of the feature space, constructing a more comprehensible model. It usually leads to better learning performance by reducing the dimension ^[10].

Friha et al. ^[11] proposed a NIDS for both SDN and non-SDN with a federated learning strategy and tested the classification accuracy by detecting attacks on three different datasets such as CIC-IDS2018, MQTTest, and InSDN. Elsayed et al. ^[12] proposed an improved long and short-term based automatic two-stage NIDS for both SDN and no-SDN with ToN-loT and InSDN dataset to validate the accuracy and precision of the Intrusion Detection System. To propose the SDN-SlowRate-DDoS dataset and validate the generated dataset using the Long Short-Term Memory (LSTM) model of the attack flow, Yungaicela-Naula et al. ^[13] conducted 23 different experiments in which they set up the network topology and established parameters such as attacker, victim, and so on. They then restricted the connection either temporarily or permanently depending on the intensity of the assault flows. It is finally concluded that SDN-IDS works best when the attacker is 4 and the victim is 2. To detect DDoS attacks based on VANET for SDN, Anyanwu et al. ^[14] proposed a Radial Basis Function (RBF) kernel for Support Vector Machine (SVM) and an exhaustive parameter search method called Grid Search Cross Verification. Then the superiority of the RBF kernel is verified by comparing the RBF, Poly, Linear, and Sigmod kernel, followed by tuning the RBF kernel with C, V, testing the time complexity, and comparing it with other Machine Learning (ML) algorithms at CICIDS 2019 to validate the superiority of the model. Gu et al. ^[15] proposed a hybrid feature selection algorithm based on Hadoop to select the most effective set of features. Then, a semi-supervised learning K-means algorithm was incorporated to use DARPA DDoS, CAIDA "DoS attack 2007" and CICIDS "DoS attack 2017" to verify the superiority of the algorithm.

The Golden Jackal Optimization (GJO) algorithm is a newly proposed meta-heuristic algorithm developed by Chopra ^[16] in 2022. Due to its simplicity, ease of implementation, and robustness, the GJO has been widely used in various fields. For instance, the usage of the GJO was recommended by Ghandourah et al. ^[17] to improve the network model and utilize it for the prediction of the performance of aluminum and polycarbonate air cavity solar stills. Najjar et al. ^[18] combined the LSTM model with the GJO and applied it to predict the tribological properties of alumina-coated silver-reinforced copper nanocomposites. Devi et al. ^[19] proposed a binary LEO-GJO algorithm by integrating LEO escape factors into the GJO and validated it on the UCI dataset for feature selection. Das et al. ^[20] used the GJO for feature selection and validated it using the dataset from the PROMISE repository. They also compared different classifiers, such as K-Nearest Neighbors (KNN), Decision Tree (DT), Naive Bayes (NB), and Quadratic Discriminant Analysis (QDA). Arini et al. ^[21] combined the GJO with the Joint Opposite Strategy (GJO-JOS) and compared it with the GJO-JOS algorithm under CEC 2017 using multiple algorithms to verify its superiority. They also performed the Wilcoxon rank sum test for the GJO-JOS, illustrating the engineering usability of the improved algorithm. Lu et al. ^[22] proposed a Quantum Evolutionary Golden Jackal Optimization Algorithm (QEGJOA), which was able to obtain a deployment scheme for sensors by increasing the duty cycle. The complexity of the algorithm was reduced while the accuracy was improved.

Our prior works ^{[23,24,25,26]} include four parts as follows. First, we proposed an integrated optimization algorithm incorporating a weighted k-nearest neighbor feature selection combination strategy, the ability of the proposed algorithm for non-SDN-IDS was tested using the KDD Cup99 dataset, which was divided into four groups conditioned on weighted KNN with feature selection, and finally it was verified that the proposed method can elevate the value of the accuracy of non-SDN-IDS. Second, we proposed a jumping spider optimization algorithm that combines the Harris Hawk algorithm with small-hole imaging and tested it with the KDD Cup99 and UNSW-NB15 datasets, which verified that the proposed method can improve the accuracy as well as the convergence speed of non-SDN-IDS. Third, we proposed a Harris Hawk algorithm optimized by Sin chaotic mapping to adjust the initialization of the Control Placement Problems (CPP) scheme. After obtaining the CPP format, the diversity of CPP is increased by using the Cauchy variation to find the CPP with the Pareto front, and experiments show that the CPP after the proposed scheme is more robust. Fourth, we proposed an improved butterfly optimization algorithm combined with black widow optimization for the feature selection of NIDS. The UNSW-NB15 dataset is selected for binary classification and multi-classification simulation experiments. The experimental results show that the proposed algorithm can enhance the performance of the feature selection model in non-SDN-IDS and reduce feature dimensions.

