Software-defined networking (SDN) faces many of the same security threats as traditional networks. The separation of the SDN control plane and data plane makes the controller more vulnerable to cyber attacks. The conventional “perimeter defense” network security model cannot prevent lateral movement attacks caused by malicious insider users or hardware and software vulnerabilities. The “zero trust architecture” has become a new security network model to protect enterprise network security. In this article, we propose an intelligent zero-trust security framework IZTSDN for the software-defined networking by integrating deep learning and zero-trust architecture, which adopts zero-trust architecture to protect every resource and network connection in the network. IZTSDN uses a traffic anomaly detection mode CALSeq2Seql based on a deep learning algorithm to analyze users’ network behavior in real-time and achieve continuous tracking and analysis of users, restrict malicious users from accessing network resources, and realize the dynamic authorization process. Finally, the Mininet simulation platform is extended to build the simulation platform MiniIZTA supporting zero-trust architecture and the proposed security framework IZTSDN is experimentally analyzed. The experimental results show that the IZTSDN security framework can provide about 80.5% of throughput when the network is attacked. The accuracy of abnormal traffic detection reaches 99.56% on the SDN dataset, which verifies that the reliability and availability of the IZTSDN security framework are verified. Since the article contains many abbreviations, the authors provide a table to sum up all of them in advance, the abbreviations are given in However, SDN faces the same threats of many network attacks as traditional networks . The conThe traditional “perimeter defense model” can not prevent internal lateral movement attacks caused by malicious internal users or software vulnerabilities, and only determines whether users’ requests are trusted by dividing the internal and external security zones. The coarse-grained access control makes the inner security zone over-trusted . In 2010Researchers have proposed a large number of machine learning-based intrusion detection schemes  for softTo address the above problems, this article combines deep learning and zero-trust architecture and proposes an Intelligent Zero Trust security framework for SDN (IZTSDN), which consists of five modules: data collection module, trust assessment engine module, intelligent behavior analysis engine module, intelligent controller module, and communication execution module.The data collection module collects the historical behavioral data of users to provide data support for authentication and authorization decisions when the intelligent controller processes user access requests to network resources, so as to better evaluate the legitimacy of user-initiated requests. The trust assessment module uses the trust authentication algorithm to calculate the predicted user’s “trust value” based on the data provided by the data collection module, which is used as an important basis for the intelligent controller module to achieve dynamic authentication and authorization of the user’s application for accessing network resources. The intelligent behavior analysis engine module detects the user’s network behavior in real-time, and uses a deep learning model deployed on the SDN controller to analyze and evaluate the behavior and security status of network-connected users in real time; The intelligent controller module grants users access to network resources based on the user trust value calculated by the trust assessment module, opens the list of network resources accessible to the requesting user, and notifies the gateway of the user’s legitimate connection request information to achieve dynamic authentication of legitimate users and fine-grained access control, at the same time, the intelligent controller module detects and judges the user’s network behavior based on the intelligent behavior analysis module. In the communication execution module, users obtain access rights to network resources and a list of accessible resources, then initiate a request to the gateway to connect to the network resources, and the gateway establishes a two-way authentication communication channel between the user and the network resources in cooperation with the user based on the legitimate user connection request information from the intelligent controller module to achieve secure access to the network resources by the user.The main contributions of this article are as follows:(1) Integrating Deep learning and zero-trust architecture to propose IZTSDN, an intelligent zero-trust security framework for software-defined networking, which aims to be able to prevent internal and external network attacks and protect every network resource and network connection;(2) The IZTSDN framework introduces a traffic anomaly detection model CALSeq2Seq for the detection of anomalous traffic in SDN. The model is evaluated by using the publicly available SDN dataset from Bennett University Research Institute, and the experimental results show that it outperforms other algorithmic models in several evaluation metrics, including accuracy, false alarm rate, precision, recall, and F1-measure, and also compares the models proposed by other researchers, and the results all show that the CALSeq2Seq model has a high accuracy rate and a low false alarm rate.(3) IZTSDN framework introduces a trust algorithm to evaluate the user’s trust value based on the user’s historical behavior data, which is used as one of the important bases for authentication and authorization to access network resources and deep learning algorithm is used to analyze user's network behavior in real-time to realize continuous tracking analysis of users, restrict malicious users from accessing network resources, and realize dynamic authentication and authorization;(4) This article extends the Mininet simulation tool to build a simulation platform MiniIZTA sup-porting zero-trust architecture, which can be used for network protocol analysis and verification under zero-trust architecture.The rest of the article is organized as follows: The background significance of the research topic is introduced in the “Introduction”. The current state of research on cyber attacks in SDNs is presented in “Related Work”. The proposed security framework IZTSDN is introduced in “Intelligent zero-trust security framework for software-defined networking”, and the functions of the five core modules are also described in detail. In “Simulation Experiments”, we describe how to integrate zero-trust components to build the simulation platform MiniIZTA, and evaluate the performance of IZTSDN in terms of two metrics: network throughput and traffic anomaly detection accuracy. Finally, the main research contents of this article are summarized in “Conclusion”.In recent years, it has been a hot topic of research on how to solve network attacks in SDN, and many researchers have conducted in-depth studies on the existence of simple authentication methods in SDN that lead to internal malicious users launching network attacks and frequent DDoS and port scanning attacks on SDN controllers. Many intelligent architectures and anomalous traffic detection frameworks have been proposed in the existing literature to address the threats of security attacks in SDN.NetworkAI  is a netIn addition to the aforementioned researchers using various security mechanisms to propose a security framework, subsequent researchers have successively introduced deep learning methods to detect malicious attacks appearing in the network. A fusion learning security scheme between the data plane and control plane in SDN environments . PredictWith the strong promotion of the zero-trust security concept worldwide in recent years, there are more and more scholars engaged in zero-trust-related research and related results at home and abroad. There are also some studies on using zero-trust architectures to address SDN security, as both are implemented in the form of software-defined programmability and have great similarities. An integrated SDP-SDN architecture  that proDomestic and international researchers have found that in such a complex and dynamic network environment, traditional network security frameworks have obvious weaknesses and are difficult to provide adequate security. The proposal of Zero Trust breaks the previous traditional authentication approach, which is a security concept for meeting the security requirements of networks with untrusted infrastructures. The concept of intelligent zero-trust architecture  is basedExisting studies have shown that this combined model approach can significantly improve the accuracy of deep learning algorithms. A scheme  based onThis article focuses on the analysis and research of network attacks faced in SDN, proposes the corresponding deep learning detection algorithm CALSeq2Seq and trust authentication algorithm UBTA for the identification of abnormal traffic in SDN and the problems of traditional authentication methods, and proposes an intelligent zero-trust framework IZTSDN in order to achieve all-round protection of SDN, and introduces the previously proposed two algorithms in its intelligent engine plane to assist the central controller to issue control policies to achieve intelligence. The proposed two algorithms are introduced in the intelligent engine plane to assist the central controller to issue control policies to achieve intelligence, and the entire framework is completed by the zero-trust software-defined boundary core components. In addition, the zero-trust core components are integrated into Mininet to build the simulation platform MiniIZTA in order to realize the intelligent zero-trust security framework IZTSDN proposed in Chapter 4, and finally, the security and reliability of the framework are verified through simulation experiments.This section details IZTSDN, a software-defined network security framework based on the intelligent zero-trust architecture proposed in this article, which mainly applies the intelligent zero-trust architecture in SDN to solve the existing security problems. The IZTSDN framework is completely based on the core idea of zero-trust architecture and is based on deep learning methods to solve known and unknown security problems in SDN networks and prevent malicious users from launching lateral movement attacks by controlling a node. The general architecture of IZTSDN is given in The IZTSDN framework consists of five modules whose respective functions are described as follows:etc.) to provide data support for authentication and authorization decisions when the intelligent controller processes user access requests to network resources in order to better evaluate the legitimacy of user-initiated requests.(1) Data collection module: This module collects historical user behavior data from multiple dimensions  Trust assessment engine module: This module adopts the dynamic trust authentication algorithm  to calculate the predicted user’s “trust value” based on the data provided by the data collection module, which is used as the intelligent controller module to realize the dynamic authentication and authorization of the user’s application. The value is used as an important basis for the intelligent controller module to achieve dynamic authentication and authorization for users to access network resources.