{"id":"https://openalex.org/W7155502774","doi":"https://doi.org/10.48550/arxiv.2604.20934","title":"SDNGuardStack: An Explainable Ensemble Learning Framework for High-Accuracy Intrusion Detection in Software-Defined Networks","display_name":"SDNGuardStack: An Explainable Ensemble Learning Framework for High-Accuracy Intrusion Detection in Software-Defined Networks","publication_year":2026,"publication_date":"2026-04-22","ids":{"openalex":"https://openalex.org/W7155502774","doi":"https://doi.org/10.48550/arxiv.2604.20934"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.20934","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.20934","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.20934","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134477711","display_name":"Ashikuzzaman","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ashikuzzaman","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134497641","display_name":"Md. Saifuzzaman Abhi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Abhi, Md. Saifuzzaman","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062053448","display_name":"Mahabubur Rahman","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rahman, Mahabubur","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134535779","display_name":"Md. Manjur Ahmed","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ahmed, Md. Manjur","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113698509","display_name":"Md. Mehedi Hasan","orcid":"https://orcid.org/0000-0002-8826-1576"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hasan, Md. Mehedi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5019112399","display_name":"Md. Ahsan Arif","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Arif, Md. Ahsan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9882000088691711,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9882000088691711,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0031999999191612005,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.0020000000949949026,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7472000122070312},{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"Ensemble learning","score":0.5138000249862671},{"id":"https://openalex.org/keywords/header","display_name":"Header","score":0.49709999561309814},{"id":"https://openalex.org/keywords/feature-selection","display_name":"Feature selection","score":0.48420000076293945},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.42489999532699585},{"id":"https://openalex.org/keywords/preprocessor","display_name":"Preprocessor","score":0.40700000524520874},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4002000093460083},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3695000112056732}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7520999908447266},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7472000122070312},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.5138000249862671},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5016000270843506},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.49790000915527344},{"id":"https://openalex.org/C48105269","wikidata":"https://www.wikidata.org/wiki/Q1141160","display_name":"Header","level":2,"score":0.49709999561309814},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.48420000076293945},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.45579999685287476},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.42489999532699585},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.40700000524520874},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4002000093460083},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3695000112056732},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.3547999858856201},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.35269999504089355},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.33629998564720154},{"id":"https://openalex.org/C10551718","wikidata":"https://www.wikidata.org/wiki/Q5227332","display_name":"Data pre-processing","level":2,"score":0.32260000705718994},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.30959999561309814},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.29910001158714294},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.29190000891685486},{"id":"https://openalex.org/C2778775528","wikidata":"https://www.wikidata.org/wiki/Q5135432","display_name":"Closing (real estate)","level":2,"score":0.27140000462532043},{"id":"https://openalex.org/C100776233","wikidata":"https://www.wikidata.org/wiki/Q2532492","display_name":"Bridge (graph theory)","level":2,"score":0.25999999046325684}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.20934","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.20934","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.20934","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.20934","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"sustainable_development_goals":[{"score":0.6338874697685242,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Software-Defined":[0],"Networking":[1],"(SDN)":[2],"is":[3,51,55,156,182],"another":[4],"technology":[5],"that":[6,128],"has":[7,130],"been":[8],"developing":[9],"in":[10,48,71,176,196],"the":[11,60,147,172,177,187,202],"last":[12],"few":[13],"years":[14],"as":[15,171],"a":[16,30,76,86,137,183],"relevant":[17],"technique":[18],"to":[19,97,112,115,123,158,201],"improve":[20],"network":[21,208],"programmability":[22],"and":[23,57,67,85,101,136,145,152,168,193,206],"administration.":[24],"Nonetheless,":[25],"its":[26],"centralized":[27],"design":[28],"presents":[29],"major":[31],"security":[32,120],"issue,":[33],"which":[34,63,92,118,198],"requires":[35],"effective":[36],"intrusion":[37,44,191],"detection":[38,45,99,192],"systems.":[39],"The":[40,125,180],"SDN-specific":[41],"machine":[42],"learning-based":[43],"system":[46],"described":[47],"this":[49],"paper":[50],"innovative":[52],"because":[53],"it":[54],"trained":[56],"tested":[58],"on":[59],"InSDN":[61],"dataset":[62],"models":[64],"attack":[65],"scenarios":[66],"realistic":[68,194],"traffic":[69],"patterns":[70],"SDN.":[72],"Our":[73],"approach":[74],"incorporates":[75],"comprehensive":[77],"preprocessing":[78],"pipeline,":[79],"feature":[80],"selection":[81],"via":[82],"Mutual":[83],"Information,":[84],"novel":[87],"ensemble":[88],"learning":[89],"model,":[90],"SDNGuardStack,":[91],"combines":[93],"multiple":[94],"base":[95],"learners":[96],"enhance":[98],"accuracy":[100,132],"efficiency.":[102],"In":[103],"addition,":[104],"we":[105],"include":[106],"explainable":[107],"AI":[108],"methods,":[109],"including":[110],"SHAP":[111],"add":[113],"transparency":[114],"model":[116,178],"predictions,":[117],"helps":[119],"analysts":[121],"respond":[122],"incidents.":[124],"experiments":[126],"prove":[127],"SDNGuard-Stack":[129],"an":[131],"rate":[133],"of":[134,140,204],"99.98%":[135],"Cohen":[138],"Kappa":[139],"0.9998,":[141],"surpassing":[142],"other":[143],"models,":[144],"at":[146],"same":[148],"time":[149],"being":[150],"interpretable":[151],"practically":[153],"executable.":[154],"It":[155],"interesting":[157],"see":[159],"such":[160],"features":[161],"like":[162],"Flow":[163],"ID,":[164],"Bwd":[165],"Header":[166],"Len,":[167],"Src":[169],"Port":[170],"most":[173],"important":[174],"factors":[175],"predictions.":[179],"work":[181],"step":[184],"towards":[185],"closing":[186],"gap":[188],"between":[189],"performance":[190],"deployment":[195],"SDN,":[197],"will":[199],"lead":[200],"creation":[203],"secure":[205],"resilient":[207],"infrastructures.":[209]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-04-25T00:00:00"}