As an important part of intrusion detection, feature selection plays a significant role in improving the performance of intrusion detection. Krill herd (KH) algorithm is an efficient swarm intelligence algorithm with excellent performance in data mining. To solve the problem of low efficiency and high false positive rate in intrusion detection caused by increasing high-dimensional data, an improved krill swarm algorithm based on linear nearest neighbor lasso step (LNNLS-KH) is proposed for feature selection of network intrusion detection. The number of selected features and classification accuracy are introduced into fitness evaluation function of LNNLS-KH algorithm, and the physical diffusion motion of the krill individuals is transformed by a nonlinear method. Meanwhile, the linear nearest neighbor lasso step optimization is performed on the updated krill herd position in order to derive the global optimal solution. Experiments show that the LNNLS-KH algorithm retains 7 features in NSL-KDD dataset and 10.2 features in CICIDS2017 dataset on average, which effectively eliminates redundant features while ensuring high detection accuracy. Compared with the CMPSO, ACO, KH, and IKH algorithms, it reduces features by 44%, 42.86%, 34.88%, and 24.32% in NSL-KDD dataset, and 57.85%, 52.34%, 27.14%, and 25% in CICIDS2017 dataset, respectively. The classification accuracy increased by 10.03% and 5.39%, and the detection rate increased by 8.63% and 5.45%. Time of intrusion detection decreased by 12.41% and 4.03% on average. Furthermore, LNNLS-KH algorithm quickly jumps out of the local optimal solution and shows good performance in the optimal fitness iteration curve, convergence speed, and false positive rate of detection.

Software Defined Networking (SDN) realizes the full decoupling between control plane and data plane, and it could effectively simplify network management and promote network innovation. In the large SDN network, there are the single point of failure and the lack of control resources for one centralized SDN controller, so several researchers have presented deploying multi-controller to improve the reliability and scalability of the network. However, unreasonable deployment of multiple controllers may cause the unbalanced distribution of controller loads, and it is harmful to the network stability. In order to address the above problems, this paper proposes Bidirectional Matching Strategy (BMS) and designs its corresponding algorithm to implement multi-controller deployment. Firstly, through collecting the information of hops, delay and traffic in the network, we build the matching lists of switches and controllers respectively. Then according to the specific sequencing of elements in the matching lists, we design a mutual selection strategy that the switch and controller will select the optimal elements from its list to implement matching in turns until realizing the construction of the distributed network. Meanwhile, we implement the strict mathematical derivation to demonstrate the feasibility of BMS. Finally, simulation shows that BMS can achieve the better multi-controller deployment when compared with the existing algorithms.

Due to the high mobility of unmanned aerial vehicles (UAVs), the network topology may change frequently, making persistent connectivity and fault tolerance difficult. Deep reinforcement learning (DRL) offers the opportunity to make proper actions in a large decision space, which could be utilized for the complicated topology control of flying ad-hoc networks. However, how to train and deploy the DRL algorithms on resource-limited and hardware-constrained UAVs to ensure network connectivity and fault tolerance still faces huge challenges. In this work, a topology control method based on positional movement and DRL is proposed, which is suitable for topology construction and topology adjustment. First, a centroid-guided target-driven method is designed to transform arbitrary graphs into 2-connected graphs by connecting each node with its two designated target nodes in a specific order. Then, a topology control method based on the centroid-guided target-driven method and soft actor–critic (CGTD-SAC) is proposed. CGTD-SAC trains agents to keep connectivity with two target agents and keep a safe distance from surrounding agents. CGTD-SAC generates 2-connected topologies in a distributed manner. CGTD-SAC is a tiny algorithm with low computational complexity and less communication overhead. Finally, experiments demonstrate that CGTD-SAC has an excellent ability to obtain network topologies with 2-connectivity, suitable link length, and appropriate number of links.

传统研究认为网络间相依边的引入使网络鲁棒性大幅降低, 但现实相依网络的鲁棒性往往优于理论结果. 通过观察现实相依网络的级联失效过程, 发现节点不会因相依节点失效而损失所有连接边, 且由于网络节点的异质性, 每个节点的连接边失效概率也不尽相同. 针对此现象, 提出一种异质弱相依网络模型, 与传统网络逾渗模型不同, 本文认为两个弱相依节点的其中一个失效后, 另一个节点的连接边以概率γ失效而不是全部失效, 并且不同节点连接边失效概率γ会因节点的异质性而不同. 通过理论分析给出模型基于生成函数的逾渗方程, 求解出任意随机分布异质对称弱相依网络的连续相变点. 仿真结果表明方程的理论解与随机网络逾渗模拟值相符合, 网络鲁棒性随着弱相依关系异质程度的增大而提高.

Modern decentralized deep learning methods for network intrusion detection in Software-Defined Networking (SDN)-enabled Industrial Internet of Things (IIoT) environments encounter significant challenges, particularly for IIoT data heterogeneity and privacy leakage. To this end, we propose a novel framework for network intrusion detection, dubbed SFLNID, that improves Federated Learning (FL) to ensure both efficient training and privacy preservation in SDN-enabled IIoT. Specifically, we firstly design joint optimization mechanism for unbalanced and non-IID data, which introduces a Focal loss as the loss function, and leverages the Wasserstein distance between global and local models as the regularization term. In addition, we improve adaptive differential privacy with dynamic gradient clipping techniques, adjusting the clip-threshold based on Holt exponential smoothing to achieve privacy protection during the local model training. Moreover, we develop a customized CNN-GRU model tailored for FL-based network intrusion detection to make a tradeoff between model accuracy and overheads. Theoretical analysis confirms the convergence and privacy guarantees of SFLNID. Extensive experiments, conducted on well-known IIoT datasets including ToN-IoT, RT-IoT and Edge-IIoT, demonstrate that SFLNID outperforms the state-of-the-art methods in terms of detection accuracy, communication overhead, and cooperative privacy preservation.