(3) User behavior analysis engine module: This module uses the traffic anomaly detection model CALSeq2Seq to detect attack traffic in the SDN network. The model first uses one-dimensional convolutional neural networks (1DCNN) to extract network features from the collected data, then introduces a self-attentive mechanism to achieve the fusion of key features, and uses the fused high-level features as the input parameters of the LSTM-Seq2Seq structured network. The long short-term memory network (LSTM) is used as the codec of Seq2Seq to learn the dependencies between the features, and finally, the prediction results are output through the fully connected layer. The model analyzes and evaluates the behavior and security status of the network-connected users in real-time.(4) Intelligent controller module: This module grants users access to network resources based on the user trust value calculated by the trust assessment module and the corresponding authentication and access control policies, and opens the list of access network resources to the requesting user, notifies the gateway of the user’s legitimate connection request information, and realizes dynamic authentication as well as fine-grained access control for legitimate users. At the same time, this module, based on the detection and judgment of user network behavior by the behavior analysis module, tracks and blocks illegal operations initiated by malicious internal users in real-time to achieve the purpose of protecting each network connection.(5) Communication execution module: After users obtain access rights to network resources and a list of accessible resources, they initiate a request to the gateway to connect to the network resources. Based on the legitimate user connection request information from the intelligent controller module, the gateway cooperates with the user to establish a two-way authentication communication channel between the user and the network resources to achieve secure user access to the network resources.etc., is obtained in real-time through the OpenFlow protocol, and matching protocol fields in the flow table (such as IP address and port number), as well as flow table-specific fields (such as counters), are extracted. Also, collecting service traffic data, including flow table message data and flow table interval data, enables better detection of attack traffic.To ensure the security and reliability of SDN systems, historical behavioral data needs to be meticulously collected and analyzed. This data covers a variety of information, including user logs, system status information, activity logs, network traffic, resource access operations, and other events, as well as enterprise user information and identity records. By collecting this information and unifying it for processing, dynamic updates of end-user trust values can be achieved, and assist the IZTSDN security framework in discovering potential security threats. To acquire network data from multiple dimensions, the data collected is divided into two parts: SDN flow table data and service flow sequences. Network state information inside the SDN, including flow table information and port statistics, When collecting traffic data, the sampling method used needs to maximize the detection of the way users request services. This is because the flow table data in normal actual user access requests are basically composed of consecutive transactions, each consisting of multiple consecutive requests. In subsequent traffic inspection, a certain slice can be selected to extract the basic characteristics of network traffic and distinguish it from the traffic of simulated attacks. This allows better detection of anomalous traffic and reduces potential security risks.The trust authentication algorithm UBTA based on user behavior is proposed in the trust evaluation engine module. UBTA extracts valid features from user behavior (data collection), analyzes and predicts its real-time trust value, and grants corresponding privileges according to its given operation threshold to provide more fine-grained access control to the accessing users and achieve dynamic continuous authentication to stop unauthorized attacks and intranet attacks.By inputting the historical behavioral data of access users to correspond to the corresponding evaluation factors and weights from multiple dimensions, the trust value of current access users is calculated by their continuous behavioral data, and the trust value of access users is dynamically updated according to the introduced time decay factor. The common behaviors generated by users are given in The user’s historical data is mainly determined by the trust evaluation factor and weight in the trust algorithm. the trust evaluation factor mainly corresponds to the trustworthiness of the current user, 0 represents no trustworthiness, 0.5 represents temporary trustworthiness, and 1 represents complete trustworthiness. This factor is determined according to the degree of deviation of user behavioral data. T denotes the continuity of the data in the duration, and t denotes the continuous login time. As shown in The current trust value of the accessed user is calculated from the mean and standard deviation of the continuous login time, and the current login deviation is normalized. This is shown by If the behavioral data deviation is small, the trust factor is set to 1. If the behavioral data deviation is within a certain range, the trust factor is set to 0.5; if the behavioral data deviation is too large, the trust factor is set to 0.The user’s current trust value is calculated by assigning an initialized weight proportion to each feature dimension and subsequently multiplying it with the trust evaluation factors of each user dimension and then adding them together. This is shown by The accessing user usually has multiple access behaviors, and the user’s historical trust should introduce a time decay factor Trust assessment is to allow legitimate users to access the resources normally. First, let the user initiate a valid SPA data request packet, and use the UBTA algorithm to calculate the user’s trust value According to the trust threshold to grant its access rights, the intelligent controller will send a message to the gateway, making the establishment of access rules flow table so that the gateway can allow the authenticated user to access the resources normally within the specified time period T. In this process, the gateway will continuously receive the intelligent controller to send In this process, the gateway will continue to receive messages from the intelligent controller for user authentication, in the communication process must establish a two-way encrypted channel communication MTLS connection to ensure data transmission security.The highly centralized control plane of SDN is often subjected to various network attacks, which makes the SDN controller prone to paralysis or downtime, resulting in fundamental damage to the entire network environment. It is necessary to design an efficient and accurate traffic anomaly detection model for SDN.After research, it is found that most of the current methods are relatively single deep learning models, which have some limitations in traffic feature extraction. For example, for some complex traffic characteristics, a single deep learning model may not be able to capture all of its information, resulting in incomplete feature expression. In addition, the real-time performance of a single model is weak, and the analysis of network traffic needs real-time processing. However, a single deep learning model may have problems such as long training time and slow prediction time, which will seriously affect the accuracy of model recognition and classification. In order to better detect the anomaly of attack traffic in SDN, a traffic anomaly detection model based on CNN self-attention LSTM-Seq2Seq and CALSeq2Seq is proposed, and the data preprocessing module, feature extraction module, feature fusion module and detection and classification module are designed.The CALSeq2Seq model algorithm uses 1D CNN to extract features from the original data in the feature extraction stage, flattens the extracted feature map into a long vector, introduces the self-attention mechanism to fuse the key features, and uses the high-level features after the feature fusion stage as the input of the LSTM-Seq2Seq structure encoder. These are then decoded to output for timing modeling. The CALSeq2Seq model is given in The main innovations of the model are as follows: the self-attention mechanism is introduced to extract key features, and the obtained advanced features are used as the input of the detection and classification module to improve the prediction and classification ability of the model for network abnormal traffic. In the detection and classification module, a Seq2Seq model based on LSTM as encoder-decoder is used. These LSTM units model the dependencies of existing sequence data, and the accuracy and detection speed are significantly improved.The traffic anomaly detection model CALSeq2Seq is shown in Time consumption and complexity analysis:We have utilized hardware acceleration in training the model to speed up the whole model training, probably each step can probably be controlled to a very small amount of less than 10 s, although it took some time in the training phase, but achieved good results in the subsequent model prediction phase, according to The acquired data usually have abnormal data , so in order to better explore the relationships existing between the data, data pre-processing must be performed before using the data. The main steps include the following:Abnormal data processing: If certain features are found to have missing values in the data, such features need to be removed to prevent errors in data analysis.Feature value encoding: There are more discrete and disordered feature values in the data, and one-hot encoding is needed to help the algorithm model to better train as well as output results, which plays the role of expanding features.Min-Max normalization: the linear transformation of the original data, so that the resultant values are mapped to between . Min-Max normalization reduces the time required to converge to the local minima and improves the model’s accuracy.After anomalous data processing, eigenvalue coding, normalization, and data reshaping in the data preprocessing module, the 1D traffic data of length The first convolution operation uses 32 convolution kernels of size In the second convolution operation, 32 convolution kernels of size After two convolutions and two pooling operations, the final 3D tensor is obtained, and this 3D tensor is represented as a matrix consisting of several 2D slices, where the Kth 2D slice corresponds to a set of feature vectors extracted from a region of the input, denoted as This one-dimensional vector Q , K , and V  are obtained, and the attention score matrix G is obtained by the operation of scaling the dot product, where In order to further strengthen the long-term memory capability of LSTM and make it more perceptive to long-distance information, the self-attentive mechanism is introduced to have a stronger ability to capture long-term dependencies. The output features obtained from the feature extraction stage are used as the input of the self-attentive mechanism, and three transformation matrices V are multiplied to obtain a result matrix Z, which incorporates the self-attentive mechanism, shown by The attentional weight matrix is shown by The LSTM-based Seq2Seq model plays a role in the detection classification module for the predictive classification of traffic generated by user behavior. The model uses an encoder-decoder framework to map the input sequence of values to the output sequence. The encoder converts the high-level features fused by the pre-processing module and the self-attentive mechanism as input sequences into fixed vectors, which are then decoded into output sequences. The encoder in the model consists of LSTM units that attempt to model the dependencies between past and present sequence data, encoding fixed lengths that are also decoded using a sequence of LSTM units.The LSTM sequential model is easier to learn long-term dependence than simple recurrent architecture and solves the problem of gradient disappearance and gradient explosion during training. The LSTM sequential model contains three gates: input gate  Connection initiation component: This component mainly consists of the user and agent, the user is the subject of access, and it is the identity mapping of real users in the network. The agent is the device used to initiate access, the system environment hardware and software, or the program code to initiate access.