Enhancing Intrusion Detection in Software-Defined Networking Using SMOTE-Based Resampling and PCA-Driven Dimensionality Reduction: A Machine Learning Approach

Abstract

Software-Defined Networking (SDN) offers dynamic and programmable network control but remains vulnerable to various cyber-attacks, making robust Intrusion Detection Systems (IDS) essential. This study investigates the impact of class imbalance on IDS performance in SDN using the publicly available InSDN dataset. To address this imbalance, we applied the Synthetic Minority Over-sampling Technique (SMOTE), followed by Principal Component Analysis (PCA) for dimensionality reduction. Multiple machine learning classifiers—Random Forest, Support Vector Machine, K-Nearest Neighbors, and Logistic Regression—were evaluated on both imbalanced and balanced datasets. Our results reveal that the integration of SMOTE and PCA significantly improves classification performance, especially for minority attack classes. The optimized Random Forest model achieved 97.4% accuracy and a macro F1-score of 92.3%, outperforming all other configurations. This study proposes a streamlined ML pipeline combining oversampling and feature selection, offering a computationally efficient and highly accurate solution for IDS in SDN environments.