Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> The Internet infrastructure and Internet-based business today still suffer from various attacks like Distributed Denial-of-Service (DDoS) attacks or worm propagations. A necessary first step in order to cope with such large-scale attacks is to provide an Internet-wide detection of such ongoing attacks, i.e., a detection that is not limited to single detection systems only. Therefore, collaborative detection systems were developed in the past. They, however, often rely on close trust relationships, which only rarely are available in the Internet. This means that the scope of detection is limited to only a small part of the Internet, mostly to a single administrative domain. This paper, therefore, introduces our newly developed collaborative attack detection that facilitates collaboration beyond domain boundaries without requiring close trust relationships. In-network detection systems are explicitly considered, too. Such systems are located on routers in the core of the Internet and are characterized by limited resources available for detection. Finally, a detailed simulative evaluation of our proposed solution is presented. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> Distributed Denial of Service (DDoS) attacks are becoming a very versatile weapon. Unfortunately, they are becoming very popular amongst cyber criminals, and they are also getting cheaper. As the interest grows for such weapons on the black market, their scale reaches unimaginable proportions. As is the case of the Spamhaus attack, which was mitigated by CloudFlare through null-routing techniques. This paper presents a way of mitigating DDoS attacks in a Software Defined Network (SDN) environment, by assessing risk through the means of a cyber-defense system based on neural networks and the biological danger theory. In addition to mitigating attacks the demo platform can also perform full packet capture in the SDN, if the central command component deems it necessary. These packet captures can be used later for forensic analysis and identification of the attacker. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> Abstract Coordinated intrusion, like DDoS, Worm outbreak and Botnet, is a major threat to network security nowadays and will continue to be a threat in the future. To ensure the Internet security, effective detection and mitigation for such attacks are indispensable. In this paper, we propose a novel collaborative intrusion prevention architecture, i.e. CIPA, aiming at confronting such coordinated intrusion behavior. CIPA is deployed as a virtual network of an artificial neural net over the substrate of networks. Taking advantage of the parallel and simple mathematical manipulation of neurons in a neural net, CIPA can disperse its lightweight computation power to the programmable switches of the substrate. Each programmable switch virtualizes one to several neurons. The whole neural net functions like an integrated IDS/IPS. This allows CIPA to detect distributed attacks on a global view. Meanwhile, it does not require high communication and computation overhead. It is scalable and robust. To validate CIPA, we have realized a prototype on Software-Defined Networks. We also conducted simulations and experiments. The results demonstrate that CIPA is effective. <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> In order to improve the performance of data transmission in SDN, this paper proposes a load balance solution scheme by taking advantage of the global network view of SDN. We collect 4 load features from each transmission path. These features are bandwidth utilization ratio, packet loss rate, transmission latency and transmission hops. By using this 4 load features, BP Artificial Neural Network model is trained to predict the integrated load for different path and to choose one with least load as the data-flow transmission path. The contrast experiment results show that load balancing strategy proposed in this paper can select more rational transmission path for data-flow and achieve 19.3% network latency decrease at most. <s> BIB004 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> An Artificial Neural Network has been proposed as predicting the performance of the Software Defined Network according to effective traffic parameters. Those used in this study are round-trip time, throughput and the flow table rules for each switch, POX controller and OpenFlow switches, which characterize the behaviour of the Software Defined Network, have been modelled and simulated via Mininet and Matlab platforms. An ANN has the ability to provide an excellent input-output relationship for nonlinear and complex processes. The network has been implemented using different topologies, one and two layers in the hidden zone with different numbers of neurons. Generalization of the prediction model has been tested with new data that are unseen in the training stage. The simulated results show reasonably good performance of the network. <s> BIB005 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> The research community has considered in the past the application of Artificial Intelligence (AI) techniques to control and operate networks. A notable example is the Knowledge Plane proposed by D.Clark et al. However, such techniques have not been extensively prototyped or deployed in the field yet. In this paper, we explore the reasons for the lack of adoption and posit that the rise of two recent paradigms: Software-Defined Networking (SDN) and Network Analytics (NA), will facilitate the adoption of AI techniques in the context of network operation and control. We describe a new paradigm that accommodates and exploits SDN, NA and AI, and provide use-cases that illustrate its applicability and benefits. We also present simple experimental results that support, for some relevant use-cases, its feasibility. We refer to this new paradigm as Knowledge-Defined Networking (KDN). <s> BIB006 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> In general, humans follow a routine with highly predictable daily movements. For instance, we commute from home to work on a daily basis and visit a selected set of places for commercial and recreational purposes during the nights and weekends. The use of mobile phones increases when commuting via public transportation, during lunch breaks, and at night. Such regular behavior creates predictable spatiotemporal fluctuations of traffic patterns. In this paper, we introduce a matheuristic for dynamic optical routing, which can be implemented as an application into a software-defined mobile carrier network. We use machine learning to predict tidal traffic variations in a mobile metro-core network, which allows us to solve off-line mixed-integer linear programming instances of an optical routing (and wavelength) assignment optimization problem. The optimal results are used to favor near-optimal on-line routing decisions. Results demonstrate the effectiveness of our on-line methodology, with results that match almost perfectly the behavior of a network that performs optical routing reconfiguration with a perfect, oracle-like traffic prediction and the solution of an optimization problem. <s> BIB007 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> Software Networks built by combining Software Defined Networks (SDN), Network Function Virtualization (NFV) and Cloud principles call for agile and dynamic automation of management