Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> Anomaly traffic detection and classification mechanisms need to be flexible and easy to manage in order to detect the ever growing spectrum of anomalies. Detection and classification are difficult tasks because of several reasons, including the need to obtain an accurate and comprehensive view of the network, the ability to detect the occurrence of new attack types, and the need to deal with misclassification. In this paper, we argue that Software-Defined Networking (SDN) form propitious environments for the design and implementation of more robust and extensible anomaly classification schemes. Different than other approaches from the literature, which individually tackle either anomaly detection or classification or mitigation, we present a management framework to perform these tasks jointly. Our proposed framework is called ATLANTIC and it combines the use of information theory to calculate deviations in the entropy of flow tables and a range of machine learning algorithms to classify traffic flows. As a result, ATLANTIC is a flexible framework capable of categorizing traffic anomalies and using the information collected to handle each traffic profile in a specific manner, e.g., blocking malicious flows. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> Abstract HTTP Adaptive Streaming (HAS) represents the dominant technology to deliver videos over the Internet, due to its ability to adapt the video quality to the available bandwidth. Despite that, HAS clients can still suffer from freezes in the video playout, the main factor influencing users’ Quality of Experience (QoE). To reduce video freezes, we propose a network-based framework, where a network controller prioritizes the delivery of particular video segments to prevent freezes at the clients. This framework is based on OpenFlow, a widely adopted protocol to implement the software-defined networking principle. The main element of the controller is a Machine Learning (ML) engine based on the random undersampling boosting algorithm and fuzzy logic, which can detect when a client is close to a freeze and drive the network prioritization to avoid it. This decision is based on measurements collected from the network nodes only, without any knowledge on the streamed videos or on the clients' characteristics. In this paper, we detail the design of the proposed ML-based framework and compare its performance with other benchmarking HAS solutions, under various video streaming scenarios. Particularly, we show through extensive experimentation that the proposed approach can reduce video freezes and freeze time with about 65% and 45% respectively, when compared to benchmarking algorithms. These results represent a major improvement for the QoE of the users watching multimedia content online. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> The ever expanding the usage of cloud computing environments, connected applications and Internet of Things-based devices have progressively increased the amount of data that travels through our networks. Software-defined network (SDN) is an emergent paradigm that aims to support next-generation networks through its flexible and powerful management mechanisms. One of the biggest threats faced by these services nowadays is security management. Attacks based on the denial of service (DoS) are particularly efficient against this paradigm due to its centralized control characteristic. Once this controlling system receives a massive amount of malicious requests, the overall performance of the network operation is impaired. Although several researches propose to address this problem, most of them are reactive approaches, detecting the attacks and warning the network administrators, i.e., after the network is already compromised. This paper presents an autonomic DoS/DDoS defensive approach for SDNs called Game Theory (GT)-Holt-Winters for Digital Signature (HWDS), which unites the anomaly detection and identification provided by an HWDS system with an autonomous decision-making model based on GT. Real collected data and simulated attacks are used by the system to measure its effectiveness and efficiency. Furthermore, we also use a heuristic Fuzzy-GADS method for anomaly detection instead of HWDS, aiming to compare the achieved performance and evaluate the behavior of the presented game theoretical approaches a standalone mitigation module. <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> As an inevitable trend of future 5G networks, Software Defined architecture has many advantages in providing central- ized control and flexible resource management. But it is also confronted with various security challenges and potential threats with emerging services and technologies. As the focus of network security, Intrusion Detection Systems (IDS) are usually deployed separately without collaboration. They are also unable to detect novel attacks with limited intelligent abilities, which are hard to meet the needs of software defined 5G. In this paper, we propose an intelligent intrusion system taking the advances of software defined technology and artificial intelligence based on Software Defined 5G architecture. It flexibly combines security function mod- ules which are adaptively invoked under centralized management and control with a globle view. It can also deal with unknown intrusions by using machine learning algorithms. Evaluation results prove that the intelligent intrusion detection system achieves a better performance. <s> BIB004 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> Information and Communication Technology is always walking in the forefront of human education. Now, it is the stage where human education has to adapt itself to the developing technologies. In 2016, the Natural Science Foundation suggested that people need to use the human-technology to improve and extend the human learning. This paper provides the concept of Software Defined Class (SDC), where the innovative sensing, communication and computing technologies are integrated with the interactive modes between the teacher and the students. Specifically, this paper proposes an intelligent video management system based on Mobile Edge Computing and face