Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning

Abstract

Adversaries now move faster than manual response processes can absorb. The average eCrime breakout time, that is, the interval between initial access and the first lateral movement to another host, fell to 29 minutes in 2025, a 65% increase in speed over the previous year; the fastest observed breakout took 27 seconds, and in one intrusion data exfiltration began within four minutes of initial access. This work presents a machine learning based system that monitors network traffic in real time, diagnoses attacks, and automatically applies countermeasures in software-defined networks, so that detection and response no longer depend on human intervention. The system comprises two modules: Network Dataset Creation (NDC), which collects IP flows, preprocesses and aggregates them to build the training dataset, and Intrusion Prevention System (IPS), which automates the modeling, training, and evaluation of different algorithms and triggers blocking actions on the SDN controller. A case study with a SYN flooding denial of service attack, shows the attack being detected and blocked in 21 seconds without human intervention, a response time compatible with the window imposed by current breakout times.