Figure 1.
SDN architecture and its fundamental abstractions [4].
Figure 2.
Framework for Proposed System.
Table 1.
Summary of notation used throughout the paper.
| Symbol | Description |
|---|---|
| G = (V, E) | Flow graph with node set V and edge set E |
| u, v | Nodes, each representing a network flow |
| xu | Input feature vector of node u |
| hu(l) | Hidden representation of node u at layer l |
| N(u) | Neighbourhood (adjacent flows) of node u |
| ⨁ | Permutation-invariant aggregation (sum) |
| 𝜓, ϕ | Message and update functions |
| W, b | Learnable weight matrix and bias |
| 𝜎(.) | Z-IsoSigmoid activation |
| hG | Graph-level embedding |
| Pool(.) | Readout (mean / sum pooling) |
| A, Â, D, I | Adjacency, normalised adjacency, degree, identity |
| k | Neighbours in the kNN graph (k = 10 |
| K | Number of selected features (k = 14) |
| d | Feature / embedding dimension |
| L | Training loss |
| bp | Breeding probability in EKPC-BOA |
| g_best | Global best solution in EKPC-BOA |
| sizeb, sizew | Elite and worker group sizes |
Table 2.
CIC-DDoS2019 dataset statistics used in this work.
| Property | Value |
|---|---|
| Total labelled flows | 431,371 |
| Attack flows | 333,540 (77.3%) |
| Benign flows | 97,831 (22.7%) |
| Class-imbalance ratio | 3.41:1 |
| Raw CICFlowMeter features | 80+ |
| Features after EKPC-BOA | 14 |
| Train / test split | 80:20 |
| Training / testing flows | 345,097 / 86,274 |
Table 3.
Performance comparison of deep learning models.
| Model | Acc | Prec | Rec | F1 | Sens | Spec |
|---|---|---|---|---|---|---|
| DNN | 89.60 | 89.59 | 91.06 | 90.32 | 91.06 | 87.93 |
| LSTM | 91.68 | 91.28 | 93.33 | 92.30 | 93.33 | 89.80 |
| BiLSTM | 93.77 | 93.06 | 95.37 | 94.20 | 95.37 | 91.96 |
| GNN | 95.86 | 95.54 | 96.67 | 96.10 | 96.67 | 94.91 |
| GCN | 96.18 | 95.92 | 96.95 | 96.43 | 96.95 | 95.31 |
| GAT | 96.58 | 96.39 | 97.06 | 96.72 | 97.06 | 95.93 |
| ZIS-GNN | 97.36 | 97.37 | 97.79 | 97.58 | 97.79 | 96.86 |
Table 4.
Experimental parameter settings (from the implementation).
| ZIS-GNN parameter | Value |
|---|---|
| Optimizer | Adam (β1 = 0.9, β2 = 0.999) |
| Learning rate | 0.001 |
| Batch size | 50 |
| Number of epochs | 100 |
| Hidden-layer dimension | 4 |
| Activation | |
| Loss function | Categorical cross-entropy |
| Feature scaling / split | MinMax [-1,1] / 80:20 |
| EKPC-BOA parameter | Value |
| Population size | 100 |
| Number of iterations | 50 |
| Breeding probability (bp) | 0.75 |
| Elite group size | pop / 5 = 20 |
| Problem size / domain | 100 / [-100,100] |
| Fitness function | weighted accuracy / subset-size trade-off |
| Stopping criterion | max iterations reached |
| Random seed | fixed (42) |
| Selected feature subset (top-K) | 14 features |
Figure 3.
Confusion matrices of models and proposed ZIS-GNN.
Table 5.
Ablation study of the proposed components (accuracy, %).
| Configuration | Accuracy |
|---|---|
| GNN (baseline) | 95.86 |
| GNN + EKPC-BOA | 96.40 |
| ZIS-GNN without feature selection | 96.20 |
| ZIS-GNN + EKPC-BOA (proposed) | 97.36 |
| No feature selection (all features) | 96.20 |
| Entropy only | 96.55 |
| Pearson correlation only | 96.70 |
| BOA only | 96.95 |
| EKPC-BOA (entropy + Pearson + BOA) | 97.36 |
Table 6.
FPR, FNR and ROC-AUC across models.
| Model | FPR (%) | FNR (%) | ROC-AUC |
|---|---|---|---|
| DNN | 12.07 | 8.94 | 0.928 |
| LSTM | 10.20 | 6.67 | 0.947 |
| BiLSTM | 8.04 | 4.63 | 0.962 |
| GNN | 5.09 | 3.33 | 0.972 |
| GCN | 4.69 | 3.05 | 0.978 |
| GAT | 4.07 | 2.94 | 0.982 |
| ZIS-GNN | 3.14 | 2.21 | 0.991 |
Table 7.
Computational cost of the models.
| Model | Train (s) | Infer (ms/flow) | Mem (MB) |
|---|---|---|---|
| DNN | 58.5 | 0.42 | 120 |
| LSTM | 53.6 | 0.55 | 180 |
| BiLSTM | 47.1 | 0.78 | 240 |
| GNN | 42.7 | 0.31 | 150 |
| GCN | 40.5 | 0.29 | 145 |
| GAT | 43.8 | 0.33 | 160 |
| ZIS-GNN | 37.5 | 0.27 | 110 |
Figure 4.
Overall performance comparison.
Figure 5.
Performance metrics (PPV, NPV, TPR, and TNR) for ZIS-GNN and baseline models.
Figure 6.
AUC-based performance comparison of ZIS-GNN and baseline models.
Figure 7.
Training time comparison of ZIS-GNN and baseline models.