DCGANN for Distributed Intrusion Detection in SDDCs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualized network solutions, such as VMware NSX, have localized firewall and intrusion detection systems that are ineffective in detecting and preventing coordinated distributed attacks across multiple software-defined data centers (SDDCs) within a region, as each SDDC may face different types of attacks.
Innovation Solution
A centralized deep generative adversarial neural network (DCGANN) is implemented to receive and combine knowledge from local convolutional neural networks (CNNs) in each SDDC, distributing this collective knowledge back to each local CNN, enabling them to collectively detect and defend against distributed attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If localized intrusion detection systems are deployed in each SDDC, then each SDDC can detect and prevent local attacks effectively, but the system cannot detect coordinated distributed attacks across multiple SDDCs
Solution Approach 1:
The patent merges multiple localized intrusion detection systems into a centralized federated learning framework where DCNN models from different SDDCs are aggregated. The central server collects local DCNN parameters from multiple SDDCs, aggregates them using federated averaging, and distributes updated parameters back to all participants, enabling collective detection capability across distributed environments while maintaining local deployment.
Solution Approach 2:
The intrusion detection system is designed with universal applicability across multiple SDDCs through a unified DCNN architecture. The same DCNN model structure and training framework are applied universally to all participating SDDCs, allowing each system to benefit from collective knowledge while maintaining consistency in detection capabilities across diverse distributed environments.
2Adaptability or versatility
If multiple SDDCs share attack knowledge centrally, then collective detection capability improves, but system complexity and communication overhead increase
Solution Approach 1:
Each SDDC's local DCNN independently processes and extracts features from its own traffic data, performing self-service feature extraction without requiring centralized data collection. The local models autonomously update their parameters based on federated learning iterations, reducing the burden on central infrastructure while still achieving knowledge sharing.
Solution Approach 2:
A central server acts as an intermediary that coordinates federated learning without centralizing sensitive traffic data. The server aggregates DCNN parameters from multiple SDDCs, computes updated model weights through federated averaging, and distributes them back to participants, enabling knowledge sharing while maintaining data privacy and reducing communication overhead compared to centralized data collection.
3Productivity
If localized DCNN models are trained independently in each SDDC, then training speed is fast, but the models lack knowledge of attacks occurring in other SDDCs
Solution Approach 1:
Local DCNN models perform preliminary training independently on their respective SDDC traffic data before participating in federated learning iterations. This preliminary action allows each model to quickly adapt to local attack patterns while maintaining training speed, and then these pre-trained models contribute their learned knowledge to the centralized aggregation process, combining fast local adaptation with comprehensive knowledge sharing.
Data Source
AI summary
Described herein are embodiments for transferring knowledge of intrusion signatures derived from a number of software-defined data centers (SDDCs), each of which has an intrusion detection system (IDS) with a convolutional neural network (CNN) to a centralized neural network. The centralized neural network is implemented as a generative adversarial neural network (GANN) having a multi-feed discriminator and a generator, which is trained from the discriminator. Knowledge in the GANN is then transferred back to the CNNs in each of the SDDCs. In this manner, each CNN obtains the learning of the CNNs in nearby IDSs of a region so that a distributed attack on each of the CNNs, such as a denial of service attack, can be defended by each of the CNNs.