Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Distributed Denial of Service (DDoS) attacks are becoming a very versatile weapon. Unfortunately, they are becoming very popular amongst cyber criminals, and they are also getting cheaper. As the interest grows for such weapons on the black market, their scale reaches unimaginable proportions. As is the case of the Spamhaus attack, which was mitigated by CloudFlare through null-routing techniques. This paper presents a way of mitigating DDoS attacks in a Software Defined Network (SDN) environment, by assessing risk through the means of a cyber-defense system based on neural networks and the biological danger theory. In addition to mitigating attacks the demo platform can also perform full packet capture in the SDN, if the central command component deems it necessary. These packet captures can be used later for forensic analysis and identification of the attacker. <s> BIB001 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software Defined Networking (SDN) provides separation of data plane and control plane. The controller has centralized control of the entire network. SDN offers the ability to program the network and allows dynamic creation of flow policies. The controller is vulnerable to Distributed Denial of Service (DDoS) attacks that leads to resource exhaustion which causes non-reachability of services given by the controller. The detection of DDoS requires adaptive and accurate classifier that does decision making from uncertain information. It is critical to detect the attack in the controller at earlier stage. SVM is widely used classifier with high accuracy and less false positive rate. We analyze the SVM classifier and compare it with other classifiers for DDoS detection. The experiments show that SVM performs accurate classification than others. <s> BIB002 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software-defined networking (SDN) has recently generated considerable interest among researchers as a next generation network architecture that can overcome the limitations of the traditional network. Intrusion detection and prevention system (IDPS) can leverage the SDN approach to achieve lots of great benefits. The specialized hardware or software for network monitoring can be replaced by OpenFlow switches which might reduce the cost and decrease the latency of the whole IDPS system. SDN also enables the automatic response of the IDPS in case of intrusion detection. Besides, the administrator tasks can be much simpler and efficient thanks to the advantages of SDN. In this paper, we propose a network-based IDPS relying on SDN approach and carry out some typical experiments to evaluate its performance against Denial of Service and Probe attack. <s> BIB003 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Abstract Coordinated intrusion, like DDoS, Worm outbreak and Botnet, is a major threat to network security nowadays and will continue to be a threat in the future. To ensure the Internet security, effective detection and mitigation for such attacks are indispensable. In this paper, we propose a novel collaborative intrusion prevention architecture, i.e. CIPA, aiming at confronting such coordinated intrusion behavior. CIPA is deployed as a virtual network of an artificial neural net over the substrate of networks. Taking advantage of the parallel and simple mathematical manipulation of neurons in a neural net, CIPA can disperse its lightweight computation power to the programmable switches of the substrate. Each programmable switch virtualizes one to several neurons. The whole neural net functions like an integrated IDS/IPS. This allows CIPA to detect distributed attacks on a global view. Meanwhile, it does not require high communication and computation overhead. It is scalable and robust. To validate CIPA, we have realized a prototype on Software-Defined Networks. We also conducted simulations and experiments. The results demonstrate that CIPA is effective. <s> BIB004 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> In order to improve the performance of data transmission in SDN, this paper proposes a load balance solution scheme by taking advantage of the global network view of SDN. We collect 4 load features from each transmission path. These features are bandwidth utilization ratio, packet loss rate, transmission latency and transmission hops. By using this 4 load features, BP Artificial Neural Network model is trained to predict the integrated load for different path and to choose one with least load as the data-flow transmission path. The contrast experiment results show that load balancing strategy proposed in this paper can select more rational transmission path for data-flow and achieve 19.3% network latency decrease at most. <s> BIB005 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> An Artificial Neural Network has been proposed as predicting the performance of the Software Defined Network according to effective traffic parameters. Those used in this study are round-trip time, throughput and the flow table rules for each switch, POX controller and OpenFlow switches, which characterize the behaviour of the Software Defined Network, have been modelled and simulated via Mininet and Matlab platforms. An ANN has the ability to provide an excellent input-output relationship for nonlinear and complex processes. The network has been implemented using different topologies, one and two layers in the hidden zone with different numbers of neurons. Generalization of the prediction model has been tested with new data that are unseen in the training stage. The simulated results show reasonably good performance of the network. <s> BIB006 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> The research community has considered in the past the application of Artificial Intelligence (AI) techniques to control and operate networks. A notable example is the Knowledge Plane proposed by D.Clark et al. However, such techniques have not been extensively prototyped or deployed in the field yet. In this paper, we explore the reasons for the lack of adoption and posit that the rise of two recent paradigms: Software-Defined Networking (SDN) and Network Analytics (NA), will facilitate the adoption of AI techniques in the context of network operation and control. We describe a new paradigm that accommodates and exploits SDN, NA and AI, and provide use-cases that illustrate its applicability and benefits. We also present simple experimental results that support, for some relevant use-cases, its feasibility. We refer to this new paradigm as Knowledge-Defined Networking (KDN). <s> BIB007 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> In this paper, we propose an optimized protection mechanism (OpenFlowSIA) for Software-Defined Networks from flooding attacks (Distributed Denial-of-Service) based on Support Vector Machine and our proposed algorithm called the Idle-timeout Adjustment (IA). Our methodology not only utilizes SVM advantages in classification such as high accuracy and little processing time, but also applies effectively the IA algorithm and