Therefore, considering the above researches, a GJO integrating the Elite Dynamic Opposite Learning (EDOL) strategy and the Golden Sine II Algorithm (GoldenSAII) is applied to the feature selection problems of SDN-IDS. The EDOL during the initialization stage helps to enhance the quality of solutions while avoiding being trapped in local optimal solutions, and the GoldenSAII is brought in the exploitation phase to enhance the convergence capability in later phases of the GJO. This paper uses the non-SDN-IDS dataset to compare with existing algorithms to validate the feasibility of the modified algorithm on NIDS, and further conducts comparative experiments with the SDN dataset, comparing to current conventional and standard algorithms to assess the superiority of the modified algorithm for SDN-IDS. The main contributions of this paper are as follows.

1). The mGJO for the SDN-IDS is proposed. The method solves the drawback that the redundant data in the SDN dataset leads to slow convergence of the SDN-IDS algorithm and falls into local optimal solutions. The performance of the proposed method is compared with other methods using benchmark test functions, four UCI datasets, the NSL-KDD dataset, and the InSDN dataset.

2). The GJO is improved using two strategies. The EDOL strategy enhances the quality of solutions while avoiding being trapped in local optimal solutions. The GoldenSAII is brought into the exploitation phase to enhance the convergence capability in later phases of the GJO.

3). The mGJO is a SDN-IDS feature selection method. This paper uses the binary version of the mGJO to select the optimal feature subsets. The mGJO has a robust global search ability and discovery ability.

2.   Original algorithm

The GJO algorithm emulates the hunting behavior of the golden jackal pairs and employs mathematical models to simulate their prey-capturing strategies in various scenarios. The golden jackal pair hunting is classified into the following phases.

2.1.   Initialization phase

During the initialization phase, the search space is populated with randomly generated solutions according to Eq (1).

where $UB$ denotes the upper bound and $LB$ denotes the lower bound, and " $rand$ " denotes a random vector with values ranging from 0 to 1. This equation can be used to generate random vectors whose values range from $UB$ to $LB$. The prey matrix initialization is created based on Eq (2). By multiplying the values with the difference between $UB$ and $LB$, this paper ensures that the vector remains within the specified range, and adding $UB$ to each element ensures that the values do not exceed the upper limit.

where $N$ denotes the number of prey population and $n$ denotes the dimension, and ${Y}_{N, n}$ represents the $n$ th dimension of the $n$ th prey.

The generated prey matrix $Pos$ is computed for each of its positional fitness values to obtain the fitness matrix of Eq (3), whereas the one with the smallest fitness value is assigned to the male jackal and the second smallest one to the female jackal.

After completing the initialization phase, the particularly important exploration and exploitation phases follow, as shown in Figure 1.

2.2.   Exploration phase

Due to the nature of jackals, they possess the ability to sense and stalk their prey, but occasionally the prey can be difficult to capture. Therefore, jackals wait and look for other prey. This hunting behavior, led by male jackals, is known as the exploration phase, where the female jackals follow the male jackals. The mathematical representation of the exploration phase is according to Eqs (4) and (5) (|E| > 1).

where $t$ is the current number of iterations, ${Y}_{M}\left(t\right)$ indicates the position of the male jackal, ${Y}_{FM}\left(t\right)$ indicates the position of the female jackal, and $Pos\left(t\right)$ is the position vector of the prey. ${Y}_{1}\left(t\right)$ and ${Y}_{2}\left(t\right)$ are the latest positions of the male and female jackals.

