Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> Software-defined networking (SDN) has recently generated considerable interest among researchers as a next generation network architecture that can overcome the limitations of the traditional network. Intrusion detection and prevention system (IDPS) can leverage the SDN approach to achieve lots of great benefits. The specialized hardware or software for network monitoring can be replaced by OpenFlow switches which might reduce the cost and decrease the latency of the whole IDPS system. SDN also enables the automatic response of the IDPS in case of intrusion detection. Besides, the administrator tasks can be much simpler and efficient thanks to the advantages of SDN. In this paper, we propose a network-based IDPS relying on SDN approach and carry out some typical experiments to evaluate its performance against Denial of Service and Probe attack. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> It is a common view in Software Defined Network (SDN) that the flow table plays the most significant role in SDN architecture, but suffers from the limited TCAM chips. The shortage of flow table storage strongly impacts the quality of service (QoS) provided by SDN, but requires rational solutions. In this paper, we present a practical on-line approach based on the decision tree structure to solve this problem. Our performance is evaluated by the comparison with other existing technologies. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> An experimental setup of 32 honeypots reported 17M login attempts originating from 112 different countries and over 6000 distinct source IP addresses. Due to decoupled control and data plane, Software Defined Networks (SDN) can handle these increasing number of attacks by blocking those network connections at the switch level. However, the challenge lies in defining the set of rules on the SDN controller to block malicious network connections. Historical network attack data can be used to automatically identify and block the malicious connections. There are a few existing open-source software tools to monitor and limit the number of login attempts per source IP address one-by-one. However, these solutions cannot efficiently act against a chain of attacks that comprises multiple IP addresses used by each attacker. In this paper, we propose using machine learning algorithms, trained on historical network attack data, to identify the potential malicious connections and potential attack destinations. We use four widely-known machine learning algorithms: C4.5, Bayesian Network (BayesNet), Decision Table (DT), and Naive-Bayes to predict the host that will be attacked based on the historical data. Experimental results show that average prediction accuracy of 91.68% is attained using Bayesian Networks. <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> Managing QoS in a telecommunications network is a complex process. Effective network design and sizing in conjunction with load balancing, access control and traffic prioritization need to be orchestrated to optimize CAPEX investment, maximize network utilization and ensure that performance metrics and SLAs are met. This work shows how big data analytics were used to improve the management of QoS in an SDN by performing multi-dimensional analysis of Key Performance Indicators (KPIs) and applying machine learning algorithms to discover new correlations, perform root cause analysis and predict traffic congestion. <s> BIB004 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> Recently, Internet-based systems need to be changed their configuration dynamically. Traditional networks have very limited ability to cope up with such frequent changes and hinder innovations management and configuration procedures. To address this issue, Software Defined Networking (SDN) has been emerging as a new network architecture that allows for more flexibility through software-enabled network control. However, the dynamism of programmable networks also faces new security challenges that demand innovative solutions. Among the widespread mechanisms of SDN security control applications, anomaly-based IDS is an extremely effective technique in detecting both known and unknown (new) attack types. In this paper, we propose an anomaly-based Intrusion Detection architecture integrated on OpenFlow Switch. The proposed system can detect and prevent a network from many attack types, especially new attack types using anomaly detection. We implement the proposed system on the FPGA technology using a Xilinx Virtex-5 xc5vtx240t device. In this FPGA-based prototype, we integrate an anomaly-based intrusion detection technique to be able to defend against many attack types and anomalous on the network traffic. The experimental results show that our system achieves a detection rate exceeding 91.81% with a 0.55% false alarms rate at maximum. <s> BIB005 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> Due to the centralized control, network-wide monitoring and flow-level scheduling of software-defined-networking (SDN), it can