Authors - Vinod B. Maniyat, Arun Kumar B. R, Shreyas A Abstract - Stealthy rogue components pose as legitimate nodes and progressively deteriorate services, take over flows, or taint network topology, posing serious scalability and security threats to modern SDN networks. High false positive rates, poor interpretability, and static threat assumptions make it difficult for current rule-based and signature-driven detection systems to detect such contextual threats. Based on the Dynamic Containment Score (DCS), a mathematically modelled, context-sensitive metric that measures each network node’s disruptive potential, this work offers a comprehensive behavioural defence paradigm. The framework integrates graph theoretic features, protocol specific entropy, and temporal volatility to compute real time DCS rankings, refined through SHAP based explainability and confidence bounded feature attribution for adaptive detection under concept drift. A multi strategy containment engine, including deception based mitigation, redirects attackers toward synthetic vulnerabilities. Validation on hybrid real world and adversarial traffic demonstrates superior early detection, explainable risk attribution, and efficient mitigation with minimal service disruption.
Open Zoom