E is the escape energy of the prey and is calculated as follows.

where ${E}_{0}$ denotes a random variable between -1 and 1, denoting the initial energy of the prey, ${c}_{1}$ is a default value set to 1.5, ${E}_{1}$ denotes the decreasing energy of prey, and $T$ denotes the maximum number of iterations.

In Eqs (4) and (5), $\left|Y\left(t\right)-rl\cdot Pos\left(t\right)\right|$ denotes the distance between the golden jackal and the prey, and $rl$ is a vector of random numbers computed by the Levy flight function. The product of $rl$ and $Pos\left(t\right)$ simulates the movement of the prey in a Levy fashion.

where $\mu$ and $v$ are random values in (0, 1) and $\beta$ is a default constant set to 1.5.

where $Y(t+1)$ is the updated position of the prey based on the golden jackal pairs.

2.3.   Exploitation phase

When prey is harassed by golden jackals, the energy to hide is reduced, and then the jackal pairs will encircle the prey detected in the previous phase. After encircling, they pounce on the prey and eat it. This behavior of male and female jackals hunting together is called as the exploitation phase. The mathematical representation of the exploitation phase is according to Eqs (12) and (13) (|E| ≤ 1).

3.   Modified strategies

The GJO may face challenges in effectively addressing feature selection problems, including issues like iterative stagnation, slow convergence in later stages, limited exploration and exploitation capabilities, and quickly reaching local optimal solutions, especially in intricate feature spaces. In this part, this paper proposes the following two improvement strategies, EDOL and GoldenSAII, to figure out the above problems, which are used to solve the problems of insufficient exploitation capability and insufficient initialization diversity of the GJO, as shown in Figure 2.

3.1.   Elite Dynamic Opposite Learning strategy

EDOL is an optimization strategy that employs two techniques, dynamic opposite learning (DOL) and elite strategy. In the context of feature selection, DOL introduces opposite individuals to enhance the diversity of the feature space. This variety reduces the risk of becoming trapped in local optimal solutions and allows for a more in-depth exploration of potentially useful features. Meanwhile, the elite strategy preserves the best individuals to make sure that the algorithm preserves its capability to explore global optimal solutions.

3.1.1.   Dynamic opposite learning

As for meta-heuristic algorithms, the initialization is usually done by creating random individuals in the search space. While this approach encourages diversity within the population, it does not provide any assurances regarding the quality of the initial solutions. However, studies have demonstrated that the initialization directly influences both the accuracy and convergence speed ^[27,28]. Xu et al. ^[29] present a novel solution to address this problem by introducing an innovative approach. They leverage an asymmetric dynamic search space to effectively enhance the quality of solutions. Additionally, they select the best individuals for initialization through the greedy strategy, thereby improving the initial solutions. Therefore, a dynamic opposite learning strategy which increases the quality of the initialization is calculated as follows.

where ${X}_{pos}$ represents the initialized population generated by random generation, $r1$ and $r2$ represent random numbers uniformly distributed between 0 and 1. Since dynamic boundaries are used, $UB$ represents the max value in ${X}_{pos}$, $LB$ represents the min value in ${X}_{pos}$. First, the GJO generates two populations, ${X}_{pos}$ and ${X}_{DOL}$, whose fitness values are calculated separately. Second, Comparing fitness values of ${X}_{pos}$ and ${X}_{DOL}$, the smaller one is assigned to the male jackal. In contrast, compared to directly assigning fitness values that are second to male jackals to female jackals, the DOL strategy assigns fitness values that are greater than that of male jackals and less than that of female jackals obtained in the previous cycle will be assigned to female jackals.

3.1.2.   Elite strategy

In a population, elite individuals contain more valid information than others, and constructing elite individuals can increase population diversity ^[30]. To be included in the elite generation, an individual must have the best fitness value at the beginning of each iteration. The elite individual is introduced for the following iteration once the current generation of iterations is finished, and the worst fitness value is eliminated.

3.2.   Golden sine II strategy

Since GoldenSAII possesses a robust global search capability and exhibits fast convergence, it enables to search for the optimal feature subset in feature selection. This, in turn, leads to enhanced classifier performance. In addition, it expedites convergence and improves exploration capability throughout the process.

