Machine Learning-Based Detection of Compromised Flow-Monitoring Services in Software-Defined Networking

Security vulnerabilities in Software-Defined Networking (SDN) can expose entire network infrastructures to substantial risk, as the centralised controller represents a single point of failure. In numerous operational deployments, flow-monitoring services such as sFlow-RT provide critical real-time visibility into network traffic behaviour and facilitate early identification of anomalous patterns. When such monitoring services are tampered or compromised, the controller loses essential visibility, enabling malicious activities to proceed undetected. This research investigates the application of machine learning techniques to identify tampering with the sFlow-RT service. The study evaluates the impact of various attack scenarios on SDN operational behaviour and analyses the detection capabilities of multiple machine learning models in identifying these perturbations. The experimental results demonstrate that machine learning-based detection mechanisms enhance accuracy and system resilience when monitoring services are compromised. These findings provide empirical support for the development of adaptive security mechanisms that leverage machine learning models such as models Logistic Regression, Random Forest, Support Vector Machine, Gradient Boosting, and K-Nearest Neighbor to protect the network infrastructure and strengthen overall reliability and security of critical infrastructures.