A Hierarchical Hybrid Deep Learning Framework for Unknown Attack Detection in SDN Networks

Software-Defined Networking (SDN) introduces new security challenges that require detecting both known and previously unseen attacks. This paper presents a novel hierarchical hybrid deep learning framework for SDN intrusion detection, combining a supervised 1D convolutional neural network with an unsupervised MLP autoencoder in a two-stage pipeline. The approach is evaluated on KRONOS-SDN, a realistic SDN-specific intrusion detection dataset generated in a controlled cyber-range. Evaluation is done using a leave-one-out attack strategy to simulate zero-day attacks. Obtained results show improved recall on unseen attacks compared to anomaly detection alone, while maintaining a stable false positive rate on benign traffic.