GoldenSAII is an algorithm proposed by Tanyildizi ^[31] to improve Golden Sine Algorithm (GoldenSA) ^[32]. The optimization procedure is usually classified into exploration and exploitation. GoldenSAII considers these two phases more than GoldenSA, and the model is shown as follows.

where ${X}_{i}^{t}$ is the current position of the $i$ th individual on the generation $t$. ${r}_{3}$, ${r}_{4}$ and ${r}_{5}$ represent random numbers uniformly distributed between 0 and 1. $d{r}_{t}$ is the amplitude of the sinusoidal function in the $t$ th iteration, which indicates the subsequent location range or the vector representing the direction of movement, and the subsequent location range can be both near and far from the target, and if $d{r}_{t}$ > 1, it indicates the location range far away from the target position; otherwise, if $d{r}_{t}$ < 1, indicates the opposite. $\omega$ is the angular frequency. ${D}_{p}$ is the value that indicates where the ideal global target is located.

${x}_{1}$ and ${x}_{2}$ are the coefficients derived by the golden section method, where $a$ and $b$ are intervals to be searched and $\tau$ is the golden ratio with a value of about 0.618033.

where $t$ is the current number of iterations and $T$ is the maximum number of iterations. The fundamental concept of the GoldenSA class of algorithms is to continuously reduce the search area to identify the best solutions, this is accomplished by utilizing the golden ratio method and the simplified mode of the sinusoidal function, while GoldenSAII introduces the concept of $d{r}_{t}$, which can better narrow down the search scope compared to GoldenSA, and jump out of local optimal solutions.

where $Fc$ is the frequency. $Fc$ is the maximum number of iterations multiplied by the population size.

3.3.   The proposed algorithm

To overcome the lack of the GJO in feature selection, this paper proposed an algorithm called the mGJO. The mGJO includes two significant improvements, the EDOL and the GoldenSAII.

In the context of feature selection, the traditional GJO typically initializes the golden jackal pairs randomly. However, this random initialization may result in a lack of diversity among the pairs, which can adversely affect the global optimization search, so the EDOL strategy is suggested. First, the EDOL strategy, employed in each iteration, plays a crucial role in generating opposite solutions that are distant from local extreme points using Eq (14). This strategy can make the GJO break free from local optimal solutions and significantly enhances its capability to identify the best solutions ^[33]. Furthermore, the tracking search pattern, which is based on the dynamic boundaries defined by Eq (15), helps locate individuals within a shrinking search region ^[34]. The elite strategy can retain individuals who contain more information, thus selecting a better subset of features. The incorporation of the EDOL strategy, which enhances the diversity of the feature subset and the initialization, can find the best solutions.

Second, the GoldenSAII improves the exploitation phase of the GJO, and the position updates are according to the following equations.

The GoldenSAII, due to its sine-based characteristics, provides advantages over the randomness of the Levy flight. It explores the search space evenly and comprehensively, enabling the discovery of potentially useful features. By strengthening the capacity to explore the solution space, this enhanced exploration capability raises the opportunity to discover a subset of extremely valuable features. By guarding against from trapped in local optimal solutions, the mGJO can enhance the overall capability. In addition, the search area is gradually reduced according to the golden segmentation coefficients ${x}_{1}$ and ${x_2}$ obtained in Eqs (18) and 19, and the updating distance and direction of the golden jackal pairs are adjusted according to ${r}_{6}$ in Eqs (22) and (23), and ${r}_{8}$ in Eqs (24) and (25), which guides the individuals to quickly approach the subset of more optimal features, improving the searching speed.

The flowchart of the mGJO, which combines EDOL and GoldenSAII, is shown in Figure 3. And the steps are as follows.

Step 1. Initialize the algorithm parameters.

Step 2. Initialize the positions of the golden jackal pairs population and calculate fitness values.

Step 3. Set the parameters of the golden sine, while deciding the elite individuals of the jackal pairs based on the fitness values.

Step 4. Obtain dynamic opposite solutions for the jackal pairs population based on Eqs (14) and (15), then modify the optimal solutions based on the fitness values.

Step 5. Perform exploitation when the escape energy E value is less than 1 and update the jackal pairs position according to Eqs (24) and (25).

