PaperlayerView exact revision on arXiv

Source-linked AI summary

Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview

Majd Latah, Levent Toker

arXiv:1803.06818v3cs.AIcs.NI

TL;DR

SDN offers centralized programmable control, and researchers have increasingly explored AI to support learning and decision making in this architecture. This paper surveys AI applications in SDN, finding that machine learning, meta-heuristics, and fuzzy systems are the most common approaches; it also identifies adversarial robustness as needing further study.

  • Problem

    The paper addresses how AI techniques are being incorporated into SDN and what application areas and potential uses they have.

    Source: §1 · p. 1, §5 · p. 8

  • Method

    The paper provides a state-of-the-art overview of AI applications in SDN, organizing its discussion around machine learning, meta-heuristics, and fuzzy systems.

    Source: §5 · p. 8, §6 · p. 21

  • Results

    Machine learning, meta-heuristics, and fuzzy systems are the most common AI approaches in SDN, and recent deep-learning and hybrid-AI advances can provide better results than traditional machine-learning approaches.

    Source: §6 · p. 21

  • Takeaways & Limitations

    AI approaches have been useful tools in SDNs across the networking problems and challenges discussed in the overview.

    Source: §6 · p. 21

    Further efforts are needed to study the robustness of AI approaches under adversarial settings.

    Source: §6 · p. 21

Abstract

from arXiv · show

Software defined networking (SDN) represents a promising networking architecture that combines central management and network programmability. SDN separates the control plane from the data plane and moves the network management to a central point, called the controller, that can be programmed and used as the brain of the network. Recently, the research community has showed an increased tendency to benefit from the recent advancements in the artificial intelligence (AI) field to provide learning abilities and better decision making in SDN. In this study, we provide a detailed overview of the recent efforts to include AI in SDN. Our study showed that the research efforts focused on three main sub-fields of AI namely: machine learning, meta-heuristics and fuzzy inference systems. Accordingly, in this work we investigate their different application areas and potential use, as well as the improvements achieved by including AI-based techniques in the SDN paradigm.

1 INTRODUCTION

SDN centralizes programmable network management while separating control and data planes, but its adoption depends on addressing problems traditional protocols cannot solve. This paper surveys efforts to integrate AI into SDN and examine its role.

1 INTRODUCTION

  • SDN separates control and data planes and centralizes programmable management, providing a global view and flow-level control of network states.The architecture supports tasks such as traffic engineering, network optimization, and orchestration.Source: §1 · p. 1
  • SDN adoption depends on finding solutions to problems that traditional networking protocols and architectures cannot solve.Source: §1 · p. 1
  • The paper extends an earlier study by providing a thorough overview of research integrating AI into SDN.It aims to give deeper insight into AI's role in the SDN paradigm.Source: §1 · p. 1

2 SDN ARCHITECTURE

SDN separates applications, control, and forwarding functions, with a controller managing flow-level decisions and interfaces connecting the planes. Its programmable architecture supports development of network services without requiring application developers to understand controller internals.

2 SDN ARCHITECTURE

  • SDN separates control and data planes, with a controller determining flow-based forwarding decisions and preparing switch forwarding tables.Source: §2 · pp. 1–2
  • The northbound API connects applications to the control plane, enabling services such as traffic engineering, intrusion detection, QoS, firewall, and monitoring.Developers can write applications without detailed knowledge of controller functions or data-plane operation.Source: §2 · p. 1
  • Southbound APIs including OpenFlow and OVSDB exchange control messages between the control plane and forwarding elements.Source: §2 · p. 1
  • Switch flow entries contain packet-matching rules, counters for matched-flow statistics, and actions or instructions executed on a match.Actions can be configured proactively or reactively.Source: §2 · p. 2

3 OPENFLOW PROTOCOL

The overview focuses on OpenFlow-based SDNs, where the protocol connects controllers with forwarding elements and supports flow-table decisions. OpenFlow has evolved to add capabilities, while table misses can lead switches to drop packets or send them to the controller.

