Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> Distributed denial-of-service (DDoS) attacks became one of the main Internet security problems over the last decade, threatening public web servers in particular. Although the DDoS mechanism is widely understood, its detection is a very hard task because of the similarities between normal traffic and useless packets, sent by compromised hosts to their victims. This work presents a lightweight method for DDoS attack detection based on traffic flow features, in which the extraction of such information is made with a very low overhead compared to traditional approaches. This is possible due to the use of the NOX platform which provides a programmatic interface to facilitate the handling of switch information. Other major contributions include the high rate of detection and very low rate of false alarms obtained by flow analysis using Self Organizing Maps. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> The recently emerging paradigm of software defined networking (SDN) predominantly employs the control-data plane OpenFlow protocol, offering centralized real-time programmability and monitoring of network devices. Effective SDN based traffic engineering using OpenFlow, particularly in campus networking however, requires sophisticated real-time user traffic visualization solution having minimum management overhead. To address the intuitive monitoring gaps in existing campus based SDN, the present paper proposes profiling campus user traffic to visualize real-time network workload and accurately provision resources. The design solely utilizes existing OpenFlow traffic measurements, subjected to k-means clustering to segregate users into different traffic classes (profiles) based on their application trends. To validate design feasibility, the present study derived six unique user traffic profiles from OpenFlow generated traffic statistics of a realistic campus switch over a two-week time frame. The derived profiles represented significant discrimination among user application trends and were further benchmarked for high stability (96.1–99.1%), to ascertain their viability for monitoring purposes. Additional simulation tests at varying user loads attributed minimum computational cost and low OpenFlow control overhead (4.02–4.96%) to the proposed approach, offering high scalability for real-time network monitoring and resource provisioning. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> Software Defined Network (SDN) architecture is a new and novel way of network management. In SDN, switches do not process the incoming packets. They match for the incoming packets in the forwarding tables and if there is none it will be sent to the controller for processing which is the operating system of the SDN. A Distributed Denial of Service (DDoS) attack is a biggest threat to cyber security in SDN network. The attack will occur at the network layer or the application layer of the compromised systems that are connected to the network. In this paper we discuss the DDoS attacks from the traces of the traffic flow. We use different machine learning algorithms such as Naive Bayes, K-Nearest neighbour, K-means and K-medoids to classify the traffic as normal and abnormal. Then these algorithms are measured using parameters such as detection rate and efficiency. The algorithm having more accuracy is chosen to implement Signature IDS and results of it are then processed by Advanced IDS which detects anomalous behaviour based on open connections and provides accurate results of the hosts specifying which hosts is involved in the DDOS attack. <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> We propose a concept of using Software Defined Network (SDN) technology and machine learning algorithms for monitoring and detection of malicious activities in the SDN data plane. The statistics and features of network traffic are generated by the native mechanisms of SDN technology. In order to conduct tests and a verification of the concept, it was necessary to obtain a set of network workload test data. We present virtual environment which enables generation of the SDN network traffic. The article examines the efficiency of selected machine learning methods: Self Organizing Maps and Learning Vector Quantization and their enhanced versions. The results are compared with other SDN-based IDS. <s> BIB004 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> With the emergence of cloud computing, many attacks, including Distributed Denial-of-Service (DDoS) attacks, have changed their direction towards cloud environment. In particular, DDoS attacks have changed in scale, methods, and targets and become more complex by using advantages provided by cloud computing. Modern cloud computing environments can benefit from moving towards Software-Defined Networking (SDN) technology, which allows network engineers and administrators to respond quickly to the changing business requirements. In this paper, we propose an approach for detecting application-layer DDoS attacks in cloud environment with SDN. The algorithm is applied to statistics extracted from network flows and, therefore, is suitable for detecting attacks that utilize encrypted protocols. The proposed detection approach is comprised of the extraction of normal user behavior patterns and detection of anomalies that significantly deviate from these patterns. The algorithm is evaluated using DDoS detection system prototype. Simulation results show that intermediate application-layer DDoS attacks can be properly detected, while the number of false alarms remains low. <s> BIB005 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> Software Defined Networking (SDN) is a revolutionary networking paradigm towards the future network, experiencing rapid development nowadays. However, its main characteristic, the separation of control plane and data plane, also brings about new security challenges, i.e., Denial-of-Service (DoS) attacks specific to OpenFlow SDN networks to exhaust the control plane bandwidth and overload the buffer memory of OpenFlow switch. To mitigate the DoS attacks in the OpenFlow networks, we design and implement SGuard, a security application on top of the NOX controller that mainly contains two modules: Access control module and Classification module. We employ novel six-tuple as feature vector to classify traffic flows, meanwhile optimizing classification by feature ranking and selecting algorithms. All the modules will cooperate with each other to complete a series of tasks such as authorization, classification and so on. At the end of this paper, we experimentally use Mininet to evaluate SGuard in a software environment. The results show that SGuard works efficiently and accurately without adding more overhead to the SDN networks. <s> BIB006 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> Abstract Software-Defined Networking (SDN) is a new programmable networking model that features the detachment of control and data planes. In this network, the network brain is an SDN controller that is used to centrally monitor and control the data plane based on the OpenFlow protocol and applications located in the application layer. In recent years, a vast number of issues relating to security have been seriously debated for this networking paradigm, especially the large-scale model. In particular, flooding attacks have been on the rise, providing great challenges for the SDN architecture to cope with. In this paper, we present a novel mechanism using the Self-Organizing Map (SOM) application to solve the performance bottleneck and overload problems for the upper layers in a large-sized