{"id":"https://openalex.org/W4415969797","doi":"https://doi.org/10.23919/icmu65253.2025.11219123","title":"Cluster-Based Detection of Compromised SDN Controller Using Behavioral Divergence","display_name":"Cluster-Based Detection of Compromised SDN Controller Using Behavioral Divergence","publication_year":2025,"publication_date":"2025-09-10","ids":{"openalex":"https://openalex.org/W4415969797","doi":"https://doi.org/10.23919/icmu65253.2025.11219123"},"language":null,"primary_location":{"id":"doi:10.23919/icmu65253.2025.11219123","is_oa":false,"landing_page_url":"https://doi.org/10.23919/icmu65253.2025.11219123","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 Fifteenth International Conference on Mobile Computing and Ubiquitous Networking (ICMU)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048435447","display_name":"Jiwon Suh","orcid":"https://orcid.org/0000-0003-3963-0117"},"institutions":[{"id":"https://openalex.org/I848706","display_name":"Sungkyunkwan University","ror":"https://ror.org/04q78tk20","country_code":"KR","type":"education","lineage":["https://openalex.org/I848706"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jiwon Suh","raw_affiliation_strings":["Sungkyunkwan University,Department of Computer Science & Engineering,Suwon,Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sungkyunkwan University,Department of Computer Science & Engineering,Suwon,Republic of Korea","institution_ids":["https://openalex.org/I848706"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050526299","display_name":"Jaehoon Jeong","orcid":"https://orcid.org/0000-0001-8490-758X"},"institutions":[{"id":"https://openalex.org/I848706","display_name":"Sungkyunkwan University","ror":"https://ror.org/04q78tk20","country_code":"KR","type":"education","lineage":["https://openalex.org/I848706"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jaehoon Paul Jeong","raw_affiliation_strings":["Sungkyunkwan University,Department of Computer Science & Engineering,Suwon,Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sungkyunkwan University,Department of Computer Science & Engineering,Suwon,Republic of Korea","institution_ids":["https://openalex.org/I848706"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5017500181","display_name":"Tae Oh","orcid":"https://orcid.org/0000-0002-6390-8927"},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tae Tom Oh","raw_affiliation_strings":["School of Information, Rochester Institute of Technology,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Information, Rochester Institute of Technology,USA","institution_ids":["https://openalex.org/I155173764"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.39079563,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9915000200271606,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9915000200271606,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.001500000013038516,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.00139999995008111,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6636000275611877},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.6105999946594238},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.59170001745224},{"id":"https://openalex.org/keywords/locality","display_name":"Locality","score":0.5112000107765198},{"id":"https://openalex.org/keywords/controller","display_name":"Controller (irrigation)","score":0.49549999833106995},{"id":"https://openalex.org/keywords/decoupling","display_name":"Decoupling (probability)","score":0.4726000130176544},{"id":"https://openalex.org/keywords/divergence","display_name":"Divergence (linguistics)","score":0.4690000116825104},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.453000009059906}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7537999749183655},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6636000275611877},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.6105999946594238},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.59170001745224},{"id":"https://openalex.org/C2779808786","wikidata":"https://www.wikidata.org/wiki/Q6664603","display_name":"Locality","level":2,"score":0.5112000107765198},{"id":"https://openalex.org/C203479927","wikidata":"https://www.wikidata.org/wiki/Q5165939","display_name":"Controller (irrigation)","level":2,"score":0.49549999833106995},{"id":"https://openalex.org/C205606062","wikidata":"https://www.wikidata.org/wiki/Q5249645","display_name":"Decoupling (probability)","level":2,"score":0.4726000130176544},{"id":"https://openalex.org/C207390915","wikidata":"https://www.wikidata.org/wiki/Q1230525","display_name":"Divergence (linguistics)","level":2,"score":0.4690000116825104},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.453000009059906},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.44200000166893005},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.43209999799728394},{"id":"https://openalex.org/C184898388","wikidata":"https://www.wikidata.org/wiki/Q1435712","display_name":"Pairwise comparison","level":2,"score":0.42149999737739563},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.385699987411499},{"id":"https://openalex.org/C105611402","wikidata":"https://www.wikidata.org/wiki/Q2976589","display_name":"Spectral clustering","level":3,"score":0.37689998745918274},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3662000000476837},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.35929998755455017},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.3325999975204468},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.305400013923645},{"id":"https://openalex.org/C164866538","wikidata":"https://www.wikidata.org/wiki/Q367351","display_name":"Cluster (spacecraft)","level":2,"score":0.3034000098705292},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2818000018596649},{"id":"https://openalex.org/C92835128","wikidata":"https://www.wikidata.org/wiki/Q1277447","display_name":"Hierarchical clustering","level":3,"score":0.2623000144958496},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.25760000944137573}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23919/icmu65253.2025.11219123","is_oa":false,"landing_page_url":"https://doi.org/10.23919/icmu65253.2025.11219123","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 Fifteenth International Conference on Mobile Computing and Ubiquitous Networking (ICMU)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7045322852","display_name":null,"funder_award_id":"RS-2024-00398199","funder_id":"https://openalex.org/F4320335489","funder_display_name":"Institute for Information and Communications Technology Promotion"},{"id":"https://openalex.org/G7232876218","display_name":null,"funder_award_id":"2023R1A2C2002990","funder_id":"https://openalex.org/F4320322120","funder_display_name":"National Research Foundation of Korea"}],"funders":[{"id":"https://openalex.org/F4320322120","display_name":"National Research Foundation of Korea","ror":"https://ror.org/013aysd81"},{"id":"https://openalex.org/F4320335489","display_name":"Institute for Information and Communications Technology Promotion","ror":"https://ror.org/01g0hqq23"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":11,"referenced_works":["https://openalex.org/W2040340473","https://openalex.org/W2123016589","https://openalex.org/W2137793678","https://openalex.org/W2147118406","https://openalex.org/W2254610628","https://openalex.org/W3109019540","https://openalex.org/W4238465620","https://openalex.org/W4378841741","https://openalex.org/W4384937665","https://openalex.org/W4385252571","https://openalex.org/W4405935236"],"related_works":[],"abstract_inverted_index":{"Software-Defined":[0],"Networking":[1],"(SDN)":[2],"enhances":[3],"programmability":[4],"by":[5],"decoupling":[6],"the":[7,62],"control":[8],"and":[9,69],"data":[10,37],"planes,":[11],"yet":[12],"this":[13],"centralization":[14],"introduces":[15],"a":[16,19,42],"critical":[17],"vulnerability:":[18],"compromised":[20],"controller":[21],"can":[22],"manipulate":[23],"traffic":[24,49,96],"while":[25],"remaining":[26],"protocol-compliant.":[27],"Existing":[28],"global":[29],"monitoring":[30,60],"techniques":[31],"struggle":[32],"with":[33,104],"scalability":[34],"in":[35,51],"large":[36],"centers.":[38],"This":[39],"paper":[40],"proposes":[41],"scalable":[43],"anomaly":[44],"detection":[45,102],"framework":[46,63],"that":[47],"leverages":[48],"locality":[50],"hierarchical":[52],"SDN":[53,112],"topologies.":[54],"By":[55],"clustering":[56],"switches":[57],"into":[58],"localized":[59],"domains,":[61],"computes":[64],"behavioral":[65],"indices":[66],"per":[67],"cluster":[68],"measures":[70],"inter-cluster":[71],"divergence":[72],"using":[73],"Max":[74],"Pairwise":[75],"Distance":[76],"(MPD).":[77],"A":[78],"supervised":[79],"learning":[80],"model":[81],"classifies":[82],"these":[83],"patterns":[84],"to":[85],"detect":[86],"anomalies":[87],"without":[88],"requiring":[89],"full-network":[90],"visibility.":[91],"Using":[92],"DCT2Gen":[93],"for":[94,110],"realistic":[95],"generation,":[97],"our":[98],"method":[99],"demonstrates":[100],"high":[101],"accuracy":[103],"low":[105],"overhead,":[106],"making":[107],"it":[108],"suitable":[109],"large-scale":[111],"deployments.":[113]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-11-06T00:00:00"}