Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other unsupervised ML approaches in SDN <s> Traffic anomaly detection has been a principal direction in the network security field, which aims to identify attacks based on significant deviations from the established normal usage profiles. Recently, a new networking paradigm, software defined networking (SDN), has emerged to facilitate effective network control and management. In this paper, we present the advantages of leveraging SDN to detect traffic anomaly, and review recent progresses in this direction. Despite their effectiveness for traditional traffic, SDN-based traffic anomaly detection methods have to face the challenge of continuously increasing network traffic. To this end, we propose two refined algorithms to be used in an anomaly detection framework which can handle voluminous data, and report some experimental results to demonstrate their performance. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Other unsupervised ML approaches in SDN <s> Securing Internet of Things is a challenge because of its multiple points of vulnerability. In particular, Distributed Denial of Service (DDoS) attacks on IoT devices pose a major security challenge to be addressed. In this paper, we propose a DNS query-based DDoS attack mitigation system using Software-Defined Networking (SDN) to block the network traffic for DDoS attacks. With some features provided by SDN, we can analyze traffic patterns and filter suspicious network flows out. To show the feasibility of the proposed system, we particularly implemented a prototype with Dirichlet process mixture model to distinguish benign traffic from malicious traffic and conducted experiments with the dataset collected from real network traces. We demonstrate the effectiveness of the proposed method by both simulations and experiment data obtained from the real network traffic traces. <s> BIB002
Other unsupervised ML methods were used in the SDN paradigm for intrusion detection task. In this context, He et al. BIB001 introduced an anomaly detection and mitigation method based on a two-stage unsupervised learning approach for feature selection and clustering. For the first stage, they used Maximal Information Coefficient (MIC) to calculate the relation information between two continuous features and they calculate the relevancy, a symmetric uncertainty estimator, for discrete features. In the second stage, they applied a density peak clustering algorithm on the sampled data points. In the case of a hierarchy of SDN controllers is employed, then this approach can be used to reduce the volume of traffic shuffled across the network by locally analysing the traffic data in each controller. Ahmed et al. BIB002 proposed a method for mitigating domain name system (DNS) query-based DDoS attacks based on Dirichlet process mixture model for clustering traffic flows. The proposed system achieved better results over mean shift (MS) clustering approach.