SDN in case of flooding attacks. Our proposed approach integrates a Distributed Self-Organizing Map (DSOM) system to OpenFlow Switches instead of using a standalone SOM. By exploiting SDN advantages, such as flexibility and overhead reduction, we implement and test both a DSOM system and a single SOM system on multi-criteria to compare the performance of our introduced system. Our experimental results show that the DSOM solution can effectively detect abnormal traffic, solve bottleneck problems and increase the system reaction speed to attack traffic, while presenting a smaller overhead to the network system. <s> BIB007 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> SDN is a new network framework which can be controlled and defined by software programming, and OpenFlow is the communication protocol between SDN controller plane and data plane. With centralized control of SDN, the network is more vulnerable encounter APT than traditional network. After deeply analyzing the process of APT at each stage in SDN, this paper proposes the APT detection method based on HMM, which can fully reflect the relationship between attack behavior and APT stage. Experiment shows that the method is more accurate to detect APT in SDN, and less overhead. <s> BIB008 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> Software Defined Network is an innovative network architecture which provides network control through software logic. It decouples control and data plane to customize the network according to the user needs. OpenFlow, a standardized network protocol acts as an interface between controllers and switches. The softwarized controllers are highly vulnerable for Distributed Denial of Service attacks. The proposed detection system uses an unsupervised stochastic Restricted Boltzmann Machine algorithm to self-learn the reliable network metrics. This algorithm detects and classifies the type of DDoS attacks in a dynamic network environment by framing a new context. The results prove that RBM based DDoS detection system achieves higher accuracy than the existing methods. <s> BIB009 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> Recent years, Software Defined Routers (SDRs) (programmable routers) have emerged as a viable solution to provide a cost-effective packet processing platform with easy extensibility and programmability. Multi-core platforms significantly promote SDRs’ parallel computing capacities, enabling them to adopt artificial intelligent techniques, i.e., deep learning, to manage routing paths. In this paper, we explore new opportunities in packet processing with deep learning to inexpensively shift the computing needs from rule-based route computation to deep learning based route estimation for high-throughput packet processing. Even though deep learning techniques have been extensively exploited in various computing areas, researchers have, to date, not been able to effectively utilize deep learning based route computation for high-speed core networks. We envision a supervised deep learning system to construct the routing tables and show how the proposed method can be integrated with programmable routers using both Central Processing Units (CPUs) and Graphics Processing Units (GPUs). We demonstrate how our uniquely characterized input and output traffic patterns can enhance the route computation of the deep learning based SDRs through both analysis and extensive computer simulations. In particular, the simulation results demonstrate that our proposal outperforms the benchmark method in terms of delay, throughput, and signaling overhead. <s> BIB010 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> Mobile cloud is changing the way to enroll teaching activities in a university campus. Lectures and lab sessions can be carried out directly from tablets in a classroom by accessing a server in the cloud. In this paper, we address the problem of high-density cloud access with wireless devices in campus networks. We propose to use Wi-Fi direct clustering to solve the problem of quality of service (QoS) degradation when a high number of wireless devices want to access a content in the cloud at the same time. A centralized software-defined network controller is used in our proposed architecture to capture the network state and organize the Wi-Fi Direct groups. The optimized number of clusters can be calculated in function of the number of devices in the room. By simulations, we show that we can provide a better QoS in terms of download time and application’s throughput by reducing the interference in this dense wireless network environment. <s> BIB011 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> Distributed Denial of Service (DDoS) attack is one of the most long-lasting problems in network security. Recently, although the DDoS attack mechanisms are widely understood, the problems are becoming more frequent due to the similarity between DDoS attack and normal traffic. In this work, we propose two approaches of DDoS attack detection which are based on the Self-Organizing Map (SOM). The proposed algorithms with their detection architecture are implemented in the Software-Defined Networking (SDN) technology which has the flexibility and programmable abilities. The SDN controller allows us to quickly perform complex classification and detection algorithm. By deploying a testbed environment, we successfully evaluate our proposed algorithms in terms of both accuracy and computational overhead. The experimental results show that these algorithms can reduce the processing time while maintain the suitable accuracy rate. <s> BIB012 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Unsupervised learning in SDN <s> In information-centric networking, accurately predicting content popularity can improve the performance of caching. Therefore, based on software defined network (SDN), this paper proposes Deep-Learning-based Content Popularity Prediction (DLCPP) to achieve the popularity prediction. DLCPP adopts the switch’s computing resources and links in the SDN to build a distributed and reconfigurable deep learning network. For DLCPP, we initially determine the metrics that can reflect changes in content popularity. Second, each network node collects the spatial-temporal joint distribution data of these metrics. Then, the data are used as input to stacked auto-encoders (SAE) in DLCPP to extract the spatiotemporal features of popularity. Finally, we transform the popularity prediction into a multi-classification problem through discretizing the content popularity into multiple classifications. The Softmax classifier is used to achieve the content popularity prediction. Some challenges for DLCPP are also addressed, such as determining the structure of SAE, realizing the neuron function on an SDN switch, and deploying DLCPP on an OpenFlow-based SDN. At the same time, we propose a lightweight caching scheme that integrates cache placement and cache replacement—caching based on popularity prediction and cache capacity (CPC). Abundant experiments demonstrate good performance of DLCPP, and it achieves close to 2.1%~15% and 5.2%~40% accuracy improvements over neural networks and auto regressive, respectively. Benefitting from DLCPP’s better prediction accuracy, CPC can yield a steady improvement of caching performance over other dominant cache management frameworks. <s> BIB013
K-means clustering BIB005 BIB011  BIB002 BIB003 , self-organizing map  BIB006 BIB007 BIB001 BIB004 BIB012 , hidden Markov model  BIB008 , Restricted Boltzmann machines BIB009 , and unsupervised deep learning approaches BIB010   BIB013 were the most used unsupervised learning techniques in SDN paradigm.