3 OPENFLOW PROTOCOL

  • OpenFlow is the de-facto southbound API standard in SDNs and provides an abstraction layer for secure controller communication with forwarding elements.The study therefore focuses mainly on OpenFlow-based SDNs.Source: §3 · p. 2
  • On a table miss, an OpenFlow switch may drop a packet or forward it to the controller using the OpenFlow protocol.Source: §3 · p. 2
  • Newer OpenFlow versions add multiple flow tables, enhanced matching and actions, optical ports, group tables, meter tables, and synchronized tables.Source: §3 · p. 2

4 ARTIFICIAL INTELLIGENCE

The paper introduces AI methods relevant to SDN, with machine learning spanning supervised, unsupervised, reinforcement, and semi-supervised approaches. It outlines representative algorithms and their roles, mechanisms, and constraints.

4 ARTIFICIAL INTELLIGENCE

  • AI encompasses machine learning, meta-heuristics, fuzzy inference systems, and other areas including reasoning, planning, decision making, and optimization.The paper introduces methods used in SDN, focusing on machine learning, meta-heuristics, and fuzzy inference systems.Source: §4 · p. 3

4.1.1 Supervised learning

  • Supervised learning maps input-output training examples to outputs, while neural networks flexibly model complex relationships but can overfit and require architecture selection.Neural networks can approximate functions without explicitly specifying the underlying model's functional form.Source: §4.1.1 · p. 3, §4.1.1.1 · p. 3

4.1.1.2 Support vector machines (SVM)

  • SVMs maximize the margin between classes and can use kernels for non-linearly separable data, while decision trees provide interpretable sequences of attribute tests but can overfit.Ensemble methods combine predictions; bagging uses bootstrap samples, whereas boosting emphasizes errors from preceding classifiers.Source: §4.1.1.2 · p. 3, §4.1.1.3 · p. 3, §4.1.1.4 · p. 3

4.1.1.5 Supervised deep learning

  • Deep learning learns hierarchical representations from raw data; recurrent networks handle sequential or time-series inputs, while convolutional networks process multi-array data using convolution, pooling, and fully connected layers.RNN outputs depend on previous computations, and LSTMs and GRUs were proposed to address conventional RNN gradient problems.Source: §4.1.1.5 · p. 4, §4.1.1.5.1 · p. 4, §4.1.1.5.2 · p. 4

4.1.2 Unsupervised learning

  • Unsupervised learning finds patterns in unlabeled data, including clusters; K-means requires a chosen cluster count and depends on initialization, whereas fuzzy C-means permits graded membership in multiple clusters.Source: §4.1.2 · p. 4, §4.1.2.1 · p. 4

4.1.2.2 Self-organizing maps (SOM)

  • Self-organizing maps map high-dimensional distributions to a low-dimensional map, and hidden Markov models represent processes with unobserved states and transition and observation probabilities.SOM training builds and reorganizes the map before classifying inputs by their winning node; HMM parameters can be trained in supervised or unsupervised fashion.Source: §4.1.2.2 · p. 4, §4.1.2.3 · p. 4

4.1.2.4 Restricted Boltzmann machine (RBM)

  • Restricted Boltzmann machines connect visible and hidden layers without within-layer connections; stacked auto-encoders reconstruct inputs, while deep belief networks stack RBMs to learn hierarchical representations.SAEs use greedy layer-wise unsupervised pre-training followed by supervised fine-tuning; DBNs train layer by layer.Source: §4.1.2.4 · p. 4, §4.1.2.5.1 · p. 5, §4.1.2.5.2 · p. 5

4.1.3 Reinforcement learning

  • Reinforcement learning updates knowledge from environmental rewards or punishments; Q-learning seeks a policy maximizing discounted expected reward, and deep RL uses neural networks to approximate policies in high-dimensional spaces.Q-learning converges with probability one under reasonable learning-rate and Markovian-environment conditions; semi-supervised learning uses labeled and unlabeled data.Source: §4.1.3 · p. 5, §4.1.3.1 · p. 5, §4.1.3.2 · p. 5

4.2 Meta-heuristic Algorithms

Meta-heuristics provide general-purpose approaches to difficult optimization problems, balancing exploration and exploitation but offering good rather than guaranteed optimal solutions. The section surveys several nature-inspired algorithms and fuzzy systems, whose rule-based explanations come with limits on adaptation.