(2) Connection acceptance component: This component mainly consists of the gateway and the protected resources. The gateway takes measures to allow or block the communication links connected by the user in real time through the policies sent from the policy enforcement component. Protected resources are important information hidden throughout the network, and only users who pass authentication and detection can access the resources.(3) Policy enforcement component: This component is responsible for enabling, monitoring, and eventually ending the connection between the accessing subject and the enterprise resource. The policy enforcement component communicates with the intelligent controller to forward requests and receive real-time updates to policies. It controls the communication link between two different connected components.In order to implement the proposed intelligent zero-trust security framework IZTSDN, the core logical components of the software-defined boundary SDP are integrated in the SDN network simulator Mininet, and the simulation platform MiniIZTA, which can support zero-trust technology and deep learning algorithms, is built. The core logic components of SDP: intelligent controller, policy enforcement component, connection initiation component, and connection acceptance component are integrated into Mininet to build the MiniIZTA emulation platform.To test the usability of the Mininet platform with respect to the SDN emulation environment, a basic network topology was first created that included the attacker, the legitimate user and the service resource the SDN network topology was set up graphically by selecting the icons in the toolbar and continuing to configure the basic properties of each device throughout the network environment. After all the initialization configuration is completed, open the command line interface of the platform to test whether the whole network can communicate normally through the ping command, each terminal can ping the other, indicating that the routing configuration policy usually is accessible to each other during the initialization state. The MiniIZTA Platform is given in SDP core components will be integrated to initialize the MiniIZTA platform, setting both attackers and legitimate users as connection initiation components, while policy enforcement components are set in front of service resources to forward flow table commands from the controller, and access resources are set as connection acceptance components, connecting them to the SDN switch to form a basic SDN network environment.Integrate the software-defined perimeter SDP core components in Mininet to implement zero-trust technology. Through the API interface, the traffic anomaly detection model CALSeq2Seq and the trust authentication algorithm UBTA are written in the controller to achieve real-time detection of network traffic and dynamic and sustainable fine-grained authentication authorization of identity. Zero Trust technology makes up for the disadvantage of “connect first, verify later” in traditional TCP/IP by performing authentication before connection establishment. At the same time, traditional scanning tools cannot scan ports because there are no open ports, thus further securing the network. The entire simulation platform MiniIZTA is launched through both the command line and graphical interface, and the network topology is created after the initialization state is verified and connected.The intelligent zero-trust security framework IZTSDN writes the traffic anomaly detection model CALSeq2Seq and the trust authentication algorithm UBTA into the controller to implement the corresponding functions. to resist attacks effectively.This MiniIZTA platform consists of four Linux Ubuntu virtual machines, where the user module is installed on VM1  and VM2 , the controller module is installed on the host, and the gateway and resource modules are installed on VM3 virtual machine. The switches in the simulation environment are SDN switches supporting the OpenFlow protocol, and the controller is using Ryu. The detailed specification of the VM setup. Detailed settings are given in Before testing the network emulation attack, the Ryu controller needs to be started, and the process can be divided into initializing the configuration, creating an application instance, connecting to the switch, starting the message loop, loading the application, and running the application. The Ryu controller first loads its default configuration file ryu.conf, and second, uses the logging module in the Python standard library to log logging information. At startup, the controller initializes the module and determines the logging level and output based on the settings in the configuration file. Then, it creates an application instance and registers the zero-trust SDP core component code and the deep learning algorithm model into the framework to detect abnormal traffic. Immediately afterward, a connection needs to be established with the OpenFlow switch for message interaction. The controller will listen to a TCP port and wait for a connection request from the switch. Once the connection is successful, the controller sends a Hello message for negotiation and then enters the normal message processing flow. The final stage is to load all the modules in the directory and start running all the executable applications, implementing all the functions of the IZTSDN security framework regarding the Intelligent Engine module on the Ryu controller, in addition to the other component contents that are programmatically defined in the corresponding terminal software to implement their functions. The Ryu controller start-up interface, which starts communicating with other components in the simulation platform. Ryu controller starts normally is given in Nmap is a popular open-source network discovery and security auditing tool that can be used to scan hosts and services on a computer network and generate detailed reports. It uses different techniques to identify information such as the operating system, application version, and open ports running on the target host. The specific steps of the attack test are as follows:(1) Open a command line terminal window and on the command line, enter the IP address or domain name of the target to be scanned.(2) Determine the object to be scanned and the port number. The scan will scan 1,000 common ports by default, and if more ports need to be scanned, you need to specify the port range. Experiment by testing to scan port 22, which is the default port for SSH protocol, an encrypted network protocol used for secure remote login and other network services on insecure networks.(3) Wait and check the scan result, a normal scan of port 22 using Nmap returns a status of open, which means that the port is open and there is a program running that is listening to the port, which indicates that services associated with the port may be accessible and exploitable. When the IZTSDN security framework was used, port 22 was scanned again with Nmap, and the status returned was filtered, which means that the port did not explicitly respond to the probe packets sent by Nmap. This is because IZTSDN does not give any response information until the identity of the accessing user is confirmed, which fundamentally prevents the transmission of similar probe packets.In the DDoS simulation attack experiment, the attack test is launched using hping3, which is a common network tool that can be used to generate various types of traffic packets, including normal traffic and attack traffic. In hping3, normal and attack traffic can be simulated by setting different parameters and options. DDoS simulation attack test generation traffic is given in To simulate normal traffic, use the “-S” option to send TCP SYN packets, which is the first step of the TCP three-times handshake, indicating a connection request. Use the “-1” option to send ICMP Echo request packets, also known as Ping request packets. Use the “-2” option to send UDP packets, which are the type of packets that a normal application would send.When simulating attack traffic, use the “--flood” option to send a TCP SYN Flood attack, which sends a large number of TCP SYN packets to the target host, making its service unavailable. Use the “--udp” option to send a UDP Flood attack, which sends a large number of UDP packets to the target host. Use “--icmp” option to send an ICMP Echo Flood attack, it will send a large number of Ping request packets to the target host, these attacks will cause the target host to run out of resources, but also are some common denial of service attacks.In this section, we implement the IZTSDN security framework on the simulation platform and evaluate its performance, mainly from the two evaluation metrics of network performance and traffic anomaly detection accuracy to verify the security of this framework.Two virtual machines were set up in the experiment, VM1 as a legitimate user client and VM2 as an illegitimate user client, with the aim of testing the impact of access under normal conditions and access under DDoS attacks on network performance. Initialize server-side bandwidth is given in The initial bandwidth of the network environment. The default port is set to 5,001 using TCP protocol, and the initial TCP bandwidth is about 3.5 Gbps, while the UDP bandwidth is set to 10 Mbps to verify the network throughput under normal conditions and after using the IZTSDN security framework. The illegal user client VM2 uses the hping3 tool to launch DDoS attacks and port scanning attacks to destroy the throughput in the whole network environment by consuming a large amount of bandwidth of the SDN network. Also, the Iperf tool is used to display the network throughput in real-time in both cases when launching the attack test. Note that hping3 can construct virtual TCP packets in a short period of time to massively consume the bandwidth of the SDN network.On VM2, the hping3 tool is used to launch attacks, by default in TCP mode. hping3 spoofs random IP addresses to quickly launch TCP requests, thus consuming bandwidth. In Iperf test results, “bandwidth” usually refers to the actual data transfer rate, which is also known as network throughput. It reflects the actual efficiency of data transmission during the test period. The overall performance of the entire network drops dramatically to around a few Mb/s or even lower. Launch DDoS and PS attacks under normal circumstances is given in Under normal circumstances, when DDoS attacks and PS attacks are launched, the data volume and bandwidth of the entire network environment transmitted within a certain time interval drop sharply to less than 1%, and it is no longer possible to provide normal services to normal users. In contrast, after using the security framework IZTSDN, the same scale of the attack is launched and the network throughput is observed. IZTSDN is basically free from unauthorized attacks and can forward and receive packets normally within the 90 s of the test time. Change in network throughput in the 90 s is given in The Wireshark tool was used to analyze the traffic data during