recognition for the flipped classroom. The video database of every student can be used for real-time assessment, sharing assessment and the capability certification for the school and the third organization. The obtained results demonstrate the enhancement and expansion of learning efficiency and management efficiency. <s> BIB005 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> Nowadays many companies and organizations choose to deploy their applications in data centers to leverage resource sharing. The increase in tasks of multiple applications, however, makes it challenging for a data center provider to maximize its revenue by intelligently scheduling tasks in software-defined networking (SDN)-enabled data centers. Existing SDN controllers only reduce network latency while ignoring virtual machine (VM) latency, thus may lead to revenue loss. In the context of SDN-enabled data centers, this paper presents a workload-aware revenue maximization (WARM) approach to maximize the revenue from a data center provider's perspective. The core idea is to jointly consider the optimal combination of VMs and routing paths for tasks of each application. Comparing with state-of-the-art methods, the experimental results show that WARM yields the best schedules that not only increase the revenue but also reduce the round-trip time of tasks of all applications. <s> BIB006 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> In recent years, the demand for application-specific qualify of service (QoS) management has grown. To effectively do application-specific QoS, a system albe to do flow classification at the application level is required. This paper presents an application identification system that can be integrated with a QoS management system in a software defined network (SDN). This paper describes the method to obtain ground truth (label) of the flow from four mainstream operating systems (OS), and the method to classify flow based on supervised machine learning and DNS responses. In our experiment, average F-measure of all applications reached 93.48%. The testing data set contained 294 applications, given that each platform version or execution file of an application was one application. The testing data set included Skype, Facebook, and other popular applications. Results showed that this system can identify application traffic on different platforms with high accuracy. <s> BIB007 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> In this paper, we consider resource allocation in data networks and evaluate the performance of various approaches using the Cross-Stratum Optimization architecture for a providercentric use case. We describe many approaches used to provision various requests related to a data center operations. We consider three simple approaches and compare them with two additional ones: the hybrid method that simultaneously considers cost, distance, and utilization; and traffic prediction methods based on Monte Carlo Tree Search that employs machine learning techniques. In evaluations, we rely on data center models and pricing structure provided by Amazon Web Services. Results indicate that using approaches that jointly optimize two strata improve network performance. Finally, the use of machine learning techniques enables network and data center operators to more efficiently utilize resources. <s> BIB008 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> Software-defined networking (SDN) is the key outcome of extensive research efforts over the past few decades toward transforming the Internet to a more programmable, configurable, and manageable infrastructure. At the same time, SDN will surely become a new target of cyber attackers. In this paper, we point out one of the critical vulnerabilities in SDNs, the capacity of controller, which is most likely to be attacked. Due to the logical centralized management, the breakdown of a controller may disrupt a whole SDN network, which can be easily occurred by Packet-In messages flooding attack (a network-level DDoS attack). To provide a robust environment in SDN, we propose an effective detection method, which has low overhead and high accuracy. We first classify the potential switches that are compromised using Bayesian Network, which is a supervised learning algorithm. Then, we deploy the anomaly detection on the vulnerable switches to detect the Packet-In messages flooding attack based on fuzzy c-means. Extensive simulations and testbed-based experiments show that the proposed solution can defeat the Packet-In messages flooding attack with low overhead and high accuracy. <s> BIB009 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other AI-based Approaches in SDN <s> The characteristic features of cloud computing deployment make it highly vulnerable to distributed denial of service (DDoS) attacks. The recent advancement in software-defined networking (SDN) enhances the possibilities for defeating DDoS attacks in cloud computing environments. This option to improve the probability of defeating DDoS attacks is made feasible through the striking features of SDN that include their capability for software-oriented traffic investigation, network global dimension, dynamically updating forwarding rules and centralized point of control. This paper presents a Fuzzy self organizing maps-based DDOS mitigation (FSOMDM) technique that is ideally and suitably designed for improving the SDN capabilities of cloud computing. FSOMDM is the enhanced neural network model that effectively replaces the neurons of the traditional Kohonen neural network model through updating fuzzy rules. The property of software-oriented traffic investigation is utilized in this process and the fuzzy rule is used for exploring the dimension of input space from which a single valued output is derived for enabling the mitigation of DDoS. In addition, FSOMDM incorporates an attack-response process that possesses the significance of dropping attack flows through its enforcement in the control plane of SDN. The performance investigation of FSOMDM confirms its significance by facilitating nearly 94% of classifier accuracy evaluated in terms of true positive rate (TPR). <s> BIB010