4.2 Meta-heuristic Algorithms

  • Meta-heuristics target hard optimization problems with a balance of exploration and exploitation, but find good rather than guaranteed optimal solutions and require parameter tuning.Hybrid approaches combine algorithm strengths.Source: §4.2 · p. 5

4.2.1 Ant colony optimization (ACO)

  • ACO searches combinatorial optimization problems through ant-like pheromone trails, with evaporation helping avoid premature convergence.Pheromone accumulates along promising paths, including the shortest path to food in the natural analogy.Source: §4.2.1 · p. 6

4.2.2 Evolutionary algorithms

  • Evolutionary algorithms draw on Darwinian evolution; in GA, chromosomes form a population and crossover and mutation guide the search.Mutation adds randomness to help avoid local optima.Source: §4.2.2 · p. 6, §4.2.2.1 · p. 6

4.2.3 Particle swarm optimization

  • PSO uses a population of particles with remembered best positions to find promising search regions, but lacks a feature for converging on optima.The particles are represented by velocity and location.Source: §4.2.3 · p. 6

4.2.4 Simulated annealing

  • SA minimizes an objective by accepting neighborhood solutions according to objective value and a decreasing temperature; ABC balances exploration and exploitation through bee roles.ABC employs employed bees, onlookers, and scouts, with a neighborhood source-production mechanism for global search.Source: §4.2.4 · p. 6, §4.2.5 · p. 6

4.2.6 Whale optimization algorithm (WOA)

  • WOA models humpback whale hunting and was reported to outperform PSO, while firefly optimization uses brightness-based attraction and global communication.Firefly optimization can be time-consuming because it performs full pair-wise comparisons.Source: §4.2.6 · p. 7, §4.2.7 · p. 7

4.2.8 Bat algorithm (BA)

  • The bat algorithm balances PSO with local search through loudness and pulse-rate parameters, while TLBO uses teacher and learner procedures with only population size and iteration count as control parameters.The described bat algorithm could not solve binary problems, prompting a binary variant.Source: §4.2.8 · p. 7, §4.2.9 · p. 7

4.3 Fuzzy Inference Systems

  • Fuzzy systems map inputs to outputs through membership functions, inference, and defuzzification; their interpretable rules require tuning and do not adapt themselves to new environments.Sugeno uses a single-point consequent and is described as more efficient than Mamdani, which requires finding a centroid.Source: §4.3 · p. 7

5 ARTIFICIAL INTELLIGENCE IN SDN

The section surveys AI use in SDN across networking tasks, including routing, traffic classification, security, and resource allocation. It identifies machine learning, meta-heuristics, and fuzzy systems as common approaches in recent SDN research.

5 ARTIFICIAL INTELLIGENCE IN SDN

  • AI and machine learning approaches have been applied to SDN tasks including routing, traffic classification, flow clustering, intrusion and fault detection, and resource allocation.The cited applications also include load balancing and QoS/QoE optimization.Source: §5 · p. 7
  • The authors report a strong research and industry tendency toward adopting AI approaches in SDN.They describe AI's role in SDN as having increased significantly.Source: §5 · p. 8
  • Machine learning, meta-heuristics, and fuzzy systems are identified as the most common approaches for networking problems in SDN.The study investigates their application areas separately.Source: §5 · p. 8

5.1.1 Supervised learning in SDN

The survey reviews supervised learning in SDN across neural networks, SVMs, decision trees, ensemble methods, and supervised deep learning. Reported applications span security and traffic tasks as well as prediction and network management, with results varying by method and task.