Step 6. Perform exploration when the escape energy E value is greater than or equal to 1, and update the jackal pairs position according to Eqs (4) and (5).

Step 7. Update the position of the prey based on the jackal pairs according to Eq (11).

Step 8. Exclude individuals with the largest fitness value, and reserve the elite individuals obtained in Step 3 to the population.

Step 9. Verify if the max iterations have been reached. If it has, end, else return to Step 3.

3.4.   The time complexity of the mGJO

The time complexity indirectly reflects the convergence rate of the algorithm. The time to initialize the parameters is ${t}_{1}$. The population size is $n$ and the dimension is $d$. According to the equations of the update the position of the prey and the golden jackals, the time is ${t}_{2}$, and the time provision for calculating the fitness is ${T}_{f}$. The time complexity of GJO is as follow.

In the mGJO, the time to initialize the parameters is ${t}_{3}$, and the time to perform the EDOL is ${t}_{4}$. According to the equations of the update the position of the prey and the golden jackals, the time is ${t}_{5}$. The time complexity of the mGJO is as follow.

The mGJO proposed in this paper has the same time complexity as the GJO.

4.   Steps and methods

This section describes applying the mGJO to feature selection problems for non-SDN-IDS and SDN-IDS. The following stages involve in the application of meta-heuristic algorithms for feature selection in NIDS.

4.1.   Data preprocessing

After downloading the datasets and examining the samples, the first step involves cleaning the data. This contains tasks such as imputing missing data, denoising data, and so on. Once the above process is completed, the next is to convert the data using the label encoding method. This method is applied to transform string or categorical attributes into their corresponding numeric representations. Label encoding is used because the classifier applies to numeric types. The last step involves normalizing the data by performing a min-max normalization on all features. This process involves normalizing all features to the range between 0 and 1, which is convenient for the algorithm to process. The normalization method is shown in Eq (28).

where ${Z}_{max}$ represents the maximum boundary of the target, ${Z}_{min}$ represents the minimum boundary of the target, $Z$ represents the input data, and ${Z}_{n}$ represents the normalized data.

4.2.   Feature selection

Feature selection can identify the best subset of features while reducing the dimension. First, the processed dataset is classified into a test set, used for selecting the feature subset, and a training set, used for initialization. Once the population has been initialized and the population fitness has been computed, the elite individual is the one with the lowest fitness value. Next, using the EDOL, the population opposite solution is obtained, and the current optimal solution is updated. When it comes to exploitation, the GoldenSAII is introduced to find more potential features, which facilitates the discovery of optimal feature subsets. During the exploration phase, the initial algorithm is employed. Before the elite strategy is implemented, it updates the location of prey based on jackal pairs. After all the iterations are completed, the feature indexes are output. At last, the feature subsets from the test set are selected according to the feature indexes.

4.3.   Classifier evaluation

This paper selects KNN ^[35] as the classifier. The KNN classifier uses the training set to train and get the feature indexes, selection is made from the test set based on the indexes obtained. Then the confusion matrix is quoted as obtaining TP, TN, FN, and FP, the significance of these four values will be described in Section 5, and the remaining metrics Pre, Rec, F1, and Acc are calculated.

The flowchart for using the mGJO to feature selection is displayed in Figure 4.

The steps to use the mGJO for the feature selection are as follows.

Step 1. Preprocess and divide the data.

Step 2. The training set is applied to initialize the parameters of the mGJO.

Step 3. Initialize the positions of the jackal pairs population and calculate fitness values.

Step 4. Set the parameters of the golden sine, while determining the elite individuals of the jackal pairs based on the fitness values.

Step 5. Obtain dynamic opposite solutions for the jackal pairs population based on Eqs (14) and (15), then modify the optimal solutions based on the fitness values.

Step 6. Perform exploitation when the escape energy E value is less than 1 and update the jackal pairs position according to Eqs (24) and (25).

Step 7. Perform exploration when the escape energy E value is greater than or equal to 1, and update the jackal pairs position according to Eqs (4) and (5).

Step 8. Update the position of the prey based on jackal pairs according to Eq (11).