operations to ensure continuous provisioning and deployment of networked resources and services. In this context, efficient Service Level Agreements (SLA) management and anticipation of Service Level Objectives (SLO) breaches become essential to fulfill established service contracts with clients. In this paper, we design and specify a framework for cognitive SLA enforcement (using Artificial Neural Network learning) for networking services involving VNFs (Virtualized Network Functions) and SDN controllers. A proof of concept, a testbed description and an extensive evaluation assess the performance of the proposed framework. <s> BIB008 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> This paper is motivated by the emerging vision of an automated and data-driven optimization of communication networks, making it possible to fully exploit the flexibilities offered by modern network technologies and heralding an era of fast and self-adjusting networks. We build upon our recent study of machine-learning approaches to (statically) optimize resource allocations based on the data produced by network algorithms in the past. We take our study a crucial step further by considering dynamic scenarios: scenarios where communication patterns can change over time. In particular, we investigate network algorithms which learn from the traffic distribution (the feature vector), in order to predict global network allocations (a multi-label problem). As a case study, we consider a well-studied fc-median problem arising in Software-Defined Networks, and aim to imitate and speedup existing heuristics as well as to predict good initial solutions for local search algorithms. We compare different machine learning algorithms by simulation and find that neural network can provide the best abstraction, saving up to two-thirds of the algorithm runtime. <s> BIB009 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Neural Networks in SDN <s> Software-Defined Networks (SDN) is an emerging area that promises to change the way we design, build, and operate network architecture. It tends to shift from traditional network architecture of proprietary based to open and programmable network architecture. However, this new innovative and improved technology also brings another security burden into the network architecture, with existing and emerging security threats. The network vulnerability has become more open to intruders: the focus is now shifted to a single point of failure where the central controller is a prime target. Therefore, integration of intrusion detection system (IDS) into the SDN architecture is essential to provide a network with attack countermeasure. The work designed and developed a virtual testbed that simulates the processes of the real network environment, where a star topology is created with hosts and servers connected to the OpenFlow OVS-switch. Signature-based Snort IDS is deployed for traffic monitoring and attack detection, by mirroring the traffic destine to the servers. The vulnerability assessment shows possible attacks threat exist in the network architecture and effectively contain by Snort IDS except for the few which the suggestion is made for possible mitigation. In order to provide scalable threat detection in the architecture, a flow-based IDS model is developed. A flow-based anomaly detection is implemented with machine learning to overcome the limitation of signature-based IDS. The results show positive improvement for detection of almost all the possible attacks in SDN environment with our pattern recognition of neural network for machine learning using our trained model with over 97% accuracy. <s> BIB010
Neural networks (NN) approach was used mainly for intrusion detection and prevention BIB003 BIB004 BIB002 , solving controller placement problem BIB007 , load balancing BIB004 , performance prediction BIB005 , service level agreements (SLA) enforcement  BIB008 , routing and optimal virtual machine (VM) placement BIB006 . Chen and Yu BIB003 proposed, CIPA, a collaborative intrusion prevention architecture, which represents a distributed intrusion prevention system based on NN approach. They used the following features: number of all packets monitored, proportion of icmp packets to all packets, the proportion of short packets, the proportion of long packets, : the proportion of udp packets to all packets and : the base-10 logarithm of the proportion of packets with syn flag set to packets with ack flag set. The experimental results showed that CIPA outperforms BIB001 in detecting DDoS flooding attacks. CIPA also achieved good results in detecting Witty, Slammer and Conficker worm outbreak. The system achieved low computational and communication overhead due to its parallel and simple computational capabilities. He et al. BIB009 proposed a multi-label classification approach to predict global network allocations (i.e. weighted controller placement problem). Compared to decision tree and logistic regression, neural network approach showed better results and saved up to two-thirds of the algorithm runtime. Alvizu et al. BIB007 used a neural network approach for off-line prediction of traffic demands in a mobile network operator, which resulted in reducing the optimality gap below 0.2% (virtual wavelength path-hourly-NN) and 0.45% (wavelength path-hourly-NN). In addition, NN approach was used for off-line prediction of the next configuration time point. Abubakar et al. BIB010 proposed an intrusion detection system for SDN based on NN approach, which achieved a high accuracy reached 97.3% using NSL-KDD dataset. Chen-Xiao and Ya-Bin BIB004 proposed an NN approach for load balancing. Compared to  and static Round Robin strategy, the experimental study showed that this method can achieve better performance and resulted in 19.3% decreasing of network latency. Sabbeh et al. BIB005 proposed an NN approach based on Levenberg Marquardt (LM) algorithm to predict the performance of SDN according to round-trip time (RTT) and throughput which are the two parameters used for training. The experimental results showed that one hidden layer achieves low mean squared error (MSE). Bendriss et al.  BIB008 proposed a new approach to enforce service level agreements (SLA) in SDN and virtualized network functions (NFV). Their research focused on prediction of service level objectives (SLOs) breaches for streaming services running on NFV and SDN. The experimental results showed that long short term memory (LSTM) is more robust than feed forward neural networks. Mestres et al. BIB006 presented a new paradigm that employs AI in SDN, termed as knowledge-defined networking (KDN). The paradigm included a proof of concept concerning routing in an overlay network based on NN approach where the mean squared error (MSE) reached 1%. In addition to solving the problem of optimal virtual machine (VM) placement in NFV paradigm. Mihai-Gabriel and Victor-Valeriu BIB002 proposed a method for mitigating DDoS attacks in SDNs by risk assessing based on neural networks and biological danger theory. The risk of a DDoS attack is calculated on every host and then the reported to a VM that is responsible for monitoring the network traffic. When the risk of the observed traffic exceeds a predefined value, instructions will be sent to the controller to install the appropriate controls that allow the SDN to enter in a proactive mode to reduce the burden on the controller caused by sending these flows to the controller for analysis.