Original title: Integrated Anomaly Detection and Mitigation in SDN Environments: A Hybrid Approach
Sherzod Gulomov, Sodikjon Jumayev, Suhrobjon Bozorov, Boykuziev Ilkhom +2 · September 2026
Modern computer networks face complex attacks that old, static security rules cannot stop. To fix this, researchers built an integrated defense system for software-defined networks, where software controls data traffic. Their framework combines four parts: traffic isolation, deep packet inspection using neural networks, attack prediction, and log analysis. Instead of running one after another, these tools run at the same time. They share a single risk score to spot threats and block bad traffic automatically. The team trained the models using federated learningA way to train AI across many locations without moving their private data—each location trains locally and only shares updates to improve a shared model., which keeps private data stored locally. In tests, the packet inspector reached 98.9% classification accuracy in 14 ms. The attack predictor scored 98.4% detection accuracy in 7.2 ms. The isolation tool caught 94.3%. of attacks and blocked traffic in 10.1 s. Testing showed that running all parts together stopped system errors and beat every individual tool alone.
Imagine four different security guards watching a building from different angles. One checks badges, one watches for unusual behavior, one reads license plates, and one monitors sensor data. Alone each guard misses a lot or raises false alarms—like the badge guard missing someone sneaking through a side door. Now imagine they all report to a central coordinator who weighs their reports together before deciding to lock a door. In this paper, the four detection systems are those guards, and the risk-scoring coordinator decides when to block traffic, catching more real threats with far fewer mistakes than any single guard.
If you use a video service or cloud app, your traffic passes through defenses that try to spot attacks in real time. Most defenses run one detection method, which misses subtle threats or floods operators with false alarms. This paper shows that running four different detectors in parallel and coordinating them through a shared scoring system catches more attacks, reduces false alarms by over ten times, and responds faster than any single detector alone. It also keeps your data local by training on each network's own traffic without sharing raw data.
The abstract reports component-level measurements and separate integrated evaluation on a synthetic dataset, so real-world performance on production networks is not established. The ablation study uses its own experimental numbers that differ from component evaluations, and the 89.2% integrated accuracy is well below the individual detectors' 94-99% figures, suggesting the scoring mechanism trades some accuracy for coordination benefits. Federated learning is mentioned but no convergence or privacy metrics are reported.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Integrated Anomaly Detection and Mitigation in SDN Environments: A Hybrid Approach — Sherzod Gulomov, Sodikjon Jumayev, Suhrobjon Bozorov et al. — Computers — doi:10.3390/computers15090641
Abstract licence: CC BY
Explanation generated by Synthesis from the abstract — it is not the original paper.