5.1.1 Supervised learning in SDN

  • The surveyed supervised-learning approaches include neural networks, SVMs, decision trees, ensemble methods, and supervised deep learning.The review lists these as commonly used supervised techniques in SDN.Source: §5.1.1 · p. 8

5.1.1.1 Neural Networks in SDN

  • Neural networks were used for intrusion detection, controller placement, load balancing, traffic prediction, SLA enforcement, routing, and VM placement, with reported performance gains across several tasks.Examples include up to two-thirds less algorithm runtime for controller placement and 19.3% lower network latency for load balancing [106].Source: §5.1.1.1 · p. 8

5.1.1.2 Support Vector Machines in SDN

  • SVMs were used mainly for intrusion detection, with studies also applying them to traffic filtering, DoS detection, and long-term controller-load detection.Reported results include 97.60% accuracy on KDD CUP99 and 97.6% accuracy with a 3.85% false positive rate for an SVM-SOM approach [117].Source: §5.1.1.2 · pp. 8–9

5.1.1.3 Decision Trees in SDN

  • Decision trees were applied to classification, intrusion detection, flow-table congestion, botnet detection, and elephant-flow detection, with reported results depending on the task.Atlas reported 94% average accuracy, while C4.5-based flow-table compression reduced average matching time by 98%.Source: §5.1.1.3 · pp. 9–10

5.1.1.4 Ensemble methods in SDN

  • Ensemble methods, especially random forests, were reported across service metrics, intrusion detection, QoE prediction, traffic classification, and security tasks.For DDoS detection in an SDN-based cloud, XGBoost achieved 98.53% accuracy versus 96.33% for RF, 97.69% for GBDT, and 97.19% for SVM.Source: §5.1.1.4 · pp. 10, 12

5.1.1.5 Supervised deep learning in SDN

  • Supervised deep learning was reported for intrusion detection, flow measurement, and traffic-matrix prediction, with recurrent models outperforming several traditional alternatives in cited studies.A GRU-RNN achieved 89% accuracy in intrusion detection; DeepFlow reported MAPE of 12% on CAIDA traces and 3.9% on a simulated Google B4 topology.Source: §5.1.1.5 · p. 12

5.1.2 Unsupervised learning in SDN

Unsupervised methods used in SDN include clustering, self-organizing maps, probabilistic models, and deep learning; applications span traffic and attack detection, routing, and network management.

5.1.2.1 K-means clustering in SDN

  • K-means combined with probabilistic transitions detected application-layer DDoS attacks better than CURE with probabilistic transitions and n-gram with k-means.Other k-means uses included Wi-Fi Direct clustering, controller placement, campus traffic profiling, and DDoS detection; k-center beat k-medoids for controller placement, while k-means reduced processing time versus k-NN and Naive Bayes in DDoS detection.Source: §5.1.2.1 · p. 13

5.1.2.2 Self-Organizing Maps (SOM) in SDN

  • SOM-based approaches addressed intrusion and DDoS detection, with feature selection enabling SGuard to achieve high detection rates using fewer features and handle IP/MAC spoofing.The reviewed SOM studies used traffic features and, in SGuard, feature-ranking and feature-selection algorithms.Source: §5.1.2.2 · p. 13
  • DSOM merged maps trained at individual switches and outperformed single SOM in system overhead; its accuracy rose from around 96.5% with 400 neurons to above 97% with 900 or 1600.False alarm rate also decreased as neuron count increased.Source: §5.1.2.2 · p. 13
  • Other SOM studies reported high detection with low false positives, while comparisons found trade-offs among detection rate, processing time, and false-positive rate.Hierarchical-LVQ1 was more efficient than SOM and LVQ1; for DDoS detection, SOM with k-NN beat SOM distributed-center on detection and false-positive rates but took longer, while distributed-center had high false positives.Source: §5.1.2.2 · pp. 13–14

5.1.2.3 Hidden Markov model (HMM) in SDN

  • HMMs modeled security-state assessment and multi-stage APT detection using Baum-Welch training and Viterbi prediction; reported outcomes included 88.25% prediction accuracy and low-overhead APT stage detection.The security assessment ranked switch-compromise status highest on average, followed by ARP, OpenFlow flooding, scanning, and normal situations.Source: §5.1.2.3 · p. 14

