Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Self-Organizing Maps (SOM) in SDN <s> Distributed denial-of-service (DDoS) attacks became one of the main Internet security problems over the last decade, threatening public web servers in particular. Although the DDoS mechanism is widely understood, its detection is a very hard task because of the similarities between normal traffic and useless packets, sent by compromised hosts to their victims. This work presents a lightweight method for DDoS attack detection based on traffic flow features, in which the extraction of such information is made with a very low overhead compared to traditional approaches. This is possible due to the use of the NOX platform which provides a programmatic interface to facilitate the handling of switch information. Other major contributions include the high rate of detection and very low rate of false alarms obtained by flow analysis using Self Organizing Maps. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Self-Organizing Maps (SOM) in SDN <s> We propose a concept of using Software Defined Network (SDN) technology and machine learning algorithms for monitoring and detection of malicious activities in the SDN data plane. The statistics and features of network traffic are generated by the native mechanisms of SDN technology. In order to conduct tests and a verification of the concept, it was necessary to obtain a set of network workload test data. We present virtual environment which enables generation of the SDN network traffic. The article examines the efficiency of selected machine learning methods: Self Organizing Maps and Learning Vector Quantization and their enhanced versions. The results are compared with other SDN-based IDS. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Self-Organizing Maps (SOM) in SDN <s> Software Defined Networking (SDN) is a revolutionary networking paradigm towards the future network, experiencing rapid development nowadays. However, its main characteristic, the separation of control plane and data plane, also brings about new security challenges, i.e., Denial-of-Service (DoS) attacks specific to OpenFlow SDN networks to exhaust the control plane bandwidth and overload the buffer memory of OpenFlow switch. To mitigate the DoS attacks in the OpenFlow networks, we design and implement SGuard, a security application on top of the NOX controller that mainly contains two modules: Access control module and Classification module. We employ novel six-tuple as feature vector to classify traffic flows, meanwhile optimizing classification by feature ranking and selecting algorithms. All the modules will cooperate with each other to complete a series of tasks such as authorization, classification and so on. At the end of this paper, we experimentally use Mininet to evaluate SGuard in a software environment. The results show that SGuard works efficiently and accurately without adding more overhead to the SDN networks. <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Self-Organizing Maps (SOM) in SDN <s> Abstract Software-Defined Networking (SDN) is a new programmable networking model that features the detachment of control and data planes. In this network, the network brain is an SDN controller that is used to centrally monitor and control the data plane based on the OpenFlow protocol and applications located in the application layer. In recent years, a vast number of issues relating to security have been seriously debated for this networking paradigm, especially the large-scale model. In particular, flooding attacks have been on the rise, providing great challenges for the SDN architecture to cope with. In this paper, we present a novel mechanism using the Self-Organizing Map (SOM) application to solve the performance bottleneck and overload problems for the upper layers in a large-sized SDN in case of flooding attacks. Our proposed approach integrates a Distributed Self-Organizing Map (DSOM) system to OpenFlow Switches instead of using a standalone SOM. By exploiting SDN advantages, such as flexibility and overhead reduction, we implement and test both a DSOM system and a single SOM system on multi-criteria to compare the performance of our introduced system. Our experimental results show that the DSOM solution can effectively detect abnormal traffic, solve bottleneck problems and increase the system reaction speed to attack traffic, while presenting a smaller overhead to the network system. <s> BIB004 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Self-Organizing Maps (SOM) in SDN <s> Distributed Denial of Service (DDoS) attack is one of the most long-lasting problems in network security. Recently, although the DDoS attack mechanisms are widely understood, the problems are becoming more frequent due to the similarity between DDoS attack and normal traffic. In this work, we propose two approaches of DDoS attack detection which are based on the Self-Organizing Map (SOM). The proposed algorithms with their detection architecture are implemented in the Software-Defined Networking (SDN) technology which has the flexibility and programmable abilities. The SDN controller allows us to quickly perform complex classification and detection algorithm. By deploying a testbed environment, we successfully evaluate our proposed algorithms in terms of both accuracy and computational overhead. The experimental results show that these algorithms can reduce the processing time while maintain the suitable accuracy rate. <s> BIB005
Self-organizing map (SOM) approach was used widely in the SDN paradigm for intrusion detection  BIB003 BIB004 BIB001 BIB002 BIB005 . Jankowski and Amanowicz  presented an intrusion detection based on SOM approach. Kohonen algorithm was used for training the SOM where the neuron whose weights are most similar to the input vector and its neighbours will update their weights. The classification step includes determining which neuron is activated under that particular input. The main disadvantage in this approach is high-grained traffic matching in flow tables. Wang and Chen BIB003 proposed, SGuard, a lightweight DoS attacks detecting and mitigating framework based on a combination of access control and SOM classification. They collected 6 traffic features: percentage of flows with a small number of packets, percentage of flows with small average bytes, percentage of flows with short time duration, percentage of reversible flows, growth rate of irreversible flows and growth rate of ports. Then, they proposed two novel feature ranking and feature selecting algorithms, which allowed the SOM to achieved high detection rate with less number of features. In addition, their proposed framework can deal with IP/MAC spoofing attacks. Phan et al. BIB004 proposed, DSOM , a distributed SOM approach for tackling the performance bottleneck and overload problems for large-sized SDNs under flooding attacks. They developed an application, called DSOMController, that manages the operation of DSOM. At each switch, DSOM was trained using a dataset obtained from the DSOMController. The DSOM Controller collects the results, which are SOM maps, from OpenFlow switches to construct a final merged SOM map. DSOM used the following 6 traffic features: number of flows, number of packet per flow, number of bytes per flow, duration, growth of client ports, protocol type. They used k-means clustering algorithm to make the final decision in DSOM. The lowest rate of accuracy was around 96.5% when they used 400 neurons. Where it was increased above 97% when they used 900 and 1600 neurons. The false alarm rate also decrease with the increased number of neurons. In addition, the experimental results showed that the DSOM outperforms the single SOM in terms of the system overhead. Braga et al. BIB001 introduced a lightweight DDoS flooding attack detection method based on SOM approach. They used 6 features namely: average of packets per flow, average of bytes per flow, average of duration per flow, percentage of pairflows, growth of single-flows, growth of different ports. Their method showed high detection rate with low false positive rate. Jankowski and Amanowicz BIB002 , on the other hand, compared different ML approaches for intrusion detection task in SDN paradigm. The experimental study showed that hierarchical learning vector quantization (Hierarchical-LVQ1) is more efficient than other approaches such as SOM and LVQ1. Nam et al. BIB005 used SOM for detecting DDoS attacks in SDNs. They used the following 5 features for the classification task: entropy of source IP address, entropy of source port, entropy of destination port, entropy of packet protocol, total number of packets. First, SOM was used for dimensionality reduction. Then, they proposed two classification techniques. The first one is based on an algorithm that combines SOM and k-NN. The second one is based on SOM with center-distributed classification, where in this case SOM is trained only on normal traffic samples. Then, the algorithm calculates the distance between each input sample to a universal reference point where the trained data is within a hyper-sphere, centred around that reference point with a predefined threshold. If the distance is less than that particular threshold, then it will be flagged as normal otherwise it will be flagged as anomalous. The traditional kNN achieved the highest accuracy but it showed high processing time. The first algorithm that combines SOM and kNN outperformed the second one (SOM distributed-center) in terms of detection rate and false positive rate. However, it showed a higher processing time in compared with the second one. SOM distributed-center showed a good detection rate with the lowest processing time however it has very high false positive rate.