The numerical values of the experiment results.

Along with the expansion of Internet of Things (IoT), the importance of security and intrusion detection in this network also increases, and the need for new and architecture-specific intrusion detection systems (IDS) is felt. In this article, a distributed intrusion detection system based on a software defined networking (SDN) is presented. In this method, the network structure is divided into a set of sub-networks using the SDN architecture, and intrusion detection is performed in each sub-network using a controller node. In order to detect intrusion in each sub-network, a decision tree optimized by black hole optimization (BHO) algorithm is used. Thus, the decision tree deployed in each sub-network is pruned by BHO, and the split points in its decision nodes are also determined in such a way that the accuracy of each tree in detecting sub-network attacks is maximized. The performance of the proposed method is evaluated in a simulated environment and its performance in detecting attacks using the NSLKDD and NSW-NB15 databases is examined. The results show that the proposed method can identify attacks in the NSLKDD and NSW-NB15 databases with an accuracy of 99.2% and 97.2%, respectively, which indicates an increase compared to previous methods.

随着物联网（Internet of Things，IoT）的规模持续扩张，其网络安全与入侵检测的重要性日益凸显，针对特定架构的新型入侵检测系统（intrusion detection systems，IDS）的需求愈发迫切。本文提出了一种基于软件定义网络（software defined networking，SDN）的分布式入侵检测系统。该方法依托SDN架构将整体网络划分为若干子网，并通过各子网内的控制器节点开展入侵检测任务。为实现各子网内的入侵检测，本文采用了经黑洞优化（black hole optimization，BHO）算法优化的决策树模型。具体而言，部署于各子网的决策树将通过BHO算法完成剪枝操作，其决策节点的分裂点也将被优化，以最大化该决策树对子网攻击的检测准确率。本文在仿真环境中对所提方法的性能进行了评估，并通过NSLKDD与NSW-NB15数据集检验了其攻击检测性能。实验结果表明，所提方法在NSLKDD和NSW-NB15数据集上的攻击检测准确率分别可达99.2%与97.2%，较现有同类方法性能有所提升。