5.1.2.4 Restricted Boltzmann machine (RBM) in SDN

  • A restricted Boltzmann machine detected DDoS attacks with a 92% detection rate and 8% false-positive rate on a dataset generated with hping3.The model used source and destination IP addresses, source and destination ports, and protocol type as input features.Source: §5.1.2.4 · p. 14

5.1.2.5 Unsupervised deep learning approaches in SDN

  • Deep-belief-network routing outperformed OSPF in throughput and average delay per hop and ran over 100 times faster on GPU than CPU; SAE-based classifiers improved application and attack classification.The 8-class DDoS detector reached 95.65% accuracy, and binary detection reached 99.82% accuracy with 0.3% false positives; content-popularity classification improved accuracy by 2.1%-15% over neural networks and 5.2%-40% over autoregressive methods.Source: §5.1.2.5 · p. 14

5.1.2.6 Other unsupervised ML approaches in SDN

  • Other unsupervised methods used feature selection and density-peak clustering for anomaly detection and mitigation, or Dirichlet process mixture clustering for DNS query-based DDoS mitigation.The two-stage method could locally analyze traffic at hierarchical controllers to reduce traffic exchanged across the network; the DNS method outperformed mean-shift clustering.Source: §5.1.2.6 · p. 14

5.1.3 Reinforcement learning in SDN

Reinforcement learning was widely applied in SDN routing and adaptive video streaming, with studies also addressing QoS, traffic engineering, and data-center management. Reported outcomes vary by objective and configuration.

5.1.4 Reinforcement learning in SDN

  • RL-based multimedia QoS and adaptive streaming approaches reported improved QoS, video stability, fairness, or network resource utilization against their stated baselines.LearnQoS introduced network overhead despite improving QoS; Q-FDBA outperformed bandwidth-aware streaming and QFF on QoE fairness.Source: §5.1.3 · pp. 14–15
  • Reinforcement-learning routing reduced loss and improved jitter versus OSPF, while Q-learning congestion prevention outperformed Dijkstra and extended Dijkstra as transmitted-data size increased; single-path forwarding achieved the lowest jitter.Source: §5.1.3 · pp. 14–15
  • MIND used online REPS-RKHS to learn a distribution over top-k paths, while UbuntuNet traffic engineering found latency and jitter best with rewards based on both link capacity and latency.The UbuntuNet study instead achieved best throughput when rewards were based on available bandwidth; its reported latency and jitter outcomes depended on reward configuration.Source: §5.1.3 · p. 15
  • CRE found near-optimal paths using 9.5 times less monitoring data than conventional SDN, although its solutions averaged 1.65% worse than optimal RTT.Its random-neural-network reinforcement-learning module searches paths against a customizable QoS objective; monitoring and OpenFlow translation are handled by separate modules.Source: §5.1.3 · p. 15
  • Deep RL routing outperformed its primary benchmark, while DeepConf found near-optimal solutions across Fat-tree and VL2 data-center topologies.DeepConf used A3C agents and a network simulator to manage data-center topologies, targeting link utilization and average flow-completion time.Source: §5.1.3 · p. 15

5.1.4 Semi-supervised learning in SDN

Semi-supervised learning was less common than other learning approaches in SDN and was applied to traffic classification, routing, and intrusion detection.