Step 9. Exclude individuals with the largest fitness value within the population based on the fitness value, and retain the elite individuals obtained in Step 4 to the population.

Step 10. Verify if the max iterations have been reached. If it has, go to Step 11, else return to Step 4.

Step 11. Compare the feature index of the optimal individual with the test set, get the test set after feature selection, and then use the classifier for evaluation.

5.   Experiments and results

5.1.   Benchmark function testing

The simulation test environment is: operating system Windows 11, 64-bit, CPU Intel i5 12400F with Nvidia GeForce RTX 3060ti, 16 GB of RAM, main frequency 2.50 GHz, simulation software Matlab2020b.

This paper selects some swarm intelligence algorithms for tests, which are Grey Wolf Optimizer (GWO) ^[36], Whale Optimization Algorithm (WOA) ^[37], GJO, and the mGJO, which incorporates EDOL and GoldenSAII, for comparison. The parameters of all algorithms are displayed in Table 1.

To test the optimization effect of the mGJO, this paper selects four unimodal functions (f1–f4) and four multimodal functions (f5–f8), Table 2 describes the details of the test functions. Table 3 and Figure 5 present the outcomes obtained from running the four algorithms independently for 30 iterations on each test function.

Based on the selected test functions, results indicate that the mGJO possesses the strongest optimization-seeking performance. The mGJO performs significantly better than GJO, GWO, and WOA. The mGJO achieves a 100% optimization effect for the functions f1–f8, with an optimal value of 0 that can be directly searched for. Except for functions f6–f8, the standard deviation of the improved algorithm is 0, indicating strong stability of the mGJO. For functions f3 and f4, the optimization effect of the mGJO is notably higher than that of other novel algorithms, with optimal values exceeding 270 orders of magnitude. The optimization accuracy improves quite a lot compared to the GJO.

The experiments show that the mGJO overcomes the problem that the GJO tends to fall into iterative stagnation and converge slowly at the later stage, and greatly improves optimization accuracy and convergence speed.

5.2.   Dataset testing

In feature selection, the number of selected features and the classification error rate decide the capability of the feature subset. The evaluation function is according to Eq (29).

where $fitness$ represents the best value of individual viable solutions of the population, $error$ indicates the classification error rate, $Nf$ expresses the feature number, $T$ denotes the max iterations, $\alpha$ and $\beta$ are two parameters, $\alpha$ = 0.99, $\beta$ = 0.01.

The classifier is KNN with k = 10, and a few evaluation metrics commonly employed in classification detection experiments: Accuracy (Acc), Recall (Rec), F1 score (F1), and Precision (Pre) are used to evaluate the performance of the algorithm, unit in %. The calculation is according to the following equations.

where $TP$ (True Positive) and $TN$ (True Negative) denote the values of positive class samples, while $FP$ (False Positive) and $FN$ (False Negative) denote the values of negative class samples. The comparison algorithms chosen for the experiments are still GWO, WOA, and GJO. When it comes to parameters, except N is the same as Table 1, T is set to 50 and Dim is the feature number of each dataset.

5.2.1.   UCI dataset

In this section, four UCI datasets are selected, namely Ionosphere, WDBC, Heartstatlog, and Sonar. Table 4 displays the results of the four algorithms that are run on each dataset, along with Figure 6.

Based on the given four datasets, the test results indicate that mGJO performs best on the Ionosphere dataset, thus proving its efficiency on this dataset. On the WDBC and Sonar datasets, the remaining three metrics, except for Rec, are the best performers. This shows that the mGJO accurately recognizes both positive and dissimilar classes. Although Rec is not the highest, it ranks second and is only about 1% lower than the first place. For the Heartstatlog dataset, Acc, Rec, and F1 are all the best performers. This means that the mGJO effectively detects positive samples and performs well for balanced classifier performance. However, the performance of Pre is not very good, about 9% lower than the first place. Nonetheless, it still ranks second. Furthermore, Figure 6 depicts the optimization search process of the mGJO on different datasets. According to Figure 6, the mGJO performs faster optimization searches on the WDBC and Ionosphere datasets. However, on the Heartstatlog and Sonar datasets, there are constant transitions and occasional escapes from local optimal solutions.

