Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> K-means clustering in SDN <s> The recently emerging paradigm of software defined networking (SDN) predominantly employs the control-data plane OpenFlow protocol, offering centralized real-time programmability and monitoring of network devices. Effective SDN based traffic engineering using OpenFlow, particularly in campus networking however, requires sophisticated real-time user traffic visualization solution having minimum management overhead. To address the intuitive monitoring gaps in existing campus based SDN, the present paper proposes profiling campus user traffic to visualize real-time network workload and accurately provision resources. The design solely utilizes existing OpenFlow traffic measurements, subjected to k-means clustering to segregate users into different traffic classes (profiles) based on their application trends. To validate design feasibility, the present study derived six unique user traffic profiles from OpenFlow generated traffic statistics of a realistic campus switch over a two-week time frame. The derived profiles represented significant discrimination among user application trends and were further benchmarked for high stability (96.1–99.1%), to ascertain their viability for monitoring purposes. Additional simulation tests at varying user loads attributed minimum computational cost and low OpenFlow control overhead (4.02–4.96%) to the proposed approach, offering high scalability for real-time network monitoring and resource provisioning. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> K-means clustering in SDN <s> Software Defined Network (SDN) architecture is a new and novel way of network management. In SDN, switches do not process the incoming packets. They match for the incoming packets in the forwarding tables and if there is none it will be sent to the controller for processing which is the operating system of the SDN. A Distributed Denial of Service (DDoS) attack is a biggest threat to cyber security in SDN network. The attack will occur at the network layer or the application layer of the compromised systems that are connected to the network. In this paper we discuss the DDoS attacks from the traces of the traffic flow. We use different machine learning algorithms such as Naive Bayes, K-Nearest neighbour, K-means and K-medoids to classify the traffic as normal and abnormal. Then these algorithms are measured using parameters such as detection rate and efficiency. The algorithm having more accuracy is chosen to implement Signature IDS and results of it are then processed by Advanced IDS which detects anomalous behaviour based on open connections and provides accurate results of the hosts specifying which hosts is involved in the DDOS attack. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> K-means clustering in SDN <s> With the emergence of cloud computing, many attacks, including Distributed Denial-of-Service (DDoS) attacks, have changed their direction towards cloud environment. In particular, DDoS attacks have changed in scale, methods, and targets and become more complex by using advantages provided by cloud computing. Modern cloud computing environments can benefit from moving towards Software-Defined Networking (SDN) technology, which allows network engineers and administrators to respond quickly to the changing business requirements. In this paper, we propose an approach for detecting application-layer DDoS attacks in cloud environment with SDN. The algorithm is applied to statistics extracted from network flows and, therefore, is suitable for detecting attacks that utilize encrypted protocols. The proposed detection approach is comprised of the extraction of normal user behavior patterns and detection of anomalies that significantly deviate from these patterns. The algorithm is evaluated using DDoS detection system prototype. Simulation results show that intermediate application-layer DDoS attacks can be properly detected, while the number of false alarms remains low. <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> K-means clustering in SDN <s> Mobile cloud is changing the way to enroll teaching activities in a university campus. Lectures and lab sessions can be carried out directly from tablets in a classroom by accessing a server in the cloud. In this paper, we address the problem of high-density cloud access with wireless devices in campus networks. We propose to use Wi-Fi direct clustering to solve the problem of quality of service (QoS) degradation when a high number of wireless devices want to access a content in the cloud at the same time. A centralized software-defined network controller is used in our proposed architecture to capture the network state and organize the Wi-Fi Direct groups. The optimized number of clusters can be calculated in function of the number of devices in the room. By simulations, we show that we can provide a better QoS in terms of download time and application’s throughput by reducing the interference in this dense wireless network environment. <s> BIB004
Ivannikova et al. BIB003 proposed a method for detecting application layer DDoS attacks in SDN-based cloud environments based on k-means and probabilistic transition. They extracted the following features at every time interval: 1) duration of the conversation, 2) number of packets sent in 1 second, 3) number of bytes sent in 1 seconds, 4) average packet size, and 5) presence of packets with different TCP flags. First, clustering is used to divide the features into different groups that represent specific classes of network traffic. Then conversations with the same source IP, destination IP and destination port at a certain time interval are grouped together. Each session in every time window is represented by a sequence of cluster labels obtained from the first step. Finally, they estimate conditional and marginal probabilities from the previously obtained sequences. Then they compare it against a corresponding threshold value, if it is lower then it is marked as anomalous. The experimental results showed that the combination of k-means and the probabilistic transition approach achieves the best results when compared with both Clustering Using REpresentatives (CURE) with the probabilistic transition, and n-gram with k-means respectively. Nguyen et al. BIB004 introduced a k-means approach for achieving Wi-Fi direct clustering in campus networks. Their simulation results showed that the proposed approach achieves better performances in terms of download time and packet error rate compared to the Wi-Fi infrastructure mode. Sahoo et al.  investigated the problem of optimal controller placement based on k-means approach. They considered two clustering algorithms namely: k-medoids and k-center. The experimental results showed that k-center algorithm achieves better result than K-Medoids. Bakhshi and Ghita BIB001 used k-means for user traffic profiling in campus SDN based on their application trend. They derived six unique user traffic profiles obtained from OpenFlow statistics, which were generated by realistic campus switch during two-week. Their proposed system showed minimum computational cost and low OpenFlow control overhead. Barki et al. BIB002 used Naive bayes, k-NN, k-means and k-medoids for detecting DDoS attacks in SDN, where the highest detection rate achieved by naive bayes approach. K-means, on the other hand, achieved better results over kNN and Naive Bayes in terms of processing time.