5.1.4 Semi-supervised learning in SDN

  • Laplacian SVM enabled QoS-aware traffic classification and outperformed a prior semi-supervised k-means classifier.The framework also supported deep packet inspection.Source: §5.1.4 · p. 16
  • A routing predesign proposal combined clustering for feature extraction, supervised ELM for flow-demand forecasting, and AHP-based adaptive multipath routing for elephant flows.The proposed approach suggested Gaussian mixture model or k-means clustering for feature extraction.Source: §5.1.4 · p. 16
  • NACC represented applications with k-means cluster-centroid matrices and used a small labeled-flow set alongside correlated unlabeled flows, reaching 90% identification accuracy.The method mapped applications to different clusters using the correlated flows.Source: §5.1.4 · p. 16
  • A modified CPLE method for wireless SDN e-health intrusion detection outperformed Naive Bayes, SVM, DNN, self-training, and original CPLE on NSL-KDD.The system used offline training and online testing for localized detection on wireless mMTC devices.Source: §5.1.4 · p. 16

5.2 Meta-heuristic Algorithms Used in SDN

SDN studies applied many meta-heuristics to routing, placement, security, resource allocation, and optimization, including ant colony, evolutionary, swarm, and other algorithms.

5.2.1 Ant colony optimization in SDN

  • ACO studies covered routing, load balancing, security, and network utilization, with reported gains in QoE, spectrum blocking, routing-rule consumption, throughput, latency, and packet loss.A4SDN outperformed two Dijkstra variants on throughput, end-to-end latency, and packet loss; WACO improved network utilization and throughput by up to 16% under a QoS condition, while random routing mutation imposed increased controller burden.Source: §5.2.1 · pp. 16–17

5.2.2 Evolutionary algorithms in SDN

  • Evolutionary algorithms addressed controller placement, QoS- and energy-aware routing, and moving-target defense; Evo-Place produced a better Pareto frontier than randomized placement under equal evaluation counts.The QoS- and energy-aware routing method significantly outperformed modified shortest-path routing on accepted demands; MOGA was suggested as suitable for moving-target-defense requirements.Source: §5.2.2 · p. 17

5.2.2.1 Genetic algorithms in SDN

  • Genetic algorithms supported routing, virtual-network planning, DPI deployment, load balancing, observation-matrix design [205], SDN data-center resource reallocation, and congestion avoidance.For DPI deployment in NFV-SDNs, relaxing the used-link-capacity constraint reduced global cost by up to 58%.Source: §5.2.2.1 · pp. 17–18

5.2.3 Particle swarm optimization in SDN

  • PSO and hybrid PSO methods supported routing, resource management, virtual-network customization, and DDoS detection, with reported energy, bandwidth, power, and throughput benefits.PSOPR achieved more than 90% of optimal network power consumption using 0.0045% to 0.9% of optimal computation time; PALM saved 36% and 16% power versus EEM and DS+DAT, respectively.Source: §5.2.3 · p. 18

5.2.4 Simulated annealing in SDN

  • Simulated annealing improved controller placement or provisioning results, but one WAN study found longer runtime than greedy knapsack despite smaller overhead.Adding many controllers adversely affected reliability by creating too many control paths, which could form a full mesh.Source: §5.2.4 · p. 19

5.2.5 Bee colony optimization-based algorithms in SDN

  • Bee-colony methods improved video-surveillance routing metrics over Dijkstra, while a cloud load balancer reached a higher average-response-time saturation point than HFA and round robin.The video-routing comparison covered average end-to-end delay, packet delivery ratio, and PSNR.Source: §5.2.5 · p. 19

5.2.6 Whale optimization algorithm in SDN

  • WOA was more accurate and faster than PSOGSA for cloud provisioning, while WOA-based IoT clustering reduced power consumption and increased received packets over conventional and PSO clustering.The packet count improved approximately 55% over conventional clustering and 20% over PSO clustering.Source: §5.2.6 · p. 19

5.2.7 Firefly optimization in SDN; 5.2.8 Bat algorithm in SDN; 5.2.9 Teaching-learning-based optimization in SDN; 5.2.10 Grey wolf optimization in SDN

  • Firefly optimization produced efficient and accurate controller placements, and binary bat feature selection yielded attack-specific detection rates; TLBO improved telesurgery QoS metrics.Chaotic GWO was 1% more accurate in 68% fewer iterations than traditional PSO for dynamic controller allocation.Source: §5.2.7 · p. 19, §5.2.8 · p. 19, §5.2.9 · p. 19

5.3 Fuzzy Inference Systems in SDN

Fuzzy inference systems are applied in SDN to protocol design, intrusion detection, deployment selection, and traffic engineering.