the entire network environment communication. When the normal situation is unprotected, it can be seen that almost no packets can be sent or received normally, while when the IZTSDN security framework is on, the network throughput and bandwidth are almost unaffected. This is because unauthorized network attacks simply cannot be authorized by the intelligent controller’s authentication and will not respond to data requests that are illegally accessed, nor will the server respond to the requests it sends. Port scanning attacks also give any response to those access requests that are not authenticated when the IZTSDN security framework is on, which makes it impossible for attackers to scan any open ports and get any valid information.In an ideal situation, IZTSDN would block all unauthenticated traffic, meaning that the entire network should be used for authenticated clients. However, in the actual network environment tested, there is also some lesser inflow of unauthorized traffic for a short period of time when legitimate clients first start to pass through, so the attack consumes some bandwidth, but with a smaller drop.It is observed in this experiment that the bandwidth available for TCP is larger than the bandwidth available for UDP, analyzing that during TCP communication three handshakes need to be established to acknowledge the data it transmits, while UDP does not need to wait for acknowledgment and will forward accepted data faster than TCP. The final test results. Average throughput are given in The experimental platform is only used to build the neural network of the model with Keras, using Python as the main programming language, and using the operating system of the host Windows 10 64-bit workstation, whose main hardware and software environment configuration. The main hardware and software environment configuration are given in Since 1998, the relevant cybersecurity agencies have evaluated the existing datasets and found that most of them are outdated and cannot meet the complex and diverse network environments of today. Some of the datasets were collected in traditional network environments and could not be applied to SDN network environments, and another part of the datasets contained attack types that no longer encompassed some of the existing publicly available attack types.The publicly available dataset provided by Bennett University Research Institute is used by simulating a collection of benign TCP, UDP, and ICMP traffic as well as malicious traffic runs .The entire dataset contains more than 100,000 rows of flow table data for training and testing the model. For feature selection, a 1D CNN was used to extract effective flow features from the originally collected data. When training the model, the dataset was randomly segmented for cross-validation, and several evaluation metrics were used to assess the performance of the model, such as accuracy, precision, recall, and F1 score. Through these measures, the dataset can be effectively used to improve the performance and robustness of the model. Key features included in the dataset are given in After several times of model training and optimization, the experiments set the optimizer as Adam, the loss function as binary_crossentropy, the number of data samples captured in one training (Batch_sizes) set to 32, the initial learning rate set to 0.01, and the Epochs set to 120, where the Adam optimizer combines the advantages of both AdaGrad and RMSProp optimization algorithms, introduces gradient momentum and gradient squared momentum, and makes the learning rate close to the optimal state by automatically adjusting the learning rate, and also introduces Dropout to prevent the problem of overfitting during model training, setting it to 0.2. During the experiments, in the SDN dataset of 104,345 data, there are still 76,009 data in the preprocessing module, and 60,807 of them are extracted as the data set to train the model, and 15,202 data are used as the test set to test the model.In the feature extraction module, convolutional layers is 2, number of filters is 32, kernel size is 3*3, stride is 1, pooling layer is 2*2, activation function is ReLU.In the detection classification module, number of LSTM hidden units is 64, number of stacked LSTM layers is 1, learning rate is 0.01, epochs is 120, Batch_sizes is 32, loss function is binary cross entropy, optimizer is Adam, dropout is 0.2.Under the same public SDN dataset, a variety of deep learning detection algorithms are compared, and the experimental results show that the CALSeq2Seq model has the best overall performance and can achieve good detection results in the simulated environment, and the CALSeq2Seq model has converged in about 120 rounds, and the accuracy and loss rates have stabilized. CALSeq2Seq model accuracy and loss rate is given in In classification experiments, samples can be classified as true positives (TP), false negatives (FN), false positives (FP), and true negatives (TN). TP indicates the proportion of attack samples predicted as attack samples, FN indicates the proportion of normal samples predicted as attack samples, FP indicates the proportion of attack samples predicted as normal samples and TN indicates the proportion of normal samples predicted as normal samples. The confusion matrix is usually used to calculate the above performance parameters. In the binary classification problem, it is defined as a 2 × 2 matrix showing the actual and predicted values of the classifier.From the experimental process of model training and optimization, it can be seen that the traffic anomaly detection model CALSeq2Seq has shown good results in terms of accuracy and loss rate on the existing publicly available SDN dataset. In the experiments, each comparison algorithm will be evaluated using the mentioned datasets, and later also compared with the research knots of other articles for comparative analysis, the models will be compared based on their accuracy, false alarm rate, precision, recall, and F1-measure, which are the main evaluation metrics for performance. The formula is shown by The publicly available SDN dataset was used, and the model performance was comprehensively evaluated by calculating the evaluation metrics of accuracy, false alarm rate, precision, recall, and F1-measure. The CALSeq2Seq model was compared with other deep learning models. It can be directly observed from the table that the CALSeq2Seq model achieves the highest scores in all evaluation metrics, showing excellent performance. Model Performance Evaluation are given in The CALSeq2Seq model achieves more than 98% accuracy with traditional machine learning models as well as in other deep learning models with ANN, CNN, and SVM-RF, which greatly improves the efficiency of network resource utilization and reduces network latency. In terms of false alarm rate, the CALSeq2Seq model also has a strong anti-noise capability, which is significantly lower than all other models, further demonstrating the reliability of CALSeq2Seq. In terms of both accuracy rate and recall rate, the CALSeq2Seq model performs equally well with SVM-RF and CNN, especially in terms of recall rate, CALSeq2Seq model can reach more than 98%, which significantly improves the coverage of the SDN network. The F1-measure, a comprehensive evaluation metric, shows the superior performance of the CALSeq2Seq model in recognition and classification tasks.In the experimental analysis, the researchers used histograms to demonstrate the performance of the model in the four evaluation metrics of accuracy, precision, recall, and F1-measure. Performance evaluation is given in CALSeq2Seq exhibits the highest sensitivity and the lowest false alarm rate, which means that this algorithm has the highest classifier accuracy. Therefore, when evaluating the pros and cons of the model algorithm, it is analyzed according to the ROC curve to judge the performance of the algorithm more accurately.Literature research found that some researchers claim to use SDN networks in their articles, but use the classical datasets KDD Cup and NSL-KDD under traditional networks for their experiments. However, these datasets are not fully applicable to SDN network scenarios. In addition, some authors did not disclose the datasets used but tested them by building their own network environments, an approach that may run the risk of lacking effective validation.Currently, there are very limited publicly available SDN datasets. Therefore, the publicly available SDN dataset was specifically chosen to ensure the reliability of this article study. This dataset contains more than 100,000 data samples, all generated and collected in the SDN network environment, which can more accurately reflect the characteristics of SDN networks. This allows the model to be constructed based on this dataset and deployed into the proposed security framework IZTSDN, thus making the research in this article more credible and reproducible. Compared with the algorithmic models proposed by other researchers, the model performance comparison of different solutions are given in The network attack test generates normal and attack traffic by hping3 simulation, and the parameters of CALSeq2Seq, the anomaly traffic detection model in the IZTSDN security framework, are tuned several times to achieve better results. After the entire simulation platform is initialized, the Ryu controller is started and all other components are opened. IZTSDN performs accurate anomaly detection on user traffic that has been authorized by authentication, and if suspicious malicious traffic is found, the controller issues a flow table forwarding policy to make the policy enforcement component disconnect the data channel established between the user and the resource. The blocking time increases dynamically with the frequency of each attacker for 120 s to completely stop the attack.The traffic anomaly detection model CALSeq2Seq is applied to the control of IZTSDN, an intelligent zero-trust security framework, and is used to detect user traffic in the network in real time. In the network attack test conducted in the simulation platform MiniIZTA, the experimental results show that CALSeq2Seq has an accuracy of 99.26% on the test set. In addition, the average score after five-fold cross-validation is 0.9975, further verifying that CALSeq2Seq’s performance is optimal. The experimental results show that CALSeq2Seq is a very reliable traffic anomaly detection model that can play an important role in SDN network environment.In the comparative analysis of schemes in In this article, we propose an intelligent zero-trust security framework named IZTSDN for securing network resources in SDN-based networks by combining deep learning with zero-trust architecture. The framework comprises five core modules: a data collection module, a trust assessment engine module, a user behavior analysis engine module, an intelligent controller module, and a communication execution module. To detect attack traffic in SDN networks, we introduce a traffic anomaly detection model called CALSeq2Seq based on deep learning algorithms. The model employs a one-dimensional convolutional neural network (1DCNN) to extract network features and introduces a self-attention mechanism to achieve a fusion of key features. Additionally, the LSTM-Seq2Seq structural network is used as a codec to learn the dependencies between features. Finally, the prediction results are output through the fully connected layer. Experimental evaluations using publicly available SDN datasets show that the CALSeq2Seq model outperforms other algorithms. We also address the issues associated with the traditional “connect first, authenticate later” access model in SDN networks by proposing a trust algorithm called UBTA based on zero-trust technology. The