be utilized to achieve quality of service (QoS) for cloud applications and services, such as voice over IP, video conference, and online games. However, most existing approaches stay at the QoS framework design and test level, while few works focus on studying the basic QoS techniques supported by SDN. In this paper, we enable SDN with QoS guaranteed abilities, which could provide end-to-end QoS routing for each cloud user service. First of all, we implement an application identification technique on SDN controller to determine required QoS levels for each application type. Then, we implement a queue scheduling technique on SDN switch. It queues the application flows into different queues and schedules the flows out of the queues with different priorities. At last, we evaluate the effectiveness of the proposed SDN-based QoS technique through both theoretical and experimental analysis. Theoretical analysis shows that our methods can provide differentiated services for the application flows mapped to different QoS levels. Experiment results show that when the output interface has sufficiently available bandwidth, the delay can be reduced by 28% on average. In addition, for the application flow with the highest priority, our methods can reduce 99.99% delay and increase 90.17% throughput on average when the output interface utilization approaches to the maximum bandwidth limitation. <s> BIB006 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> This paper proposes an application-aware multipath flow routing framework that integrates Machine Learning Techniques (MLT) in Software Defined Networks (SDN). Applications generated by the devices are diverse in nature, for each application bandwidth and delay requirements vary. The flows in the network compete for a constrained resource such as bandwidth or low latency path, an intelligent flow routing algorithm becomes a natural demand. Better overall network performance could be achieved only if the network is capable of prioritizing the flows and assign resources based on their application specific requirement. Our proposed, AMPS controller is capable of prioritizing each of the flow using MLT, and assign a path based on its classified priority. AMPS controller supports routing flows through different path even if the flows are between the same pair of nodes. The path finding algorithm employs Yen-K-shortest path algorithm, also it supports scalable flow routing for a large volume of flows. We have implemented the flow routing algorithm in OpenvSwitch as a proof of concept. A significant improvement is observed in comparison to SDN with traditional routing techniques involving a large number of flows. The proposed flow routing algorithm ensures high availability of an unloaded path for high priority flows even in a heavily loaded network. <s> BIB007 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> Software defined networking (SDN) provides flexible management for datacenter networks with the flow-level control. Such the fine-grained management, however, consumes large amount of bandwidth between data and control planes, which results in the bottleneck in the scalability of SDN-based datacenters. "The elephant and mouse phenomenon" suggests that there are only very few elephant flows that carry the majority of bytes in datacenters so that it can improve management efficiency to detect and reroute elephant flows while leaving mice flows in data plane leveraging wildcard flow table in OpenFlow. Unfortunately, existing mechanisms for elephant flow detection suffer from high bandwidth consumption and long detection time. In this paper, we propose an efficient sampling and classification approach (ESCA) with the two-phase elephant flow detection. In the first phase, ESCA improves sampling efficiency by estimating the arrival interval of elephant flows and filtering out redundant samples using a filtering flow table. In the second phase, ESCA classifies samples with a new supervised classification algorithm based on correlation among data flows. The mathematical analysis proofs our ESCA outperforms related schemes. Extensive experiment results on real public datacenter traces further demonstrate that our ESCA can provide accurate detection with less sampled packets and shorter detection time. <s> BIB008 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> Current era of networking world witnesses an increase in the number of devices that have intelligent component embedded in them, which leads to an unmanageable state. This has lead to a steady shift towards using Open Software Defined Networks to reduce operational expenditure. The whole of the intelligence lies in the central controller which obviously is the single point of failure. The attackers find it easy to bring down the whole network by saturating the control plane of the SDN which eventually leads to denial-of-service (DoS) to the data plane, through host location hijacking attack. The various strategies proposed to defend the SDN controller from host location hijack attack includes authentication of host which incurs