Edited. Sorry for my "too broad question" previously. Suppose that kinds of attack that I want to generate are these 4 big types of attack, DoS, R2L, U2R and Probe or scan attack by using appropriate attack tools for each attack. Is it possible to detect the attack (labelled) by using only the flow information (layer 1-4) provided by the SDN controller? Even though there are several additional features can be added, but still, based on this flow-related information from SDN controller, especially from ONOS. By detect I mean using anomaly based detection algorithms such as machine-learning or deep-learning algorithms. Thank you.
Currently, I'm working in the IDS (Intrusion Detection System) on the network with SDN controller. My current scheme of the IDS is, detecting attack based on the flow information provided by the SDN controller. I am using ONOS as the SDN controller and simulated network with mininet. In order to do that, I need to define some rules regarding of the attack types that can be detected based on that information. I only need to get which flow is the malicious flow and then I can forward that information to another traditional-based IDS using deep packet inspection (DPI). Thank you for your help.