Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> With the rapid growth of the Internet-of-Things (IoT), concerns about the security of IoT devices have become prominent. Several vendors are producing IP-connected devices for home and small office networks that often suffer from flawed security designs and implementations. They also tend to lack mechanisms for firmware updates or patches that can help eliminate security vulnerabilities. Securing networks where the presence of such vulnerable devices is given, requires a brownfield approach: applying necessary protection measures within the network so that potentially vulnerable devices can coexist without endangering the security of other devices in the same network. In this paper, we present IoT Sentinel, a system capable of automatically identifying the types of devices being connected to an IoT network and enabling enforcement of rules for constraining the communications of vulnerable devices so as to minimize damage resulting from their compromise. We show that IoT Sentinel is effective in identifying device types and has minimal performance overhead. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> Software Defined Networks (SDNs) provides a separation between the control plane and the forwarding plane of networks. The software implementation of the control plane and the built in data collection mechanisms of the OpenFlow protocol promise to be excellent tools to implement Machine Learning (ML) network control applications. A first step in that direction is to understand the type of data that can be collected in SDNs and how information can be learned from that data. In this work we describe a simple architecture deployed in an enterprise network that gathers traffic data using the OpenFlow protocol. We present the data-sets that can be obtained and show how several ML techniques can be applied to it for traffic classification. The results indicate that high accuracy classification can be obtained with the data-sets using supervised learning. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> We estimate end-to-end service metrics from network device statistics. Our approach is based upon statistical, supervised learning, whereby the mapping from device-level to service-level metrics is learned from observations, i.e., through monitoring the system. The approach enables end-to-end performance prediction without requiring an explicit model of the system, which is different from traditional engineering techniques that use stochastic modeling and simulation. The fact that end-to-end service metrics can be estimated from local network statistics with good accuracy in the scenarios we consider suggests that service-level properties are “encoded” in network-level statistics. We show that the set of network statistics needed for estimation can be reduced to a set of measurements along the network path between client and service backend, with little loss in estimation accuracy. The reported work is largely experimental and its results have been obtained through testbed measurements from a video streaming service and a KV store over an OpenFlow network . <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> Software-defined networks (SDN) are vulnerable to most of the attacks that traditional networks are vulnerable to. In addition, SDN has introduced new vulnerabilities through its unique architecture such as those related to the southbound and northbound controller interfaces. In this paper, we introduce a lightweight flow-based Intrusion Detection System (IDS) that periodically gathers statistical information about flows from SDN OpenFlow switches, and analyzes traffic information by extracting and aggregating a set of features. The proposed IDS system proved to be accurate with a high detection rate at 0.98 measured by the F1 score of the classification model and a relatively low false alarm rate. <s> BIB004 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> Our work in this paper presents a prediction of quality of experience based on full reference parametric (SSIM, VQM) and application metrics (resolution, bit rate, frame rate) in SDN networks. First, we used DCR (Degradation Category Rating) as subjective method to build the training model and validation, this method is based on not only the quality of received video but also the original video but all subjective methods are too expensive, don't take place in real time and takes much time for example our method takes three hours to determine the average MOS (Mean Opinion Score). That's why we proposed novel method based on machine learning algorithms to obtain the quality of experience in an objective manner. Previous researches in this field help us to use four algorithms: Decision Tree (DT), Neural Network, K nearest neighbors KNN and Random Forest RF thanks to their efficiency. We have used two metrics recommended by VQEG group to assess the best algorithm: Pearson correlation coefficient r and Root-Mean-Square-Error RMSE. The last part of the paper describes environment based on: Weka to analyze ML algorithms, MSU tool to calculate SSIM and VQM and Mininet for the SDN simulation. <s> BIB005 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> Software-Defined Networking (SDN) is an emerging network architecture that decouples the control plane and the data plane to provide unprecedented programmability, automation, and network control. The SDN controller exercises centralized control over network software, and in doing so, it can monitor and respond to malicious traffic for network protection. This paper proposes a threat-aware system based on machine-learning for timely detection and response against network intrusion in SDN. Our proposed system consists of data preprocessing for feature selection, predictive data modeling for machine-learning and anomaly detection, and decision making for intrusion response in SDN. Due to the time-critical nature of SDN, we propose a practical approach utilizing machine-learning techniques to protect against network intrusion and reduce uncertainty in decision-making outcomes. The maliciousness of most uncertain network traffic subsets is evaluated with selected significant feature sets. Our experimental results show that the proposed approach achieves high performance and significantly reduces uncertainty in the decision process with a small number of feature sets. The results help the SDN controller to properly react against known or unknown attacks that cannot be prevented by signature-based network intrusion detection systems. <s> BIB006 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> Abstract While traditional networks depend on a fully distributed control plane, Software