overhead. In this paper we propose SLAMHHA, a Supervised Learning Approach to Mitigate Host location Hijacking Attack. SLAMHHA is implemented in the SDN controller which monitors the legitimacy of the hosts and identifies the clandestine users impersonating the hosts in the data plane. The SLAMHHA algorithm can be implemented in either of the two SDN controller setup (i.e.) in both centralized and decentralized controller setup, been used to set the flow rules and monitor the underlying network. MININET has been used to test the efficiency of the SLAMHHA algorithm. SLAMHHA algorithm was implemented in the POX controller. Numerical results show that SLAMHHA incurs less overhead in terms of CPU and memory consumption when compared to the authentication method. This algorithm blocks the attack within 3 seconds when 100 hosts are impersonated to perform DoS attack. Thus our proposed SLAMHHA algorithm mitigates the host location hijacking attack with less overhead. <s> BIB009 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> Abstract The decision-tree based packet-classification algorithm field has seen many contributions since the first algorithm using a geometrical rule representation, HiCuts, has been proposed. While hardware reported implementations for this class of algorithms have proven that a high throughput can be reached, those algorithms are inherently facing a tradeoff between speed and memory consumption. This paper presents two extensions applicable to decision-tree based algorithms designed to tackle two of their common drawbacks. Applied together, they achieve a reduction of the number of memory accesses, while reducing the data structure size. The first contribution consists of a new rule-clustering method aimed for the reduction of the number of trees built. The second contribution relies on a leaf compression method that allows tackling the problem that stems from linear leaf traversal. Applied together, as shown by simulations, those two new methods improve the trade-off between search-time complexity and data structure size. These strategies provide gains in many contexts, although they are tailored for handling complex rule sets used in the context of Software Defined Networking. For sets of 100,000 and 10,000 rules, those two strategies reduce the number of memory accesses by a factor of 3 on average, while decreasing the size of the data structure by about 45% over EffiCuts, a well-known decision-tree based algorithm. <s> BIB010 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Decision Trees in SDN <s> Software-defined networking (SDN) is a new paradigm that allows developing more flexible network applications. SDN controller, which represents a centralized controlling point, is responsible for running various network applications as well as maintaining different network services and functionalities. Choosing an efficient intrusion detection system helps in reducing the overhead of the running controller and creates a more secure network. In this study, we investigate the performance of the well-known anomaly-based intrusion detection approaches in terms of accuracy, false alarm rate, precision, recall, f1-measure, area under ROC curve, execution time and Mc Nemar's test. Precisely, we focus on supervised machine-learning approaches where we use the following classifiers: Decision Trees (DT), Extreme Learning Machine (ELM), Naive Bayes (NB), Linear Discriminant Analysis (LDA), Neural Networks (NN), Support Vector Machines (SVM), Random Forest (RT), K Nearest-Neighbour (KNN), AdaBoost, RUSBoost, LogitBoost and BaggingTrees where we employ the well-known NSL-KDD benchmark dataset to compare the performance of each one of these classifiers. <s> BIB011
Decision trees were widely used for application identification BIB006 BIB007 , packet and traffic classification BIB002 BIB008 , intrusion detection BIB001  BIB011 , Botnet detection  BIB011 , solving flow table congestion BIB003 , detection of elephant flows BIB004 , prediction of QoS violations BIB005 , as well as solving SDNrelated security challenged BIB009 BIB010 . In BIB006 and BIB007 the C4.5 decision tree approach was used for application identification in order to associate each application type with a corresponding QoS level. Le et al. BIB001 , on the other hand, proposed an intrusion detection and prevention system based on C4.5 algorithm. Nagarathna and Shalinie BIB009 proposed, SLAMHHA, a supervised learning approach based on Iterative Dichotomiser 3 (ID3) decision tree algorithm for mitigating host location hijacking attacks on SDN controllers. This attack is a new attack vector for SDNs where it exploits the vulnerability of the SDN to launch a DoS attack on the controller. By exploiting the vulnerability of the host tracking service of the SDN controller, which estimates the host location by examining the PACKET-IN messages. SLAMHHA consists of three main components: 1) decision tree construction, 2) modified host tracking service module and 3) classification module. When a new PACKET-IN message is received, SLAMHHA probes the message