5.3 Fuzzy Inference Systems in SDN

  • Fuzzy-inference applications in SDN span protocol design, intrusion detection, deployment selection, and traffic engineering.Source: §5.3 · p. 20
  • 97% of attack flows were detected, with approximately 5% false positives and 50% fewer flow entries during attacks using Sugeno fuzzy inference.The method used packet inter-arrival and single-packet-flow rates as inputs.Source: §5.3 · p. 20
  • A fuzzy DoS-flood defense had lower computational load and response time than SynCookie and a service-provider firewall; another system detected 95% of attacks with 1.2% false positives.The latter used Mamdani inference, with threat degree based mainly on TRW-CB and rate-limiting algorithms.Source: §5.3 · p. 20
  • A 21-rule Mamdani model maps five network and deployment inputs to a technology choice, while adaptive type-2 fuzzy traffic engineering outperformed three alternatives on delay, PSNR, and packet loss.The comparison included type-1 fuzzy, available-bandwidth-based traffic engineering, and OSPF.Source: §5.3 · p. 20

5.4 Other AI-based Approaches in SDN

The section surveys hybrid and other AI-based approaches across SDN security, traffic management, resource allocation, and application identification.

5.4 Other AI-based Approaches in SDN

  • 65% fewer video freezes and 45% less freeze time were reported for RUSBoost combined with fuzzy logic versus FINEAS and MSS.Source: §5.4 · p. 20
  • For DoS/DDoS mitigation, HWDS performed better in performance tests, while Fuzzy-GADS was more efficient at detecting stealthier anomalies.HWDS combined Holt-Winters anomaly detection with game-theoretic defense selection.Source: §5.4 · p. 20
  • A hybrid 5G intrusion detector reported 94.48% precision, 92.62% recall, 91.02% F1, and 0.54% false positives; a clustered k-means/SVM method reported 88.7% accuracy and 82.3% precision.The first used 23 KDD99 features; the second used entropy analysis before clustering and SVM classification.Source: §5.4 · p. 20
  • PSO selected network-efficiency inputs with better performance and faster convergence than GA, while a separate SDN video-management system used EigenFace, FisherFace, and LBP.Source: §5.4 · p. 20
  • HCSP reduced RTT and increased revenue versus OSPF and Round Robin; combining DNS-response inspection with machine learning achieved higher application-identification accuracy than standalone ML.HCSP combines chaotic PSO with simulated annealing; the application classifier used a voting strategy.Source: §5.4 · p. 20
  • FSOMDM, a fuzzy self-organizing-map DDoS mitigation approach for cloud SDNs, achieved a 94% true positive rate.Source: §5.4 · p. 21
  • Hybrid assignment and MCTS traffic prediction were the strongest data-center selection approaches; prediction had low blocking and efficient resource use, while hybrid assignment had higher blocking under high loads but slightly lower cost.Source: §5.4 · p. 21
  • A two-stage flooding detector reached 95.68% detection with 10% false positives and low overhead by monitoring vulnerable switches rather than all switches.It classified potentially compromised switches with a Bayesian network, then used fuzzy c-means to determine whether flooding occurred.Source: §5.4 · p. 21

6 CONCLUSION

The overview finds growing adoption of AI techniques in SDN, especially machine learning, meta-heuristics, and fuzzy systems. It also identifies adversarial robustness as an area needing further study.

6 CONCLUSION

  • The overview reports increased adoption of AI techniques for diverse networking problems and SDN-related challenges, with machine learning, meta-heuristics, and fuzzy systems most common.Source: §6 · p. 21
  • Recent machine-learning advances, including deep learning and hybrid AI, can provide better results than traditional machine-learning approaches.Source: §6 · p. 21
  • The authors describe AI approaches as useful tools in SDN, while calling for more study of their robustness under adversarial settings.Source: §6 · p. 21
Loading 1803.06818v3…