Defined Networks (SDNs), the rapidly emerging area in computer networking, utilize a centralized control plane. SDNs bring in many benefits such as fine-grained control, possibility of optimal routing, and resource management within the network. As a result, SDNs find wider deployments in certain segments of networking such as data center networks. In addition, SDN approach is a potential candidate for the control plane design in 5G networks. Despite the benefits, SDNs face certain issues such as the possibility of single point failure, the communication overhead between switches and controllers, and more importantly the security as well as trustability of the control plane. Due to the centralized nature of the control plane, it is important to detect the presence of compromised control plane in an SDN. Compromised control plane refers to the situation where one or more of the controllers in an SDN are compromised by malwares, resulting in deviation from the normal control plane behavior. Developing new solutions for detecting the presence of compromised controllers is exacerbated by the lack of appropriate SDN traffic data sets. As a result, existing literature lacks solutions to detect the presence of a compromised control plane. Of particular interest is the case where SDN controller-specific threats hide their presence from end-users and administrators of the network. Our contributions in this paper include the following: (i) identification of five threat vectors that represent compromised controllers in SDNs, (ii) creation of a large volume of OpenFlow traffic traces in order for studying various SDN threat vectors, (iii) proposal of nine novel OpenFlow-specific features that capture the above mentioned threat vectors, and (iv) study of machine-learning based detection technique for compromised control plane using six classifiers. The OpenFlow traffic trace data set, we created, is made available for the use of larger research community. We carried out detailed experimental studies that show the efficacy of our scheme in detecting the presence of compromised controllers. Our results indicate that Random Forest is the most suitable machine learning classifier that provides about 97% accuracy. <s> BIB007 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> Security is one of the main concerns facing the development of new projects in networking and communications. Another challenge is to verify that a system is working exactly as specified. On the other hand, advances in Artificial Intelligence (AI) technology have opened up new markets and opportunities for progress in critical areas such as network resiliency, health, education, energy, economic inclusion, social welfare, and the environment. AI is expected to play an increasing role in defensive and offensive measures to provide a rapid response to react to the landscape of evolving threats. Software Defined Networking (SDN), being centralized by nature, provides a global view of the network. It is the flexibility and robustness offered by programmable networking that lead us to consider the integration of these two concepts, SDN and AI. Inspired by the fascinating tactics of the human immunity system, we aim to design a general hybrid Artificial Intelligence Resiliency System (ARS) that strikes a good balance between centralized and distributed security systems that may be applicable to different network environments. In addition, we aim to investigate and leverage the latest AI techniques to improve network performance in general and resiliency in particular. <s> BIB008 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> Software Defined Network separates the control plane from network equipment and has great advantage in network management as compared with traditional approaches. With this paradigm, the security issues persist to exist and could become even worse because of the flexibility on handling the packets. In this paper we propose an effective framework by integrating SDN and machine learning to detect and categorize P2P network traffics. This work provides experimental evidence showing that our approach can automatically analyze network traffic and flexibly change flow entries in OpenFlow switches through the SDN controller. This can effectively help the network administrators manage related security problems. <s> BIB009 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> The marriage of cloud and software defined network (SDN) can work out the challenge which exist in the typical cloud platform such as the private cloud isolation of user, network flow control. But in SDN based cloud, the SDN controller which manages the whole system is vulnerable to distributed-denial-of-service (DDoS) attack, causing paralysis of the entire network. It is critical for SDN controller to be quick-speed, low false positive, and high precise against attack detection. In this paper, we use the extreme gradient boosting (XGBoost), as detection method in SDN based cloud. In addition, we use the POX as SDN controller, build SDN topology using Mininet and simulate real DDoS attack environment by attack tool Hyenae. The XGBoost classifier uses the flow packet data set collected by TcpDump for DDoS detection and compares it with other classifiers. The detection results validate that our method performs higher accuracy, lower false positive rate, fast-speed and has scalability. <s> BIB010 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Ensemble methods in SDN <s> We describe two applications of machine learning in the context of IP/Optical networks. The first one allows agile management of resources at a core IP/Optical network by using machine learning for short-term and long-term prediction of traffic flows and joint global optimization of IP and optical layers using colorless/directionless (CD) flexible ROADMs. Multilayer coordination allows for significant cost savings, flexible new services to meet dynamic capacity needs, and improved robustness by being able to proactively adapt to new traffic patterns and network conditions. The second application is important as we migrate our metro networks to Open ROADM networks, to allow physical routing without the need for detailed knowledge of optical parameters. We discuss a proof-of-concept study, where detailed performance data for wavelengths on a current flexible ROADM network is used for machine learning to predict the optical performance of each wavelength. Both applications can be efficiently implemented by using a SDN (Software Defined Network) controller. <s> BIB011