UBTA algorithm uses the user’s historical behavioral data to evaluate its trust value and grants corresponding authority based on its given operation threshold, enabling a dynamic authorization process. To validate our proposed intelligent zero-trust security framework IZTSDN, we build the simulation platform MiniIZTA by integrating the zero-trust component extension Mininet network tool. We implement the IZTSDN security framework proposed with the help of the MiniIZTA simulation platform and verify its usability and security by designing network simulation attack tests and security tests. In the experiments, we use two evaluation metrics, throughput, and traffic anomaly detection accuracy, to evaluate the performance of the IZTSDN security framework. The experimental results show that the IZTSDN security framework can maintain about 80.5% throughput when encountering unauthorized DDoS attacks and port scanning attacks. Furthermore, the traffic anomaly detection model CALSeq2Seq has an accuracy rate of 99.26% in the test, with an average score of 0.9975 after five-fold cross-validation, further validating its performance in the simulation test. Additionally, the security framework performs port blocking of the attacker’s IP to prevent further malicious attacks.With the continuous development of technology, there is still room for further improvement in this area. Therefore, based on the existing article, future SDN security issues are further studied as follows:(1) The traffic anomaly detection model proposed in this article, although can greatly improve the accuracy of network anomaly traffic detection and reduce the false alarm rate. However, it is not enough to identify the type of network traffic attack alone, and the addition of mitigation and traceability mechanisms can be considered later.(2) The network traffic used in this study is unencrypted. Nowadays, some of the attack traffic is transmitted after encryption, which is harmful, long attack cycle time, is concealment, and is not easy to be detected. Therefore, the predictive identification of encrypted traffic needs to be added at a later stage.(3) The method of trust algorithm proposed in this article needs to be further optimized. This is due to the nature of the trust itself such as interactivity which makes it difficult to be quantified, and how to further derive the trust value of the access subject still needs a lot of theoretical research.For the mitigation of network traffic attacks, in the short term, we can try to use some security policies, and in the long term, we can develop a set of security protocols for specific scenarios to mitigate abnormal traffic attacks. As for traceability techniques, one can consider adding a threat model to trace the attacker’s attack path to prevent such attacks in advance at a later stage. For the identification and processing of encrypted traffic maybe consider transforming it into images or text and using neural networks to predict the identification. The optimization of trust algorithms is more reflected in the algorithm, perhaps in the future, we can try to add some security algorithms to ensure the degree of trust.10.7717/peerj-cs.1674/supp-1Supplemental Information 1Click here for additional data file.10.7717/peerj-cs.1674/supp-2Supplemental Information 2Click here for additional data file.


The condition-based maintenance of vibrating screens requires new methods of their elements’ diagnostics due to severe disturbances in measured signals from vibrators and falling pieces of material. The bolted joints of the sieving deck, when failed, require a lot of time and workforce for repair. In this research, the authors proposed the model-based diagnostic method based on modal analysis of the 2-DOF system, which accounts for the interaction of the screen body and the upper deck under conditions of bolted joint degradation. It is shown that the second natural mode with an out-of-phase motion of the upper deck against the main screen housing may coincide with the excitation frequency or its higher harmonics, which appear when vibrators’ bearings are in bad condition. This interaction speeds up bolt loosening and joint opening by the dynamical loading of higher amplitude. The proposed approach can be used to detune the system from resonance and anti-resonance to reduce maintenance costs and energy consumption. To prevent abrupt failures, such parameters as second natural mode frequency, damping factor, and phase space plot (PSP) distortion measures are proposed as bolt health indicators, and these are verified on the laboratory vibrating screen. Also, the robustness is tested by the impulsive non-Gaussian noise addition to the measurement data. A special diagram was proposed for the bolted joints’ strength capacity assessment and maintenance actions planning , depending on clearance in the joints. Different vibrating screens are widely used in raw material processing and aggregate industries. Vibration screens have a significant role in separating bulk materials such as the fractions of coal and ore. Sieving screens can separate from 10 to over 1000 tons per hour depending on their design, drive power, size, and the number of decks . Cyclic Sieving material is fed to the top of the screen by the belt conveyor with a specific linear speed. Some systems are under development  to preveAt the design stage, by using the discrete and finite element approach ,17,18,19Supporting springs are well-known as vital components of sieving screens, and they substantially affect particles’ trajectory and overall process efficiency due to a significant influence on their dynamics . AlthougThe most desirable by the energy consumption are resonance vibrating screens  but theyIn the standard far beyond resonance vibrating screens, a serious dynamical problem causing excessive energy consumption constitutes the Sommerfeld effect when the machine structure passes its main resonance at startup. About 30% of the additional power of electric drives is needed for reliable transition through the resonance, which results in excessive energy consumption at the working rotation speed. When the rotation speed of vibrators goes down, the screen structure passes resonance very slowly and its elements are subjected to excessive loading cycles of high amplitude. Some solutions are proposed in this regard based on magneto-rheological dampers (MRDs) ,39 and eThe additional dynamical loading is caused by the gaps opening, which can appear due to contact wear in joints and deformation of bolts. This effect has a potential threat to appear in non-stationary vibrating machines with reverse loading. Thus, due to the significant influence on the lifetime and reliability of different parts of the vibrating screen, clearances may be thought of as the most critical but hidden for measurement operational parameters. The bolted joints are one of the most vital factors determining the correct operation of vibrating screens. The strength capability of bolted joints supposes that the designers of machines should forecast their peak loads and prevent the contacted surfaces from opening at any joint under any forces because in this case, the additional stresses  appear in the bolt shank . The greThe diagnosis of bolts loosening is a complex scientific and engineering problem considering the potentially massive number of bolted joints and the dramatic outcomes of their loosening, leading to the unexpected redistribution of inner loads between other bolts in joints, not only in rotating systems but in building, bridge, and other infrastructure that use a lot of bolts. Health monitoring of bolts can be divided into two general approaches. The first is based on smart bolts and dense sensors in the local area, and the second approach uses analysis of bolts based on modal analysis of whole structures and systems. A dense sensor approach can be performed by measuring tensile stress with ultrasonic waves ,43, utilIn recent years, due to technological improvement of cameras and related algorithms, the approach based on image processing to diagnose bolts has accumulated some favor ,59,60. TAnother category of bolt diagnostic approaches is based on identified modal parameters of the system. Detecting changes in a natural frequency and phases can detect the weak bolt tightening caused by changing the system’s stiffness and contact friction . For insIn this research, the authors are focused on the dynamical analysis of a vibrating screen with an emphasis on the causes of frequent failures on the heavy upper deck and methods of bolted joint diagnostics. All further calculations are regarding only those bolts that fasten the upper deck to the screen structure to restrain its vertical displacement but not the other bolts in side panels, which loosening is planned for analysis in our future research. We consider the most difficult case when nuts are fixed and other methods, e.g., visual inspection, are not sufficient in the bolted joint maintenance on the screens.Both practical and theoretical goals motivated this research. The practical goal was to understand the reasons for frequent failures of bolted joints in the vibrating screen and to develop remedies against such failures. The theoretical goal was to develop methods of bolted joint loosening based on a dynamical model and implement the appropriate signal processing techniques. In fact, the developed method and diagnostic parameters are applicable to any horizontal screens and other vibrating machines  where two main parts are joined by the bolts and susceptible to frequent failures.The scope of the conducted research covers industrial research and measurements on the fully functional laboratory screen. The novelty of the developed approach is in considering the vibrating screen as a system with a changeable structure when an additional degree of freedom appears due to bolted joint degradation. In this case, the second mode natural frequency change and the first mode damping values are used as the diagnostic parameters of bolted joint loosening. In addition, anti-resonances are identified in the 2DOF dynamical system and their possible effect on screen working efficiency and diagnostics is explained. The developed method is not sensitive to the non-Gaussian noise created by the sieved bulk material.The paper is organized as follows. In In our research, we analyze two devices. The first is an industrial vibrating sieving screen, a general view of which is depicted in The investigated typical industrial vibrating screen see  includesThe upper deck blinding with a near-mesh-size material can increase the weight of vibrating masses while the severe abrasive wear of beams will reduce the mass of the deck see . The totAccording to the recommendations of the vibrating screens’ producers regarding the equipment maintenance actions see , the vibVibration measurements were obtained by the Kistler LabAmp 5165A, a 4-channel universal laboratory charge amplifier used for dynamic signal or mechanical quantity measurements with piezoelectric sensors (IEPE) . The K-Sn degrees of freedom and viscous damping can be represented as follows:x, F is force. Also, the mentioned equation can be presented in a state space form [The equation of the mechanical system motion with ace form :(2)x˙(t)Equations  and 3)  3) can bFor the modal analysis, first, we assume the free vibration problem with Equation  can be rY and This equation represents a set of Equation  is consiquation (y(t)=YeλtEquation  and simpEquation  is a stax can be defined as follows:xdata is input data, ydata is an observed output, both represented as either matrix or vector, and ydata, which is computed instead of a standard sum of squares. Using this method of curve fitting, a damping ratio is estimated by the