Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Support Vector Machines in SDN <s> Software Defined Networking (SDN) provides separation of data plane and control plane. The controller has centralized control of the entire network. SDN offers the ability to program the network and allows dynamic creation of flow policies. The controller is vulnerable to Distributed Denial of Service (DDoS) attacks that leads to resource exhaustion which causes non-reachability of services given by the controller. The detection of DDoS requires adaptive and accurate classifier that does decision making from uncertain information. It is critical to detect the attack in the controller at earlier stage. SVM is widely used classifier with high accuracy and less false positive rate. We analyze the SVM classifier and compare it with other classifiers for DDoS detection. The experiments show that SVM performs accurate classification than others. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Support Vector Machines in SDN <s> In this paper, we propose an optimized protection mechanism (OpenFlowSIA) for Software-Defined Networks from flooding attacks (Distributed Denial-of-Service) based on Support Vector Machine and our proposed algorithm called the Idle-timeout Adjustment (IA). Our methodology not only utilizes SVM advantages in classification such as high accuracy and little processing time, but also applies effectively the IA algorithm and coherent policies to protect network from resource exhaustion caused by flooding attacks, particularly for the SDN controller and OpenFlow switches. Through comprehensive experiments, the OpenFlowSIA scheme illustrates that it can be an innovative solution to secure and save the network resources under flooding attacks in the Software-Defined Networks. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Support Vector Machines in SDN <s> Most existing approaches for solving the network threat problems focus on the specific security mechanisms, for example, network intrusion detection system (NIDS) detection, firewall configuration, rather than on flow management approaches to defend network threats with an SDN (Software Defined Networking) architecture. Accordingly, this study proposes an improved behaviour-based SVM (support vector machine) with learning algorithm for use in the security monitoring system (SMS) to categorize network threats for network intrusion detection system. The model also adopted the ID3 decision tree theory to outrank raw features and determine the most qualified features to train support vector classifier (SVC) considering the overall detection precision rate of experiments which speeds up the learning of normal and intrusive patterns and and increases the accuracy of detecting intrusion. By using sFlow collector and analyzer associated with sFlow-RT toolset, the experimental results proved that the SMS enables a defender to classify the network threats with defence strategies and defend network threats. <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Support Vector Machines in SDN <s> In this paper, we firstly introduce a new combined approach to enhance the performance of classification in network traffic. The proposed combination mainly focuses on taking advantages of two classification algorithms, Support Vector Machine (SVM), Self Organizing Map (SOM). We utilize both advantages that SVM takes a little time to produce outputs with a high accuracy, SOM makes a reliable prediction based on their neurons. Next, we propose a hybrid flow-based work mechanism, which applies the proposed combination SVMs-SOM, for handling with Distributed Denial-of-Service (DDoS) attacks, network component protection from resource exhaustion in Software-Defined Networking. In the introduced scheme, multiple Linear SVMs first classify flow entries existing in flow-tables from OpenFlow switches. In the case that a flow's position is located between two margin lines or a vague region in the Linear SVM representation, it will be then forwarded to a SOM to make a final decision. Afterwards, an attack classifier, a policy enforcement module will be applied to attack flows with the purpose of attack diminution, the SDN controller protection. Besides, we also provide readers with a new view of DDoS attacks in the Software-Defined Networking. Thorough practical experiments conducted in the Software-Defined Networking environment, it is proved that the proposed classification combination outperforms original algorithms,, the novel hybrid mechanism can be an effective, innovative approach to face with DDoS attacks, protect the OpenFlow switches, the SDN controller from being overloaded. <s> BIB004 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Support Vector Machines in SDN <s> Intrusion Detection Systems (IDS) are aimed at analyzing and detecting security problems. IDS based on anomaly detection and, in particular, on statistical analysis, inspect each traffic flow in order to get its statistical characterization, which represents the fingerprint of the flow. Software Defined Networking (SDN) is revolutionizing the networking industry by enabling programmability, easier management and faster innovation. These benefits are made possible by its centralized control plane architecture which allows the network to be programmed and controlled by one central entity. The fusion of these two technologies can lead to an innovative system of malware detection. This paper tries to join these two concepts in order to obtain the best from the two worlds. We use a well known machine learning scheme (Support Vector Machine) as core system for detecting malware