On the given UCI datasets, F1, Acc of the mGJO are consistently higher than those of the other comparative algorithms, which indicates that the mGJO can accurately classify most of the samples with strong classifiability.

5.2.2.   NSL-KDD dataset

This section uses KDDTrain+_20Percent.txt with KDDTest-21.txt for the test, which is part of the NSL-KDD ^[38] dataset.

First, the attack stream type column is used as the label after the string type in the dataset transforms into a data type. The DoS, Probe, U2R, and R2L classes are all set to 1, representing the Abnormal class, while the Normal class is set to 0. Second, the dimension of the dataset is decreased. The features of columns 10 through 22 of the network connection vector are eliminated, leaving the remaining columns as features. At last, the normalization is carried out, this paper uses the mapminmax function so that the data maps to the interval from 0 to 1. This paper takes 5% of the data in KDDTrain and KDDTest, KDDTrain is used for training while KDDTest is used for prediction. Table 5 displays the results of the four algorithms that are run, along with Figure 7.

Based on the test results of the NSL-KDD dataset, the mGJO has been ranked as the best algorithm overall, with a 3% to 5% increase in Acc, a 4% to 8% increase in Pre, and a 2% to 4% increase in F1 in comparison to other algorithms. The highest Acc signifies that the mGJO is highly accurate in classifying the entire dataset and has a minimal tendency to misclassify the Normal class samples as Abnormal. The highest Pre indicates that the mGJO is precise in predicting samples to the Abnormal class, which helps to avoid incorrect predictions of Normal class samples as Abnormal. The highest F1 signifies that the mGJO finds the best balance between Pre and Rec, accurately predicting Abnormal class samples and efficiently identifying the most relevant features that can be selected for all Abnormal class samples. As shown in Figure 7, Fitness values of the mGJO continue to rise with fluctuating during the updating, indicating that the mGJO keeps overcoming the local optimal solution and has a strong capability to select the best features. Furthermore, the mGJO reaches the optimal fitness value in the 19th generation, and the convergence speed is far ahead of other algorithms.

Compared to tests on the UCI datasets, the results of the NSL-KDD experiment can further illustrate the classification capability of the mGJO. The results for F1, Acc, and Pre metrics are indicative of a commendable performance. The mGJO can find the optimal subset of features in a better way, precisely classify the samples, and strike an optimal balance between the prediction and identification of Abnormal class samples.

In addition, this paper also tests the ROC curve with AUC values shown in Table 6 and Figure 8. Based on Table 6 and Figure 8, it can be concluded that the mGJO performs exceptionally well on the NSL-KDD dataset. The ROC curve of the mGJO is near the left top corner which implies it reduces the possibility of false positives, which suggests that the mGJO performs very close to the optimal performance under different thresholds. The AUC value of the mGJO achieves closest to 1, exhibiting an enhancement of 0.4% to 4% compared to other algorithms, which indicates the mGJO performs well on a high true positive rate and a low false positive rate for sample recognition. The mGJO performs better under different thresholds and can classify efficiently.

5.2.3.   InSDN dataset

Today, SDN enables a wide range of applications, which are accompanied by threats and vulnerabilities, making intrusion detection for SDN essential. Elsayed et al. ^[39] published an attack-specific SDN dataset, InSDN, which includes several categories of attacks against SDN components, including attacks on the data plane, attacks on control plane communications, attacks on SDN controllers, and attacks on the application plane. InSDN contains three datasets in CSV format, Normal, OVS, and metasploitable-2, which contains a total of 343, 889 pieces of data, 1 label tag, 6 socket information, and 77 different features ^[40]. Table 7 displays that the Normal Group contains information about all normal flows, while the OVS Group with Metasploitable-2 Group represents the attack flows.

This paper uses the InSDN dataset for SDN-IDS, which focuses on feature selection for the subset features of the SDN environment. This paper combines labels that are from the original dataset and features that are shown in Table 8 together as a new SDN dataset.