decaying transient vibrations to detect bolt loosening during experiments.Besides the natural frequencies, the damping ratio is used for bolt looseness detection. The method is based on the transient vibration curve robust nonlinear fitting solved with the least-square approach. The problem of finding coefficients Modal testing is an experimental technique that is used to design the modal model of linear invariant vibratory systems over time. The theoretical basis of the technique is to determine the relationship between one location’s vibration response and another location’s excitation as a function of the excitation frequency. This relationship is often a complex mathematical function, called the frequency response function (FRF) . FRFs arx, F, and In the following, we show the FRF representation by using displacement based on Equation , which ieference .It is known from the theory and authors’ experience of industrial measurements that stochastic non-Gaussian impacts from the large pieces of sieved material falling on the upper deck produce a wide-band spectrum of forces. It can be described by the following formulas :(13)X=SαFor vibrating screen analysis, the 2-DOF dynamical model is assumed, the calculation scheme for which is represented in The matrices of the dynamical system parameters in Equation  have theThe governing equations for the 2-DOF non-linear system are the same as for the linear model but the stiffness of degrading bolts is described by the discontinuous nonlinear function with a dead zone (gap) and two linear pieces of constant stiffness:The composed system of non-linear differential equations is solved numerically by the Runge–Kutta method of fourth order with a constant time step of integration.This model is further used for vibrating screen dynamics analysis and diagnostic feature investigation.F1 from both unbalanced vibrators acts directly on mass m1 and impacts force F2 from the falling pieces of the material acting on mass m2, the following four channels are considered (see FRFF1) to (displacement of mass m1);FRFF1) to (displacement of mass m2);FRFF2) to (displacement of mass m1);FRFF2) to (displacement of mass m2).The dynamics analysis included the building of Frequency Response Functions (FRFs) of the vibrating screen. Taking into account that the total exciting force ered see :FRF11: fFRFFRFFRFThe exact values of natural mode frequencies of vertical vibration are as follows: 1st mode—2.6 Hz; 2nd mode—30.5 Hz. Functions mmWhile the first mode of vibration is mainly determined by the design parameters of the screen , the second mode of the screen’s natural vibration depends on several factors. The most influencing factor is the gradually changing stiffness between mass ings see .After maintenance actions are undertaken on the screen, those higher harmonics disappeared, which proves their origin. Measurements of vibration in the four corners of the main screen housing on supporting springs showed that it vibrates as the rigid body. Hence, even one bearing with damaged rings or having excessive clearance can generate not only 15 Hz but as high as 30 Hz and 45 Hz harmonics and excite the second natural mode with increased tension in the bolted joints. Since the maintenance actions of bearings and bolted joints have different periods, this process can occur at any time of operation and requires new methods of damage detection in the condition monitoring system.The vibrating screen simulations are conducted in several aspects. Firstly, the periodical excitation is applied to mass In the second stage of simulations, the stochastic impacts are applied to the mass The mechanism of bolted joints loosening can be explained as developed in several steps and influenced by many factors. The initial tightening force (torque) is recommended to provide uniform clamping stress The critical value of clearance is about 0.5 mm, after which the failure is unavoidable. In practice, with two accelerometers installed on the screen body and on the sieving deck, tensile forces (stress) can be easily calculated with relative displacements (deformation), which are then applied to the diagrams in In addition, for bolt looseness detection, the phase space plots (PSPs) are built in Based on the results of simulations, we can conclude that the modal parameters of the system should have high sensitivity to clearance in the bolted joints between two masses of the screen—the main body and the upper sieving deck. The dependencies of the first and second natural modes’ frequencies on the clearance in the bolted joints are shown in Besides the natural frequencies, damping ratio and PSP were taken as the diagnostic parameters.When the residual plastic deformation increases enough, clearances appear in the joints, and the amplitude of the second natural mode increases, which corresponds to the out-of-phase motion of the upper deck and the screen body. In the case of simultaneous defects or excessive clearances in the bearings of vibrators, the higher harmonics of excitation force appear in the spectrum, which greatly increases amplitudes of the second mode, and hence tensile stress in the bolts. Finally, loosened bolted joints induce contact opening in the upper deck around the places of its mounting on the screen housing. The worst stage of degradation starts when an initial crack appears due to the unequal loads on separate bolts above the ultimate stress of their steel grade.Moreover, the upper deck of the screen consists of three sections with similar masses. Every section has different angles of inclination and different amplitudes of the vertical components of forces. Therefore, the above-mentioned stages of worsening bolt condition will develop asynchronously, requiring even more frequent maintenance actions. The bolts loosened in one section will have an impact on the other two sections. Hence, scheduled maintenance is better when conducted for the whole set of bolts on the upper deck. All issues mentioned above require the system to detune from the resonance at the second natural node frequency.The dependencies of the first and second mode natural frequencies on the Since the design diameters of the bolts provide the required strength capacity, their decrease is not possible, nor is the section’s increase (restricted by hole diameters). Instead, a decrease in the bolted joints’ stiffness and simultaneously providing better damping of shock impacts in joints of the upper deck can be achieved by the special pads made of polyamide or other durable elastic material installed under bolts’ heads and nuts. The geometry of such pads should be calculated based on applied material properties and design.FRFFRFFRFThe relations of In the context of bolted joints’ diagnostics, the coincidence of the vibrators’ rotation and anti-resonance frequency has a positive effect on the dynamics reduction of bolted joints, because amplitudes of out-of-phase vibrations are less at these frequencies. However, this is not desirable for energy saving of the screen and has to be avoided in practice.Since the measurements of bolt loosening and moreover their regulation is almost impossible in industrial sieving screens, the experimental part of this research was conducted on the fully functional laboratory vibrating screen see  to demonThe signals registered during the described experiment can be seen in Parameters of FFT used in signal processing procedures are as follows: sampling frequency: 25 kHz; data length: 4 s ; frequency resolution: 0.25 Hz; windowing: no window. The spectrum and changes of the first (about 4.2 Hz) and the second (16.7 Hz) natural modes’ frequencies are shown in As an additional diagnostic parameter for bolt loosening, the damping ratio was used in the same series of experiments. The change in the damping parameter in three different cases can be seen in As shown above, on the dynamical model of screen vibrations, phase space plots are sensitive to bolt looseness. Based on experimental data obtained on the laboratory screen, these graphs are built for three cases and are shown in The numerical parameters of PSP shape are given in Additionally, the authors checked if the second natural frequency would change after simulating the additive impulsive noise. Based on previous research, authors determined that in the real working conditions, the maximum range of impulsive noise impacts usually does not exceed the amplitude of the machine vibrations more than three times and comes from the material falling on the upper sieve. Three kinds of noises—Noise1, Noise2, and Noise3—have been used in the simulation. The are assumed to have alpha-stable distribution with parameters presented in Noises generated with these parameters can be seen in Results visible in The new approach to bolted joint diagnostics in the vibrating screens is developed based on the dynamical model and verified experimentally on the fully functional laboratory sieving screen.No other scientific works on bolted joint diagnostics in the sieving screens were found during our research. The proposed in-the-market systems designed especially for the vibrating screens, e.g., CONiQ (Shenk) , SmartChThe proposed approach, unlike other known studies, e.g., , consideIf we are to compare the developed method with “smart” bolts or washers for loosening detection, our solution is more cost-efficient and convenient because it does not require additional time during screen maintenance for electronic component installation.Vibration signals for diagnostic purposes can be recorded during the idle period of machine work to reduce the influence of impulsive noise from bulk material; however, this is usually not desirable in the continuous technological chains of large-scale enterprises. Therefore, to speed up and make the bolted joint diagnostics reliable, in distinction to the standard methods supposing detection of spectrum parameters changes at the kinematics-related frequencies, it is proposed to use a multi-body system of the natural mode frequencies, which are absolutely robust to impulsive noise, speed, and load variations. Identification of the first two natural modes frequencies can be accomplished by the calculation or a bump test conducted on the machine. Also, the signals during the system transition through the resonance are appropriate.It was discovered, by experiments and on the model, that for certain combinations of design parameters of vibrating screens, the additional excitation (not accounted for at the development) can be generated by the higher  harmonics of the main frequency of inertial vibrators in case of their bearings’ deterioration. This fact is well-known in diagnostics but is firstly highlighted here as an initiating factor for bolted joint failures.The gradual looseness of bolted joints appears as a result of the out-of-phase motion of the upper deck and the main body of the screen. The initial clearance induces a further increase in impact amplitude in the non-linear mechanical system. In conjunction with a standard deformation diagram see , this prThe simulations on the 2-DOF dynamical model and experiments showed that the second mode frequency of vertical vibration can be a diagnostic parameter for bolted joint looseness detection. This frequency decreases with clearance development in the bolted joints due to their non-linear stiffness. The first mode frequency has no remarkable change with clearance development.The damping factor of natural vibrations is identified as an additional diagnostics parameter, which decreases with clearance development in the bolted joints. The most appropriate periods for damping calculation are during the transient processes of the machine running out (stopping of vibrators) when it passes the internal resonances.Phase space plots in coordinates