Virtual Local Area Networks (VLANs) constitute a foundational technology in modern enterprise network architecture, enabling logical segmentation of physical networks through IEEE 802.1Q tagging. Despite their widespread adoption and security benefits, VLAN environments remain vulnerable to a range of Layer-2 attacks—including VLAN hopping, MAC flooding, ARP spoofing, and DHCP spoofing—that exploit fundamental weaknesses in the 802.1Q specification and associated protocols. Traditional security mechanisms, such as signature-based intrusion detection systems and Layer-3/4 firewalls, provide limited visibility into these VLAN-specific attacks, as they operate predominantly at the network and transport layers and lack awareness of VLAN tags and Layer-2 protocol behaviors. Furthermore, existing anomaly detection frameworks are often computationally intensive, not specifically tailored to VLAN environments, and lack temporal phase annotations required for proactive threat prediction.
This thesis addresses these critical gaps by proposing a comprehensive framework for proactive VLAN threat detection and prediction based on a hybrid multi-task neural network architecture. In this study, proactive prediction refers to identifying pre-attack or early-stage behavioral indicators within a defined time window before the attack reaches its disruptive phase. The research encompasses three principal contributions. First, the VLAN-TTP-2026 dataset is developed, comprising 31,350 labeled windows of 5-second observations with 37 engineered features spanning packet-level metrics, window-based statistics, flow-based metrics, VLAN-specific attributes, MAC dynamics, ARP behavior, protocol ratios, and topology-aware features. Each window is annotated with four hierarchical labels: binary (normal/attack), categorical (attack type), temporal phase (Normal, Reconnaissance, Preparation, Execution, Impact, Recovery), and a compact multi-stage label (Normal, Pre-Attack, Attack, Post-Attack), enabling direct measurement of prediction lead time. The dataset is derived from a real emulated testbed built on Ubuntu 22.04 using Mininet 2.3 and Open vSwitch 2.15, ensuring operational relevance.
Second, a novel hybrid multi-task neural network architecture is designed, combining an autoencoder for unsupervised feature learning and reconstruction-based anomaly detection, a Bidirectional LSTM (BiLSTM) for temporal modeling, and an attention mechanism for focusing on the most relevant temporal features. The architecture incorporates four task-specific heads: binary classification (normal vs. attack), multi-class classification (5 attack types including normal, VLAN hopping, MAC flooding, ARP spoofing, DHCP spoofing), proactive prediction (4 stages), and fine-grained phase identification (6 phases). The model is trained end-to-end with a joint loss function combining task-specific losses with reconstruction loss.
Third, comprehensive experimental evaluation is conducted against three classical machine learning models (K-NN, Random Forest, XGBoost) across all four classification tasks. The results demonstrate that the hybrid model consistently outperforms all traditional models, achieving near-perfect precision of 97.98% in binary classification and an average accuracy of 97.95% across all tasks—a relative improvement of 9.86% over the best traditional model. Notably, the model achieves 100% precision in binary classification, resulting in a False Positive Rate of effectively 0%, which is critical for operational deployment. The model provides a mean prediction lead time of 72 seconds with a 100% detection rate, enabling network administrators to take corrective action before attack execution.
The feature importance analysis confirms that source MAC address diversity (unique_src_mac) and VLAN identifier entropy (vid_entropy) are the most discriminative features for VLAN attack detection. Statistical significance testing using McNemar’s test confirms the superiority of the hybrid model (p < 0.0001). The proposed framework addresses all six research gaps identified in the literature review: unified framework (RG1), standardized dataset (RG2), computational efficiency (RG3), false positive reduction (RG4), multi-task learning (RG5), and replicability (RG6).
This research contributes to the advancement of VLAN security by delivering a tangible, implementable solution deployable on a single workstation with 16 GB RAM, making advanced threat prediction accessible to small-to-medium enterprises and academic institutions. The complete replication package, including simulation scripts, dataset generation tools, feature extraction code, model training scripts, and evaluation frameworks, is provided to foster reproducible research and accelerate the development of proactive security systems capable of issuing alerts approximately 1.2 minutes before attack execution.