Since the labels of the InSDN dataset are divided into 8 classes, which are Normal, DoS, DDoS, Probe, BFA, Web-Attack, Botnet, and U2R, these label classes are converted to data types corresponding to 0, 1, 2, 3, 4, 5, 6, and 7 respectively when performing multiclassification, as the label classes of the new dataset, and the remaining 48 columns are normalized using the mapminmax function in Matlab to get the processed SDN dataset. Due to the large amount of data in the InSDN dataset, all the data in the BFA, Web-Attrack, Botnet, and U2R categories, which have a small amount of data, are taken out for the experiment here. The Normal, DoS, DDoS, and Probe categories based on the percentage of the original dataset are then randomized to a total of 10, 000 instances for testing. The proportion of the training set to the test set is 7 to 3. Tables 9 and 10 present the outcomes obtained from running the four algorithms independently for 30 iterations.

Based on the results, the mGJO outperforms the other algorithms and claims the top rank. Among the four categories, namely DoS, DDoS, BFA, and Web-Attack, the mGJO has the highest Pre. On DoS and DDoS, the mGJO improves by about 0.1% compared to the other three algorithms. On BFA and Web-Attack, the Pre of the mGJO enhances about 1% than WOA. In terms of overall performance, the mGJO ranks second on Normal, Probe, and Botnet. Regarding Rec, Normal performs the best, with an improvement of around 0.2% to 0.6% compared to the other three algorithms. However, on DDoS, Probe, BFA, and Web-Attack, Normal ranks second. When it comes to F1, Normal, DoS, DDoS, and Web-Attack are the four categories with the highest performance, with an improvement of about 0.5% compared to other algorithms. In other categories, the mGJO ranks second. When it comes to Acc, the mGJO also performs the best. Overall it shows that the mGJO performs excellently in Acc, F1, and Pre. Rec, conversely, is slightly worse than F1 and Pre. However, compared to the other algorithms, the mGJO ranks first in overall Rec.

From the above analysis, it is easy to see that the mGJO has an improvement in Acc, F1, and Pre compared to the remaining three algorithms, which indicates that the mGJO can also perform at a better level in multi-classification problems, with less misclassification of these types of data in the InSDN dataset, and can make the correct predictions. For Normal, DoS, DDoS, and Probe, which are classes with high data volume in the original dataset and a lot of attack behaviors that require high Acc and Pre, the mGJO is the best performer in these classes combined. As for BFA, Web-Attack, and BOTNET, which are classes with fewer attack flows in the InSDN dataset itself, high Rec and high F1 are often required. The mGJO in these classes also achieves the combined optimum in these two metrics. It is shown that the mGJO is suitable for the InSDN dataset and can also perform feature selection on the dataset. The experimental data also further illustrates that the mGJO can show strong Acc, F1, and Pre when performing feature selection.

6.   Conclusions and future works

To promote the application of the GJO in SDN-IDS, this paper proposes the mGJO that incorporates EDOL and GoldenSAII strategies. First, the global search capability of the mGJO is verified using the benchmark test function; second, the UCI datasets are used to verify the classification ability of mGJO in feature selection; subsequently, the NSL-KDD dataset is used to verify the feasibility of mGJO in non-SDN-IDS, which further verifies the ability of mGJO for feature subset selection; in the end, the experiments with the InSDN dataset conclude that mGJO can be used for feature selection on InSDN dataset, and it also has a very good effect for SDN-IDS, and it can be further extended for use in SDN.

The mGJO combines the advantages of the EDOL strategy with the GoldenSAII strategy compared to the GJO. From the experimental results above, it can be seen that the mGJO performs well in the three indicators of F1, Acc, and Pre, but it is difficult to achieve a high value of Rec and at the same time, F1 balances Pre and Rec. Moreover, there are fewer datasets for SDN-IDS, which lacks the generalizability to be applied in real SDN scenarios. All of these will be further studied and improved. In the next step, our work intends to conduct simulation experiments using the SDN environment to obtain the flow data for further testing.

Use of AI tools declaration

The authors declare they have not used Artificial Intelligence (AI) tools in the creation of this article.

Acknowledgments

This work has been supported by the National Natural Science Foundation of China under Grant 61602162 and Hubei Provincial Science and Technology Plan Project under Grant 2023BCB041.

Conflict of interest

The authors declare no conflict of interest.