of displacement and velocity provided a sensitive diagnostic method for bolt looseness. The advantage of these functions is in only one direction of vibration measurement. The proposed health indicators describing the shape of PSP trajectory, natural frequency, and damping are quite easily calculated in the time domain. They can be implemented in the even middle range of cost data collectors.The most important data obtained in the test are quantitative relations of diagnostic parameters to the bolt loosening grades. The sensitivity by the second natural mode frequency is estimated at about 12.5 Hz/mm for initial loosening and about 4.5 Hz/mm for higher loosening. This regularity agrees with model simulations see . The damFRFBased on system modal analysis, the frequency response functions are constructed, which show that the system has anti-resonances. Keeping vibrators’ frequency close to a such region of Vibrations at the second mode frequency and its higher harmonics can generate additional shock impacts with a wide-band spectrum on the upper deck, which intensifies the disintegration of cohesive fine-fractions materials with high humidity. However, it would be much more harmful to the bolted joints due to increasing the risk of their abrupt failures at the unpredicted moment of machine operation.The loosened bolted joints will significantly disturb the designed trajectory (orbit) of the sieving screen motion and reduce its technological efficiency. The out-of-phase vibrations of the upper deck will cause the gradually increasing plastic deformations of bolts and finally lead to their breaking. If we assume the standard endurance limit of about The higher yield stress of used steel supposes bigger amplitudes of impacts, which bolts can restrain without plastic deformation and irreversible elongation, which reduces tightening (tension) and finally produces a gap in the joint. On the other hand, usually, more strengthened steels have less impact toughness and more risk of brittle cracking under dynamic loading. Therefore, steel grade for bolts in the upper deck joints should be thoroughly selected to have simultaneously high yield stress, hence, higher endurance limit, and high impact toughness. Such contradictory properties can provide special heat treatment routes for alloy steels including the deep cryogenic treatment stage, which also eliminates internal stresses after heat treatment ,88.Based on the conducted research and vibrating screen simulations we have come to the following conclusions.The detailed analysis of modal parameters allows considering the vertically vibrating screen structure as the 2-DOF system where the upper deck consisting of large section beams is considered as the second mass and its bolted joints as the intermediate stiffness with the main structure of the screen.The total stiffness of these bolted joints has a non-linear (piece-wise linear) characteristic due to the unavoidable plastic deformation of bolt bodies under the action of severe impacts from the vertical components of excitation forces from unbalanced vibrators.The gradual deterioration of bolts and appearing of clearances in the joints greatly increase the shock impacts produced by upper deck mass and further quick elongation of bolts within several working days. Therefore, their diagnostics and timely maintenance (tightening or replacement) are important for plant staff.Using higher classes of bolts’ strength has not solved the problem because the main reason for that is a coincidence of the second mode frequencies of screen natural vibration with the main excitation force (15 Hz) and its higher harmonics , which appears when shaft bearings and spring supports are in bad technical condition.Such interrelation of failures in different units of industrial machines is well known in condition monitoring and explicitly undermined for the vibrating screen in current research.At the design stage, to minimize the effect of out-of-phase vibrations in the sieving screens, which increase the energy consumption and risk of bolted joints failure, it is necessary to keep the anti-resonance frequency beyond of at least 5 Hz range from the rotation frequency of the inertial vibrators. During the screen operation, maintenance personnel should periodically check the wear of bearings in vibrators either manually  or by the signals of condition monitoring systems where it is reflected in the amplitudes of higher harmonics of rotation frequency.A possible way to increase the maintenance interval on the existing screen is to introduce elastic pads on both sides of bolted joints. In this case, the stiffness tuning between masses allows shifting the frequency of the second natural mode from the frequency of the main excitation force and its higher harmonics.In this research, only those bolts are considered, which are fastening the upper deck to the screen structure. The other bolts connecting side panels and reinforcement bars, which loosening is related to higher natural modes of the screen structure, are planned for analysis in our future research.


All three algorithms successfully predicted the compressional sonic log (DT). XGBoost demonstrated the highest prediction accuracy, with R2 of 0.9068 and the least errors. RF exhibited the next highest accuracy, with R2 being 0.85478, while SVM had R2 of 0.66591. Therefore, the ensemble algorithms (XGBoost and RF) proved to be more accurate than the non-ensemble algorithm (SVM) in this study. The outcome of the study will accelerate and enhance the understanding of oil and gas fields with few or no compressional sonic logs. To the best of the authors’ knowledge, this is the first study to have predicted the compressional sonic log from well data (logs) in a Ghanaian sedimentary basin using machine learning algorithms, and only a few such studies have been conducted in the whole West African sub-region.Sonic logs are essential for determining important reservoir properties such as porosity, permeability, lithology, and elastic properties, among others, and yet may be missing in some well logging suites due to high acquisition costs, borehole washout, tool damage, poor tool calibration, or faulty logging instruments. This study aims at predicting the compressional sonic log from commonly acquired logs  in the Tano basin of Ghana using Support Vector Machines (SVM), Random Forest (RF), and Extreme Gradient Boosting (XGBoost) Machine Learning (ML) algorithms and comparing the performances of the algorithms. The algorithms were trained with 70% of the data from two wells and tested using the remaining 30% of the data from the wells after cross-validation. Subsequently, they were applied to the data from a third well to predict the sonic log in the well. The performances of the algorithms were assessed with five statistical tools: coefficient of determination (R TheseDespite this risk, the high cost of acquisition of sonic logs may deter companies from acquiring them in future oil and gas projects owing to the increasing difficulty with obtaining funding for hydrocarbon projects resulting from the global energy transition .In cases where the sonic log was missing in a logging suite, it was obtained by transforming the commonly acquired logs, such as resistivity and density logs, based on an experimental formula built between them. However, this approach is prone to unacceptable errors as the formula may not be suitable for all formation conditions across oil and gas fields . This neML is a subdivision of Artificial Intelligence (AI) that uses various algorithms to teach computers to identify patterns in data and based on the patterns, make predictions and forecasts. These algorithms mimic human cognitive functions such as learning, reasoning, problem-solving, and self-correction and serve as a quality check for performance optimization . ML algoSeveral studies attest to the ability of ML algorithms to synthesize or predict sonic logs based on commonly acquired logs such as gamma ray, density, neutron-porosity, resistivity, and spontaneous potential, among others . relied Apart from these, several other studies have demonstrated the efficacy of ML algorithms in the prediction of other reservoir properties such as porosity , permeabSimilar to the aforementioned studies, this study aims at predicting the compressional sonic log by applying SVM and two ensemble machine learning algorithms (random forest and XGBoost) on commonly acquired logs  from three wells in the Western (Tano) Sedimentary Basin of Ghana taking cognizance of the relevance of the sonic log in oil and gas exploration and production, its high cost of acquisition and the threats imposed by the global energy transition. The study also aims at establishing the veracity of claims that the ensemble machine learning algorithms are more accurate than the non-ensemble algorithms ,37 by coThis study is imperative to reassure hydrocarbon exploration and production companies, as well as nascent oil and gas nations, that hydrocarbon exploration and production can be achieved with limited or no sonic log information. The outcome of the study will accelerate and enhance the understanding of oil and gas fields with few or no compressional sonic logs, as this study will motivate the generation of synthetic sonic logs or any other logs that may be missing in a logging suite. Predicting logs instead of acquiring them also saves time and cost, which could lead to optimized oil and gas exploration and production and potentially lower related carbon dioxide emissions as envisaged by the global energy transition agenda.To the best of the knowledge of the authors, this is the first time ML algorithms are employed to predict the compressional sonic log in a Ghanaian sedimentary basin. The outcome of this study will, therefore, be useful for the ongoing exploration works and the unexplored portions of the Western Basin as well as other sedimentary basins in Ghana. The results could help accelerate oil and gas exploration and production in Ghana to generate the necessary revenues to support the development of the clean energy resources (little or no carbon energy sources) envisaged by the energy transition.22.10 represent the model ‘weights’ and SVMs are supervised machine learning models with a kernel function for non-linear classification and regression. With this algorithm, linear learning machines are trained in kernel-induced feature spaces by applying the generalization theory of Vapnik-Chervonenkis ,39. SVMsAccording to Ref. , the SVR2.2The RF algorithm builds an ensemble of trees (many independent decision trees), trains them, and subsequently carries out predictions with them. It prevents overfitting using bootstrap re-sampling. Bootstrap sets are built on initial data with several samples replacing other repeating samples. An individual bootstrap set produces a tree . The trees built, therefore, have different datasets and predictions. For regression, the different trees are aggregated after training, and the predictions of each tree are averaged to obtain the final predictions ,43. AccoTo predict at a point x:Classification: Where 2.3XGBoost is a combination of tree ensemble learning and gradient descent. This supervised learning model can be used for regression and classification problems. The performance of the XGBoost model is improved by adding one new tree at a time to the previous XGBoost model. This also optimizes the value of a pre-specified objective function . It avoit = total number of base tree models, The random forest and XGBoost algorithms were randomly selected from the ensemble family of ML algorithms based on the assertion that the ensemble methods are generally robust. However, the two algorithms employ different techniques for making predictions. While random forest