ABSTRACT Software Defined Networking (SDN) is an open network approach that has been proposed to address some of the main problems with traditional networks. However, SDN faces cybersecurity issues. To provide a network defense against attacks, an Intrusion Detection System (IDS) needs to be updated and included into the SDN architecture on a regular basis. Machine learning methods have proved effective in detecting intrusions in SDN. Moreover, these techniques pose the problem of significant computational overload and the absence of regular updates when new cyber‐attacks appear. To address these issues, we propose a new SDN‐based cloud intrusion detection system called Continual Federated Learning (CFL). In CFL, we modify the classical federated learning process by granting a more important and dynamic role to each participating client. On the one hand, it can trigger this process whenever a new type of intrusion is detected. On the other hand, once the new model has been identified, the customer can decide whether or not to deploy it in his network. In addition, to verify the accuracy of the CFL system, we have formally specified it by a communication protocol. This specification organizes the exchanges between the different communicating entities involved in the CFL. To verify the accuracy of this specification, we described it using the PROMELA language and checked with the associated SPIN tool. On the experimental side, we deployed this specification of the CFL system in an SDN computing environment. We defined different scenarios, and we proposed that each client decides locally to deploy or not the newly obtained intrusion detection model. The decision is based on a modified metric where we integrate the severity of the intrusions. Experimental results using private local datasets show that the proposed CFL system can efficiently and accurately detect new types of intrusions while preserving client confidentiality. Thus, it can be considered a promising system for SDN‐based edge computing.

Summary Software defined networking (SDN) separates control from data operations. However, this technology adds a new security cost to the network architecture because of the ongoing and developing security vulnerabilities. An intrusion detection system must be continuously improved and integrated into the SDN architecture in order to provide a network defense against attacks. In this study, we propose a continual learning system based on risk assessment to detect intrusion in SDN. We suggest a technique for continually enhancing datasets to produce a more accurate prediction. The proposed system includes various processes, including risk assessment and the selection of the deep learning (DL) approach. We propose assessing the risks related to different intrusion types. Based on the risk value, we can identify which intrusion types are more important and have a dangerous impact. We use the risk values to choose the most appropriate DL approach and for the dataset's continual enrichment. We compare different DL methods using the standard metrics and two proposed metrics. Then, we propose to use a method based on the bit alternation approach to obtain a unique metric for decision‐making. Finally, we have studied the efficacy of our system using two case studies.

Summary Due to the increasing number of vehicles in circulation in different urban cities, several automatic traffic monitoring systems have been developed. In particular, traffic monitoring systems using roadside cameras are becoming extensively deployed, as they offer imperative technological advantages compared with other traffic monitoring systems. Vehicle detection and traffic congestion classification are two main steps for video‐based traffic congestion detection systems; the associated methods have a deep impact on the performance of the whole system. In this paper, we investigate four selected vehicle detection methods namely Gaussian Mixture Model (GMM), GMM‐Kalman filter, Optical Flow, and ACF object detector in two contexts: urban and highway. Three traffic congestion classification methods are also studied. The comparative study of the different methods allows us to choose the most appropriate ones to be integrated in the framework proposed to solve the traffic issues in the bridge of Bizerte.