by using only traffic features that can be extracted using an SDN controller. <s> BIB005 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Support Vector Machines in SDN <s> Distributed Denial-of-Service (DDoS) flooding attack is one of the most serious threats to network security. Software-Defined Networking (SDN) has recently emerged as a new network management platform, and its centralized control architecture brings many new opportunities for defending against network attacks. In this paper, we propose FADM, an efficient and lightweight framework to detect and mitigate DDoS attacks in SDN. Firstly, the network traffic information is collected through the SDN controller and sFlow agents. Then an entropy-based method is used to measure network features, and the SVM classifier is applied to identify network anomalies. By adopting these methods together, the timeliness and accuracy of attack detection are effectively improved. To keep the major network functionality working, we propose an efficient attack mitigation mechanism based on the white-list and traffic migration. By introducing the mitigation agent to the network, attack traffic can be timely blocked while benign traffic can be forwarded as usual, which prevents the controller resources from being exhausted and ensures that legitimate users can access the network normally. The experimental results show that multiple DDoS attacks can be accurately detected and effectively mitigated by FADM, which enables the network to recover in a short time. <s> BIB006 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Support Vector Machines in SDN <s> The controller is a critical piece of the SDN architecture, where it is considered as the mastermind of SDN networks. Thus, its failure will cause a significant portion of the network to fail. Overload is one of the common causes of failure since the controller is frequently invoked by new flows. Even through SDN controllers are often replicated, the significant recovery time can be an overkill for the availability of the entire network. In order to overcome the problem of the overloaded controller failure in SDN, this paper proposes a novel controller offload solution for failure mitigation based on a prediction module that anticipates the presence of a harmful long-term load. In fact, the long-standing load would eventually overwhelm the controller leading to a possible failure. To predict whether the load in the controller is short-term or long-term load, we used three different classification algorithms: Support Vector Machine, k-Nearest Neighbors, and Naive Bayes. Our evaluation results demonstrate that Support Vector Machine algorithm is applicable for detecting the type of load with an accuracy of 97.93% in a real-time scenario. Besides, our scheme succeeded to offload the controller by switching between the reactive and proactive mode in response to the prediction module output. <s> BIB007 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Support Vector Machines in SDN <s> Software-Defined Networking (SDN) is an emerging networking paradigm that provides an advanced programming capability and moves the control functionality to a centralized controller. This paper proposes a two-stage novel intelligent approach that takes advantage of the SDN approach to detect Denial of Service (DoS) flooding attacks based on calculation of packet rate as the first step and followed by Support Vector Machine (SVM) classification as the second step. Flow concept is an essential idea in OpenFlow protocol, which represents a common interface between an SDN switch and an SDN controller. Therefore, our system calculates the packet rate of each flow based on flow statistics obtained by SDN controller. Once the packet rate exceeds a predefined threshold, the system will activate the packet inspection unit, which, in turn, will use the (SVM) algorithm to classify the previously collected packets. The experimental results showed that our system was able to detect DoS flooding attacks with 96.25% accuracy and 0.26% false alarm rate. <s> BIB008 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Support Vector Machines in SDN <s> Multimedia traffic has drastically grown in the last few years. In addition, some of the last paradigms proposed, like the Internet of Things (IoT), adds new types of traffic and applications. Software-defined networks (SDNs) improve the capability of network management. Combined with SDN, artificial intelligence (AI) can provide solutions to network problems based on classification and estimation techniques. In this paper, we propose an artificial intelligence system for detecting and correcting errors in multimedia transmission in a surveillance IoT environment connected through a SDN. The architecture, algorithm, and messages of the SDN are detailed. The AI system design is described, and the test-bed and the data set are explained. The AI module consists of two different parts. The first one is a classifying part, which detects the type of traffic that is sent through the network. The second part is an estimator that informs the SDN controller on which kind of action should be executed to guarantee the quality of service and quality of experience. Results show that with the actions performed by the network, like jitter can be reduced up to 70% of average and losses can be reduced from 9.07% to nearly 1.16%. Moreover, the presented AI module is able to detect critical traffic with 77% accuracy. <s> BIB009
