Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised deep learning in SDN <s> Software Defined Networking (SDN) has recently emerged to become one of the promising solutions for the future Internet. With the logical centralization of controllers and a global network overview, SDN brings us a chance to strengthen our network security. However, SDN also brings us a dangerous increase in potential threats. In this paper, we apply a deep learning approach for flow-based anomaly detection in an SDN environment. We build a Deep Neural Network (DNN) model for an intrusion detection system and train the model with the NSL-KDD Dataset. In this work, we just use six basic features (that can be easily obtained in an SDN environment) taken from the forty-one features of NSL-KDD Dataset. Through experiments, we confirm that the deep learning approach shows strong potential to be used for flow-based anomaly detection in SDN environments. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised deep learning in SDN <s> Providing fine grained traffic measurement is crucial for many network management tasks such as traffic engineering, anomaly detection, traffic accounting, and load balancing. Software-defined networks can potentially enable fine-grained measurement by providing statistics for each forwarding rule of an OpenFlow-enabled switch. However, providing fine grained traffic measurement in a scalable fashion in hardware switches poses significant challenges due to the limitations in the size of the TCAMs that fit only a relatively small number of rules compared to the number of active flows in the network. In this paper, we present DeepFlow, a framework for scalable software-defined measurement that relies on an efficient mechanism that a) adaptively detect the most active source and destination prefixes in the network, b) collects fine-grained flow-size measurements for the most active prefixes and coarse grained for the less active ones, and c) uses historical measurements in order to train a cloud-based Deep Learning model that can be used to provide short-term predictions whenever exact flow counters cannot be placed at a switch due to its limited resources. Thus the number of fine-grained flows measured can increase significantly without the need to use other flow sampling solutions that loose accuracy. An extensive experimental evaluation using a prototype implementation and real network traces shows that DeepFlow can provide very high accuracy for estimating flow sizes at various aggregation levels. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised deep learning in SDN <s> This paper introduces NeuRoute, a dynamic routing framework for Software Defined Networks (SDN) entirely based on machine learning, specifically, Neural Networks. Current SDN/OpenFlow controllers use a default routing based on Dijkstra algorithm for shortest paths, and provide APIs to develop custom routing applications. NeuRoute is a controller-agnostic dynamic routing framework that (i) predicts traffic matrix in real time, (ii) uses a neural network to learn traffic characteristics and (iii) generates forwarding rules accordingly to optimize the network throughput. NeuRoute achieves the same results as the most efficient dynamic routing heuristic but in much less execution time. <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised deep learning in SDN <s> Software Defined Networking (SDN) has emerged as a key enabler for future agile Internet architecture. Nevertheless, the flexibility provided by SDN architecture manifests several new design issues in terms of network security. These issues must be addressed in a unified way to strengthen overall network security for future SDN deployments. Consequently, in this paper, we propose a Gated Recurrent Unit Recurrent Neural Network (GRU-RNN) enabled intrusion detection systems for SDNs. The proposed approach is tested using the NSL-KDD dataset, and we achieve an accuracy of 89% with only six raw features. Our experiment results also show that the proposed GRU-RNN does not deteriorate the network performance. Through extensive experiments, we conclude that the proposed approach exhibits a strong potential for intrusion detection in the SDN environments. <s> BIB004 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised deep learning in SDN <s> This paper presents NeuTM, a framework for network Traffic Matrix (TM) prediction based on Long Short-Term Memory Recurrent Neural Networks (LSTM RNNs). TM prediction is defined as the problem of estimating future network traffic matrix from the previous and achieved network traffic data. It is widely used in network planning, resource management and network security. Long Short-Term Memory (LSTM) is a specific recurrent neural network (RNN) architecture that is well-suited to learn from data and classify or predict time series with time lags of unknown size. LSTMs have been shown to model long-range dependencies more accurately than conventional RNNs. NeuTM is a LSTM RNN-based framework for predicting TM in large networks. By validating our framework on real-world data from GEEANT network, we show that our model converges quickly and gives state of the art TM prediction performance. <s> BIB005 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised deep learning in SDN <s> In recent years, software defined networking (SDN) has become a novel network architecture and design by employing manageable software between the control and data planes. Many SDN-based intrusion detection systems (IDS) have been proposed in recent researches. On the other hand, deep learning has emerged as an explosive growth in research and industry. The application of deep learning on IDS has been studied in many security-critical scenarios. However, some reports has indicated the vulnerability of adversarial attacks on deep learning IDS system with intentional perturbation injection or manipulation. It is important for the empowered IDS system employing deep learning to be responsible for not leading misclassification. Therefore, exploring the impact on the adversarial attacks over SDN networks or security-critical scenarios applying deep learning is an important step to confront such urgent issues. In this paper, we will conduct the SDN-based experiments on adversarial attacks for deep learning detecting system. We propose a novel class of adversarial attacks that exploits the vulnerability of the deep learning classifiers in SDN environment. Three typical deep learning models combining with four different adversarial testing will be conducted in the simulation for complete analysis. <s> BIB006
Deep learning techniques have shown promising results in SDN compared to traditional ML approaches. Tang et al. BIB001 proposed an intrusion detection system based on a simple deep neural network, where deep learning approach achieved the best results compared to other supervised ML algorithms such as naive bayes, SVM and DT, with an accuracy of 75.75%. In BIB004 , The same authors improved their results by using GRU-RNN instead of the simple deep learning model. Their new proposed model outperformed their previous simple DNN-based model BIB001 , SVM and NB Tree with an accuracy of 89%. Lazaris and Prasanna BIB002 proposed, DeepFlow, an intelligent traffic measurement framework for SDNs that uses the available TCAM memory to install measurement rules for important flows, and employs LSTM-RNN to predict the size of rest of the flows when flow counters cannot be placed at a switch due to its limited resources, on the basis of historical data from previous measurement periods. The experimental results showed an average mean absolute percentage error (MAPE) of 12% for approximating real flow sizes on CAIDA traces and MAPE of 3.9% on simulating the network topology of Google's B4. Azzouni et al. BIB003 employed a (LSTM-RNN) approach for predicting traffic matrix. GÉANT traffic matrices and related network states were the input of the LSTM network. The authors implemented a GÉANT network topology and generated 10000 samples using Mininet. Experimental studies showed that this approach outperformed an efficient dynamic routing heuristic by finding the near optimal path in shorter time. In the same context, Azzouni and Pujolle BIB005 used (LSTM-RNN) for the same purpose. However, in this work they validate their model based on real-world data from GÉANT backbone networks. The experimental results showed that RRN-LSTM can outperform linear forecasting models (ARMA, ARAR, HW) and feed forward neural network (FFNN). Huang et al. BIB006 studied adversarial attacks on SDN-based deep learning port scan detection system. They applied three different adversarial attack mechanisms namely: Fast Gradient Sign Method (FGSM), Jacobian-based Saliency Map Attack (JSMA), JSMA reverse (JSMA-RE) to three different deep learning algorithms: MLP (which is previously refereed as DNN in this paper), CNN, LSTM. The deep learning models detected the port scan attacks based on Packet-In messages and STATs reports. They generated samples with three different adversarial test sets and one normal test set. JSMA showed a significant effect on the deep learning models ranges from 14 to 42%. JSMA-RE did not reduce the accuracy of CNN and LSTM, however it reduced the accuracy of MLP to 35%. FGSM caused a significant reduction in the accuracy of LSTM (more than 50%).