Abstract

Software-Defined Networking has reshaped how modern infrastructures move traffic by pulling forwarding intelligence into one programmable controller. The same design choice creates a single pressure point that attackers can push against. We present AI-MSDN, a security monitoring framework that watches flow level statistics directly at the SDN controller and flags hostile activity without inspecting packet payloads. The detection pipeline runs in two stages: a CNN-LSTM block extracts spatial correlations and temporal rhythms from controller telemetry, then a Random Forest ensemble decides what counts as normal traffic. Every alert carries a SHAP attribution report so the analyst can read off which features drove the decision. We train on the InSDN dataset and validate on a Mininet and ONOS testbed. AI-MSDN reaches 98.71 percent accuracy with an F1 score of 98.43 percent and a false positive rate of 0.29 percent, averaged over five-fold cross validation. Average alert latency is 23.6 ms with a 95th percentile of 39.8 ms, which keeps controller round trip latency inside operational bounds during sustained attack workload.