Kaya Emre Arikan

This study presents the development of a realistic and comprehensive SDN-ATK dataset designed to evaluate the effectiveness of machine learning (ML) and deep learning (DL) approaches for attack detection in Software-Defined Networking (SDN) environments. Unlike existing datasets, SDN-ATK explicitly includes attacks targeting key SDN components such as SDN controllers and OpenFlow switches, addressing a critical gap in current research. We evaluated three ML (XGBoost, Random Forest, and Decision Tree) and three DL (Convolutional Neural Network (CNN), Feed-forward Neural Network (FNN), and Long Short-Term Memory (LSTM)) algorithms across binary and multiclass classification tasks to assess detection performance. Our results demonstrate that DL models, particularly FNN and CNN outperform ML counterparts, achieving 98–99% accuracy, precision, and recall in binary classification. Explainability analyses were conducted using SHAP (SHapley Additive explanations) on the XGBoost model, offering valuable insights into the importance of feature and improving transparency in ML-based attack detection. The study’s findings provide critical guidance for both academia and industry, highlighting that within our Ryu-based SDN testbed, DL models demonstrated more reliable and balanced performance for large-scale attack detection. This work lays a solid foundation for future research, including developing real-time, intelligent, and explainable intrusion detection systems for SDN environments.

In the realm of software development, quality reigns supreme, but the ever-present danger of vulnerabilities threatens to undermine this fundamental principle. Insufficient early vulnerability identification is a key factor in releasing numerous apps with compromised security measures. The most effective solution could be using machine learning models trained on labeled datasets; however, existing datasets still struggle to meet this need fully. Our research constructs a vulnerability dataset for Android application source code, primarily based on the Common Vulnerabilities and Exposures (CVE) system, using data derived from real-world developers’ vulnerability-fixing commits. This dataset was obtained by systematically searching such commits on GitHub using well-designed keywords. This study created the dataset using vulnerable code snippets from 366,231 out of 2.9 million analyzed repositories. All scripts used for data collection, processing, and refinement and the generated dataset are publicly available on GitHub. Experimental results demonstrate that fine-tuned Support Vector Machine and Logistic Regression models trained on this dataset achieve an accuracy of 98.71%, highlighting their effectiveness in vulnerability detection.

Security Socket Layer (SSL) / Transport Layer Security (TLS) protocols are utilized to secure network communication (e.g., transmitting user data). Failing to properly implement SSL/TLS configuration during the app development results in security risks. The weak implementations include trusting all host names, trusting all certificates, ignoring certificate verification errors, even lack of SSL public key pinning usage. These unsecured implementations may cause Man-In-The-Middle (MITM) attacks. The major aim of this research is to detect configuration errors of SSL/TLS implementation in Android apps. We combine existing open-source tools and streamline the analysis process with the combination of automated static analysis and dynamic analysis with manual assistance. We scan for four types of vulnerabilities in the static analysis phase and verify misuse of SSL/TLS in the dynamic analysis phase. The dynamic analysis is essential for eliminating false positives generated at the static analysis stage. We analyze 109 apps from Google Play Store and the experimental results show that 45 (41.28%) apps contain potential security errors in the application of SSL/TLS. We verify that 19 (17.43%) out of 109 apps are vulnerable to MITM attacks.