to investigate the host related information. A check is made to find whether the host related information is presented in the host profile. If no match is found, then the classification event is invoked by the SDN controller. SLAMHHA achieved less overhead in terms of CPU and memory consumption when compared to the authentication method. Tariq and Baig  applied C4.5 for SDN-based Botnet detection. In addition to the OpenFlow statistics they extracted four more features namely: average packet inter-arrival time , bytes per packets, bits per second, and packets per second. The training phase included four Botnets whereas the testing phase included five additional Botnets to check the detection capability of the proposed model. The experimental results based on CTU-43 botnet dataset showed that proposed approach achieved an accuracy of 80%. Qazi et al. proposed  , Atlas, a framework that enables fine-grained and scalable application classification for mobile agents in SDN based on C5.0 algorithm. Atlas was prototyped in HP Lab wireless network and it collected the netstat logs us-ing mobile agents running on employee devices. These logs are sent to the control plane, at which the classification algorithm works. The flow features were collected by an OpenFlow enabled wireless AP and sent to the control plane. The authors used 40 most popular applications in Google Play Store in order to collect over 100k flow samples from five devices during 3 weeks of the testing period. The experimental results showed that Atlas can achieve a 94% of accuracy on average. Leng et al. BIB002 presented a method for solving flow table congestion problem based on C4.5 algorithm. C4.5 is employed to compress the flow entries with QoS guaranteed. DT is translated into a new flow table according to the path between each node and the root. The experimental results showed that the proposed approach achieved a higher compressing with larger number of flow entries and also it reduced the flow matching cost (average matching time dropped by 98% on average). Nanda et al. BIB003 proposed a method for predicting potential vulnerable hosts using historical network data and ML algorithms such as C4.5, bayesian network (BN), decision table (DT), and naive-bayes (NB). The best results were achieved by bayesian network approach. Stimpfling et al. BIB010 introduced new extensions for decision-tree algorithms, namely adaptive grouping factor (AGF) and independent sub-rule (ISR) leaf structure that allow achieving better packet classification for larger rules, as well as reducing the number of memory access by a factor of 3. Furthermore, it decreased the size of the data structure by about 45% over EffiCuts approach. The authors considered SDN rule-sets for this study. Tang et al. BIB008 proposed a two-stage approach for detecting elephant flows, where the first stage consists of an efficient sampling used in order to attain a good balance between detection overhead and implementation. The the next stage, on the other hand, employs an enhanced C4.5 for the previously correlated flows. The proposed approach depends mainly on finding the most effective sampling periods and classifying these samples based on enhanced C4.5. The new C4.5 is based on flow correlation and probability. It is worth mentioning that the proposed system requires only one packet to identify whether a particular flow is an elephant flow or not. The enhanced C4.5 improved the accuracy of C4.5 up to 12%. Jain et al. BIB004 investigated the prediction of traffic congestion based on M5Rules approach, which combines decision trees and linear regression in order to improve the management of QoS. They proposed a multi-dimensional analysis of Key Performance Indicators (KPIs) followed by M5Rules decision tree to discover different types of correlations, which have been divided into 3 groups: expected correlations, discovered correlations and unexpected correlations. Van et al. [134] used a J48-tree classifier for intrusion detection on OpenFlow switches. They implemented an FPGA-based prototype where the experimental results based on KDD99 dataset showed that their proposed system can achieve an overall accuracy of 93.3% and a detection rate of 91.81% with low false alarm rates (0.55%). Wijesinghe et al.  studied the detection of Botnets (IRC,HTTP and P2P botnets) using SDN paradigm based decision trees approach, which showed better results for detecting peer-to-peer botnets, whereas SVM and Bayesian networks Latah and Toker BIB011 presented a comparative analysis of application of different supervised ML approaches for SDNbased intrusion detection task. They used Principal Components Analysis (PCA) for feature reduction. The experimental results based on NSL-KDD dataset showed that DT approach achieved the best performance in terms of accuracy, precision, F1-measure, AUC and Mc Nemar's Test. Whereas Bagging and boosting approaches achieved better results over traditional supervised ML approaches such as k-NN, NN and SVM. LogitBoost also showed the best results in terms of false alarm rate and recall.