Support vector machine (SVM) approach was mainly used for deploying intrusion detection systems in the SDN paradigm BIB001 BIB002 BIB003 BIB005 BIB004  BIB006 BIB008 . Kokila et al. BIB001 proposed a method for detection of DDoS attacks on the SDN controller. SVM showed higher accuracy and less false positive rate when compared to other classifiers. Phan et al. BIB002 proposed, OpenFlowSIA, a framework for detection of flooding attacks based on SVM and idle-timeout adjustment (IA) algorithm, which leads to an accurate system and reduction of CPU usage of Open vSwitches and their correspondence SDN controller. On the other hand, an SVM approach for network intrusion introduced in BIB003 . The model also employed the ID3 decision tree approach for feature selection. Based on the experimental results conducted on KDD CUP99 dataset, the system showed an accuracy of 97.60%. Boero et al. BIB005 used SVM for SDN-based malware detection where information gain (IG) metric was used for selecting the most relevant features. Their model achieved a detection rate of 80% and 95% for malware and normal traffic respectively. In addition, it showed a false positive rate of 5.4% and 18.5% for malware and normal traffic respectively. Phan et al. BIB004 proposed a new approach that combines SVM with self-organizing map (SOM) in order to get a higher accuracy and better detection rate for DDoS attacks in SDN, as well as achieving lower false alarm rate. The input vector for the SOM module is a 4-tuple including four attributes: number of packet, number of byte, duration and protocol. The experimental results showed that this system was able to achieve an accuracy of 97.6% and a false positive rate of 3.85%. Shang et al.  proposed an SVM approach for implementing a traffic-based filtering classifier, which represents the second stage of a framework proposed to mitigate DoS attacks. Their model showed a high detection rate when attack rate is higher than 3000 packets per second. Hu et al. BIB006 proposed ,FADM, a real-time lightweight framework for detecting and mitigating DDoS attacks in SDN. The real-time attack detection module works as an application in the controller. The attack mitigation module consists of two main components: 1) Mitigation server and 2) Mitigation agent. The mitigation server works as an application in the controller whereas the mitigation agent runs on a host in the SDN network. In the detection stage, the authors collected the following features: source IP address entropy, destination IP address entropy, source port entropy, destination port entropy and protocol type. The authors proposed to use controller-based method and sFlow-based method according to different network environments. The controller based method (i.e. based on the incoming Packet-In messages) is efficient for low rate attacks. Whereas sFlow-based method (i.e. flow samples generated periodically from sFlow agents embedded in OF-enabled switches) is efficient for high rate attacks. FADM was implemented on the POX controller. TFN2K tool was used to launch multiple types of DDoS flooding attacks. The SVM algorithm was trained on a relatively small training dataset which consists of 552 attack samples and 662 benign samples. The attack mitigation mechanism was based on white-list and dynamic updating of forwarding rules. Compared to the controller-based method, the sFlow-based method showed higher detection rate reached 100% when the attack rate was greater than 3000 packets per second (pps). In terms of the average detection, the difference between these methods is very small. Latah and Toker BIB008 introduced a two-stage SDN-based approach for detecting DoS attacks. The detection loop consists of the following two stages: 1) Calculation of packet rate on the controller side and 2) SVM classification on the host side. When the packet rate exceeds a predefined probability, then the system will activate a host-based packet inspection unit, which collects packet-based statistics during a 4-second period and then uses the RBF-SVM algorithm in order to determine whether the attack is happened or not. The authors generated a dataset which consists of 321 instances of normal traffic and 639 instances of DoS flooding attack. Thereafter, the system was evaluated using 10-fold cross-validation and achieved 96.25% accuracy with 0.26% false alarm rate. Rego et al. BIB009 presented an intelligence system to detect problems and correct errors in multimedia transmission in surveillance SDN-based IoT environments. Their proposed AI module consists of two different parts. The first one is the traffic classification part based on SVM algorithm, which detects the type of network traffic. The second part is an estimator that informs the SDN controller on which kind of action should be taken to guarantee the quality of service (QoS) and quality of experience (QoE). The experimental results showed that the jitter was reduced up to 70% on average and losses were reduced from 9.07% to nearly 1.16%. Furthermore, SVM was able to detect critical traffic with an accuracy of 77%. Bouacida et al. BIB007 employed supervised approaches to detect long-term load on SDN controllers. They generated a dataset contains nine features and 2344 instances (799 instances labeled as long-term load, 1545 instances labeled as short-term load) based on injecting Packet-In messages to the controller. The experimental results showed that the linear SVM approach achieved the best results among k-nn and Naive Bayes approaches in terms of accuracy, precision, F1-measure and Area Under AUC curve. In addition, the real-time evaluation showed that both of accuracy and precision values diminish proportionally when they use larger look-ahead intervals. Moreover, offloading delay increases linearly with the number of flow entries.