uses bagging or bootstrap aggregation, XGBoost uses boosting. In bagging, many independent models are built, and the average value is used while boosting builds models sequentially . Both apThe regression versions of all three algorithms were used to predict the compressional sonic log in this study.3trans-tensional movement during the separation of Africa and South America and the opening of the Atlantic in the Albian. Active rifting and subsidence during this period resulted in the formation of a deep basin characterized by thick organic-rich shale in the Cenomanian and Turonian. Large turbidite and channel complexes were deposited as a result of several river systems . Fig. 74.2The aim of feature correlation is to identify and remove irrelevant and redundant input parameters to improve the performance of the algorithms. This was achieved using the Pearson Correlation Heat Map to establish collinear relationships between the input parameters. According to Ref. , for anyThe data were also normalized or standardized to improve their integrity and prevent the algorithms from being biased to the magnitude of the data. The choice of a normalization method depends on the application and the algorithm . AccordiFollowing these processes, the SVM, RF and XGBoost algorithms were trained and tested using the data from wells A and B. Training and testing or validation of ML algorithms are essential to provide assurance that they can produce similar or the desired results when applied to other data sets in different locations. There are several ways of validating ML algorithms, and this study adopted the holdout or random sampling and blind set validation methods after some preliminary investigations. The holdout or random sampling method involves randomly splitting the data set into two portions: one portion for training the algorithms and the other for testing them. In this study, seventy percent (70%) of the data from wells A and B were randomly selected and used to train the algorithms and the remaining thirty percent (30%) were used to test them.To further assess the credibility of the results produced by the holdout method, the K-fold cross-validation was also implemented on the data from wells A and B, and the results were compared with those of the holdout method. The K-fold cross-validation is an elaboration of the holdout method which divides the data into K-subsets or folds and, then the holdout method is repeated K-times. In this case, the data from wells A and B were divided into ten folds or subsets, following which ten rounds of predictions were carried out. At each round, one fold or subset was used to test the algorithms after the remaining nine folds were used to train them, and the accuracy was determined by averaging the results of the ten predictions.The algorithms were further validated by implementing the blind set validation. This involves applying the algorithms to a data set that has not been used for training or testing to ensure an unbiased evaluation of the algorithms’ accuracies. In this study, the data from well C constituted the blind data set to which the SVM, RF, and XGBoost algorithms were applied after the holdout and K-fold methods were carried out or after the training and testing were conducted.4.3Machine learning algorithms have parameters that have to be optimized to ensure accurate predictions and avoid overfitting or underfitting. These parameters are adjusted during training and testing until an algorithm produces the best performance or the most accurate predictions. The parameters that produce the best model's performance are called hyperparameters and are used to configure the algorithms and control the learning process. They produce the minimum generalization error on the test set. The model overfits if it is too complex and underfits if it is too simple (it does not capture most of the complexity of the data). Under these circumstances, the generalization error will be very high .In this study, the hyperparameters of the SVM, RF, and XGBoost algorithms were determined using the grid search method. This involves searching through a wide variety of hyperparameter combinations to find the combination that returns the highest model performance. The parameters that returned the models with the highest accuracies in this study are contained in 2), adjusted R2  slightly outperformed the K-fold (R2 of 0.94781) during training of SVM but both methods had the same accuracy (R2 of 0.94783) during testing. As opposed to the SVM, K-fold slightly outperformed the holdout method in both training and testing of RF. The difference was about 0.01% for the training and 0.001% for the testing. The accuracies were the same for both cross-validation methods when XGBoost was trained and tested.The results of the holdout and K-fold cross-validation methods during training and testing of the algorithms with the data from wells A and B are presented in Given the similarity in the results of both cross-validation methods and the high accuracies recoded, the algorithms were considered capable of predicting the sonic log from a blind data set.However, only the results of the holdout cross-validation for training and testing the algorithms have been provided in this study because it outperformed the K-fold when the SVM was used for the predictions considering that the SVM operates on a different principle from XGBoost and RF. These results are 2 of 0.9979 and 0.9940 during training and testing respectively. This means that 99.79% of the predicted data correlated with the actual data during training, and 99.40% of the predicted data correlated with actual data when RF was applied to the remaining 30% of the data from wells A and B (testing). The R2 values were validated by calculating the adjusted R22 values for both training and testing. Correspondingly, the RF algorithm recorded the least errors, as evidenced by the MAE, MSE, and RMSE values in From 2 and 2 for RF and SVM were 0.85478 and 0.66591 respectively. This means that 90.69% of the predicted travel times correlated with the actual travel times when the XGBoost algorithm was applied to the blind data set (data from well C), while 85.49% and 66.59% of the predicted travel times correlated with the actual travel times when the RF and SVM algorithms were respectively applied to the blind data set.In 2 and lower MAE, MSE, and RMSE values than the latter.The XGBoost also exhibited the lowest errors as compared to the RF and the SVM algorithms, as evidenced by the MAE, MSE, and RMSE values in The sonic or acoustic log measures the travel time of an elastic wave through a formation. Therefore, from The speed or velocity with which waves travel through formations depends on a number of factors, including lithology, rock textures, porosity, etc. Notably, velocity decreases with increasing porosity and increases with decreasing porosity or increasing density. The varying wave velocities observed in well C may, therefore, be attributed to variations in the composition or characteristics of the subsurface layers. The high-velocity zones may be highly dense or compact zones and the low-velocity zones may be characterized by some porosities.The behavior of the gamma ray, resistivity, neutron-porosity, and density logs in the same well  above suHowever, interpretation of the logs is not the scope of this work as additional information would be required to confirm the exact characteristics of the subsurface. The interpretation above is to emphasise that synthetic logs can provide the true reflection of the subsurface given the strong correlations observed between the predicted and actual sonic logs and the rest of the logs in the well.The estimated velocities from the sonic log (whether synthetic or measured) aids in the determination of reservoir properties such as porosity, permeability, lithologies, elastic parameters, etc., which are critical for oil and gas exploration and production. The strong correlation observed in Given the degree of correlation between the predicted and original sonic logs in all three cases, it suffices to conclude that all three algorithms can accurately predict or synthesize sonic logs if the sonic log is missing in a logging suite. However, the ensemble algorithms may be prioritized in such predictions because of their superior prediction capabilities.The results have demonstrated that the ensemble methods (XGBoost and RF) are more accurate than the non-ensemble method (SVM) which agrees with the studies reported by Ref.  and otheFrom From 6This study employed SVM, RF, and XGBoost ML algorithms to predict the compressional sonic log from commonly acquired logs  from wells in the Western (Tano) sedimentary of Ghana (West Africa). The study also ascertained the veracity of claims that ensemble ML algorithms are more accurate than non-ensemble ML algorithms by comparing the performance of the SVM  with the performances of RF and XGBoost, which are ensemble algorithms. Data preprocessing, use of relevant input parameters, optimized hyperparameter selection, and cross-validation of supervised ML algorithms are essential steps to ensure confidence in the predictions made by ML algorithms. All these steps were employed in the prediction of the compressional sonic log in this study. The outcome of the study proves that the SVM, RF and XGBoost algorithms can successfully predict the compressional sonic log when it is missing in a logging suite. However, the ensemble algorithms (RF and XGBoost) should be prioritized when predicting the sonic log or any other log because of their superior generalization abilities to the non-ensemble method (SVM). This study agrees with previous works that reported that the ensemble algorithms are more accurate than the non-ensemble algorithms. Despite the superior performance of the XGBoost, the study cannot confirm that the XGBoost algorithm will always outperform the RF algorithm.Generating synthetic logs has the potential to reduce greenhouse emissions from oil and gas exploration and production activities, as emissions resulting from the use of rigs to acquire logs will be avoided. ML could, therefore, be an essential tool, in this era of energy transition, for the oil and gas industry to cut down carbon dioxide emissions and continue to provide the global energy needs.To the best of the knowledge of the authors, this is the first study that has employed machine learning algorithms to predict the compressional sonic log using well data from a Ghanaian sedimentary basin and is one of the few such studies in the whole West African sub-region. The study would, therefore, be very useful for hydrocarbon exploration and production in Ghana, the West African sub-region, and the world at large as it will help accelerate and enhance understanding of oil and gas fields and help save time and cost of sonic log acquisition. In subsequent studies, the authors will use these or other ML algorithms to predict sand and shale volumes from logs in the study area.Callistus Nero; Conceived and designed the experiments.Performed the experiments, Analysed and interpreted the data, Contributed regents, materials, analysis tools or data, Wrote the paper.Akwasi Acheampong Aning; Conceived and designed the experiments, Analysed and interpreted the data, Contributed regents, materials, analysis tools or data, Wrote the paper.Sylvester Kojo Danuor; Conceived and designed the experiments, Analysed and interpreted the data, Contributed regents, materials, analysis tools or data, Wrote the paper.Victor Mensah; Conceived and designed the experiments, Analysed and interpreted the data, Contributed regents, materials, analysis tools or data, Wrote the paper.The authors do not have permission to share the data.The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.