Other researchers proposed many hybrid models that make use of two or more intelligent approach to enhance the overall performance and accuracy of these algorithms. Petrangeli et al. BIB002 investigated preventing video freezes in HTTP adaptive streaming based on combination of random under-sampling boosting (RUSBoost) algorithm and fuzzy logic approach. The Experimental results showed that the proposed system was able to reduce video freezes with 65% and freeze time with 45%, when compared with fair in-network enhanced adaptive streaming (FINEAS) and Microsoft ISS smooth streaming (MSS). De Assis et al. BIB003 proposed a method for mitigating DoS/DDoS attacks based on a game theatrical approach that employs Holt-Winters and genetic algorithm with fuzzy logic. Holt-Winters for digital signature (HWDS) approach was used for detecting and identifying anomalies and game theory decision-making (GTDM) approach was used for choosing the optimal defense strategy. HWDS was compared with fuzzy genetic algorithm digital signature (Fuzzy-GADS) approach where HWDS fared better in performance tests. Fuzzy-GADS, on the other hand, found to be more efficient on detecting the occurrence of stealthier anomalies. Li et al. BIB004 introduced an intelligent hybrid intrusion detection system for SDN-based 5G network where random forest approach was used for feature selection and k-means++ with Adaboost approach was used for flow classification. The algorithm was able to achieved a good precision (94.48%), recall (92.62%) and f1-score (91.02%) with a low false positive rate (0.54%) based on 23 selected features from KDD99 dataset. Da Silva et al. BIB001 proposed an anomaly detection and classification method based on a two-phases approach: 1) lightweight phase based on entropy analysis and 2) heavyweight approach based on a hybrid ML approach, which employs k-means and SVM. Similar flows were clustered together where each cluster represents a particular traffic profile then the SVM algorithm is used to classify the flows in each cluster. The SVM showed an accuracy of 88.7% and a precision of 82.3%. Sabih et al.  studied optimizing the performance of SDN based on hybrid intelligence approach, which makes use of a neural network model. GA and PSO algorithms were used separately to select the optimal set of inputs that maximizes the network efficiency. The experimental results showed that PSO achieves a better performance and a faster convergence in compared with GA. Li et al. BIB005 presented an intelligent SDNbased video management system, which uses face detection and recognition techniques based on EigenFace algorithm principal component analysis (PCA), FisherFace algorithm based on linear discriminant analysis (LDA), and local binary patterns (LBP). Yuan e al. BIB006 investigated revenue maximization in data centers based on workload-aware SDN controller, which determines the optimal combination of a VM and routing path for each application. The proposed system uses a hybrid approach named hybrid chaotic simulated-annealing PSO (HCSP) that combines chaotic PSO and SA algorithm. Compared with OSPF and Round Robin approaches, the proposed approach was successful in reducing the RTT and increasing the revenue. Huang et al. BIB007 proposed a method for application identification based on DNS responses inspection and ML. A classification system, which adopts a voting strategy, was implemented by Weak Java API, from which three algorithms were used namely: random forest, rotation forest and random committee with random tree. The experimental results showed that the combination of DNS responses inspection and ML techniques was able to achieve higher accuracy compared to standalone ML techniques. Pillutla and Arjunan BIB010 introduced, FSOMDM, a fuzzy self organizing maps-based DDoS mitigation approach for cloud-based SDNs. FSOMDM, enhances the neural network approach by replacing the neurons of the traditional Kohonen neural network model by updating fuzzy rules. The experimental results showed that FSOMDM achieved a true positive rate (TPR) of 94%. Aibin et al. BIB008 employed Monte Carlo Tree Search (MCTS) for advanced traffic predication for bandwidth-ondemand services and provisioning of dynamic lightpaths based on Cross-Stratum Optimization architecture. MCTS builds a sparse search tree and chooses actions using Monte Carlo sampling approach. They compared the performance of the different approaches for selecting a data center that can be used for providing services to a request. These approaches are: the nearest, the cheapest, the least utilized data center (DC), hybrid assignment (combining the three simple approaches) and traffic predication approaches based on MCTS. In the experimental studies they considered data center models and pricing structure provided by Amazon Web Services. The hybrid assignment and traffic prediction were the two best approaches among the others. The traffic prediction approach resulted in low request blocking percentage and more efficient utilization network resources. Hybrid approach was slightly lower than the cost of using the MCTS approach. However, it showed a higher request blocking percentage in case of high traffic loads. Gao et al. BIB009 presented a hybrid approach that combines supervised and unsupervised approaches for defending against Packet-In based flooding attacks. Their proposed approach consisted of two stages. In the first stage, Bayesian Network, which is a supervised learning algorithm, is used for classifying the potential compromised switches. In the next stage, they make use of fuzzy c-means approach to determine whether the packet-In messages flooding attack happened or not. They conducted their experimental study based on Mininet where they used Distributed Internet Traffic Generator (DITG) to generate the legitimate traffic and DARPA intrusion detection data sets were used as the malicious traffic. Based on the receiver operating characteristic (ROC) curves, we can observe that the system can achieve a good accuracy, however it is combined with relatively high false alarm rate. For instance, when the detection rate is 95.68%, the false positive rate reaches 10%. The system however achieves a low overhead, as it only needs to monitor the vulnerable switches rather than all the available switches.