A hybrid IndRNNLSTM approach for real-time anomaly detection in
  software-defined networks
Sajjad Salem Salman Asoudeh
Anomaly detection in SDN using data flow prediction is a difficult task. This
problem is included in the category of time series and regression problems.
Machine learning approaches are challenging in this field due to the manual
selection of features. On the other hand, deep learning approaches have
important features due to the automatic selection of features. Meanwhile,
RNN-based approaches have been used the most. The LSTM and GRU approaches learn
dependent entities well; on the other hand, the IndRNN approach learns
non-dependent entities in time series. The proposed approach tried to use a
combination of IndRNN and LSTM approaches to learn dependent and non-dependent
features. Feature selection approaches also provide a suitable view of features
for the models; for this purpose, four feature selection models, Filter,
Wrapper, Embedded, and Autoencoder were used. The proposed IndRNNLSTM
algorithm, in combination with Embedded, was able to achieve MAE=1.22 and
RMSE=9.92 on NSL-KDD data.