The random forest (RF) approach was widely used for estimating service-level metrics BIB003 , intrusion detection, security applications BIB001  BIB004 BIB007 BIB008 BIB009 BIB010 , QoE prediction BIB005 , traffic classification BIB002 and prediction of traffic matrix and performance of optical path BIB011 . Stadler et al. BIB003 proposed a RF approach for estimating service-level metrics based on network-level statistics. Song et al. BIB006 presented an intrusion detection system where the RF approach has been used for both feature selection and classification. Miettinen et al. BIB001 introduced, IoT SENTINEL, an SDN-based system for automatic identification and security enforcement of potentially vulnerable IoT devices using device type-specific profiling approach. They used SDN for isolation and traffic filtering where the system can control the traffic flows of vulnerable devices to protect the other devices in the network from any potential threats. The device identification was achieved by fixed length fingerprints, where RF approach was used as a classification algorithm. Abar et al. BIB005 proposed a ML based QoE prediction approach in SDN paradigm. The authors utilized the following ML algorithms: RF, k-nearest neighbours (k-NN), NN and decision trees where RF showed better performance. Amaral et al. BIB002 used several ML techniques such as RF, stochastic gradient boosting and extreme gradient boosting for traffic classification task. RF approach showed competitive results in compared with the other two algorithms in terms of the classifier accuracy. Zago et al.  proposed an RF approach for for cyber threat detection. RF approach showed the best performance among k-NN, naive bayes and logistic regression (LR) for cyber threat detection. Ajaeiya et al. BIB004 proposed a machine learning SDN-based approach for analysing, detecting and reacting against cyber threats. Experimental resulted based on ISOT botnet dataset showed that RF approach achieves the best results in terms of F1-score among k-NN, naive bayes, baggedtrees and logistic regression. Anand et al. BIB007 introduced a method detecting compromised controllers in SDNs. The authors identified five threat models for representing the compromised controllers. They used 9 OpenFlow-specific features in order to correctly and accurately build their ML model. The RF approach showed the highest accuracy (97%) compared to Naive Bayes, SVM, NN, AdaBoost and DT. The proposed approach, however, was not Choudhury et al. BIB011 RF and Gradient boosted regression trees. Prediction of traffic matrix and performance of optical path. Outperformed rigde regression, LASSO regression, LASSO with quadratic features, MLP, Guassian process regression, gradiant boosted regression trees. able to exactly identify and locate the compromised controller when multiple physical controllers are included. Hussein et al. BIB008 designed two architectures for building a general solution to defend and enhance the security of communication networks. The first architecture is distributed extraction, centralized processing, and centralized management. The second one is distributed extraction, distributed processing and centralized management. Then the authors introduced a two-stage detection technique. The first stage includes detecting whether an attack happened or not, whereas the second stage includes identifying the type of attack. The experimental results conducted on the NSL-KDD dataset showed that the RF approach achieves better results when compared with the other techniques including SVM, kNN, DT, neural networks and deep learning. Su et al. BIB009 presented an intelligent approach to detect P2P Botnets. The detection model consisted of two sub-modules namely: primary classification module and secondary classification module. The primary classification module included one binary classifier for each application or Botnet. Whereas the secondary classification module employed a multi-class classification, which is used when more than one binary classifier matches in the primary classification module. The authors tested the performance of k-NN and SVM for the primary classification module. Whereas RF was used for the secondary classification module. Both of these stage were evaluated by 10-fold cross validation. In addition, they collected network traffic samples generated by different P2P Botnets and normal P2P applications. They used traffic trace files of Storm and Zeus Botnet as malicious training samples of P2P Botnets. Whereas network traffic trace files of eMule, uTorrent, and Skype, were used for as benign training samples of P2P applications. The following features were also selected: packet count, packet size, flow size, inter-arrival times (min,max, mean, and standard deviation), TCP Push flag count, duration, total bytes, TCP Urgent flag count. The experimental results showed that SVM achieved better results compared to kNN. However, the authors used kNN for the primary classification, because the training time of SVM is much longer compared to kNN. In addition, RF was able to achieve an average accuracy of 99.77% for the second stage. Chen et al. BIB010 used XGBoost classifier for DDoS attack detection in SDN-based cloud. XGBoost is an enhanced version of the traditional Gradient Boosting Decision Tree (GBDT) and provides a more flexible approach for preventing fitting and increasing the generalization ability of the model. KDD Cup 99 dataset was used for training the model based on 9 important features, which have the maximum information gain and chi-square statistic. They used Mininet to simulate real DDoS attacks by an attack tool called Hyenae. XGBOS showed an accuracy of 98.53%. Whereas RF, GBDT and SVM showed an accuracy of 96.33%, 97.69% and 97.19% respectively. In addition, the false positive rate of XGBoost was 0.008 whereas RF, GBDT and SVM showed a the false positive rate of 0.018%, 0.013% and 0.011% respectively. In terms of training time, however, the best results achieved by RF and the worst results achieved by SVM. Choudhury et al. BIB011 introduced two applications of ML approaches for managing IP and optical networks. The first one was prediction of network traffic matrix, which allows proactive network updates for providing more flexible services. The second one is prediction of optical path performance in multivendor network based on the latest optical performance data. For the first task, they employed Gaussian process regression (GPR). For the second task they employed machine learning methods that broadly fall into three categories: penalized linear regressions, non-linear regressions and ensembles of regression trees. Among ensemble models, they applied gradient boosted regression trees and random forests. RF achieved the best overall error rates. Research efforts made to apply conventional ML approaches in SDN are briefly summarized in Table 2 .