coherent policies to protect network from resource exhaustion caused by flooding attacks, particularly for the SDN controller and OpenFlow switches. Through comprehensive experiments, the OpenFlowSIA scheme illustrates that it can be an innovative solution to secure and save the network resources under flooding attacks in the Software-Defined Networks. <s> BIB008 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Most existing approaches for solving the network threat problems focus on the specific security mechanisms, for example, network intrusion detection system (NIDS) detection, firewall configuration, rather than on flow management approaches to defend network threats with an SDN (Software Defined Networking) architecture. Accordingly, this study proposes an improved behaviour-based SVM (support vector machine) with learning algorithm for use in the security monitoring system (SMS) to categorize network threats for network intrusion detection system. The model also adopted the ID3 decision tree theory to outrank raw features and determine the most qualified features to train support vector classifier (SVC) considering the overall detection precision rate of experiments which speeds up the learning of normal and intrusive patterns and and increases the accuracy of detecting intrusion. By using sFlow collector and analyzer associated with sFlow-RT toolset, the experimental results proved that the SMS enables a defender to classify the network threats with defence strategies and defend network threats. <s> BIB009 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> In this paper, we firstly introduce a new combined approach to enhance the performance of classification in network traffic. The proposed combination mainly focuses on taking advantages of two classification algorithms, Support Vector Machine (SVM), Self Organizing Map (SOM). We utilize both advantages that SVM takes a little time to produce outputs with a high accuracy, SOM makes a reliable prediction based on their neurons. Next, we propose a hybrid flow-based work mechanism, which applies the proposed combination SVMs-SOM, for handling with Distributed Denial-of-Service (DDoS) attacks, network component protection from resource exhaustion in Software-Defined Networking. In the introduced scheme, multiple Linear SVMs first classify flow entries existing in flow-tables from OpenFlow switches. In the case that a flow's position is located between two margin lines or a vague region in the Linear SVM representation, it will be then forwarded to a SOM to make a final decision. Afterwards, an attack classifier, a policy enforcement module will be applied to attack flows with the purpose of attack diminution, the SDN controller protection. Besides, we also provide readers with a new view of DDoS attacks in the Software-Defined Networking. Thorough practical experiments conducted in the Software-Defined Networking environment, it is proved that the proposed classification combination outperforms original algorithms,, the novel hybrid mechanism can be an effective, innovative approach to face with DDoS attacks, protect the OpenFlow switches, the SDN controller from being overloaded. <s> BIB010 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> It is a common view in Software Defined Network (SDN) that the flow table plays the most significant role in SDN architecture, but suffers from the limited TCAM chips. The shortage of flow table storage strongly impacts the quality of service (QoS) provided by SDN, but requires rational solutions. In this paper, we present a practical on-line approach based on the decision tree structure to solve this problem. Our performance is evaluated by the comparison with other existing technologies. <s> BIB011 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> An experimental setup of 32 honeypots reported 17M login attempts originating from 112 different countries and over 6000 distinct source IP addresses. Due to decoupled control and data plane, Software Defined Networks (SDN) can handle these increasing number of attacks by blocking those network connections at the switch level. However, the challenge lies in defining the set of rules on the SDN controller to block malicious network connections. Historical network attack data can be used to automatically identify and block the malicious connections. There are a few existing open-source software tools to monitor and limit the number of login attempts per source IP address one-by-one. However, these solutions cannot efficiently act against a chain of attacks that comprises multiple IP addresses used by each attacker. In this paper, we propose using machine learning algorithms, trained on historical network attack data, to identify the potential malicious connections and potential attack destinations. We use four widely-known machine learning algorithms: C4.5, Bayesian Network (BayesNet), Decision Table (DT), and Naive-Bayes to predict the host that will be attacked based on the historical data. Experimental results show that average prediction accuracy of 91.68% is attained using Bayesian Networks. <s> BIB012 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Managing QoS in a telecommunications network is a complex process. Effective network design and sizing in conjunction with load balancing, access control and traffic prioritization need to be orchestrated to optimize CAPEX investment, maximize network utilization and ensure that performance metrics and SLAs are met. This work shows how big data analytics were used to improve the management of QoS in an SDN by performing multi-dimensional analysis of Key Performance Indicators (KPIs) and applying machine learning algorithms to discover new correlations, perform root cause analysis and predict traffic congestion. <s> BIB013 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Recently, Internet-based systems need to be changed their configuration dynamically. Traditional networks have very limited ability to cope up with such frequent changes and hinder innovations management and configuration procedures. To address this issue, Software Defined Networking (SDN) has been emerging as a new network architecture that allows for more flexibility through software-enabled network control. However, the dynamism of programmable networks also faces new security challenges that demand innovative solutions. Among the widespread mechanisms of SDN security control applications, anomaly-based IDS is an extremely effective technique in detecting both known and unknown (new) attack types. In this paper, we propose an anomaly-based Intrusion Detection architecture integrated on OpenFlow Switch. The proposed system can detect and prevent a network from many attack types, especially new attack types using anomaly detection. We implement the proposed system on the FPGA technology using a Xilinx Virtex-5 xc5vtx240t device. In this FPGA-based prototype, we integrate an anomaly-based intrusion detection technique to be able to defend against many attack types and anomalous on the network traffic. The experimental results show that our system achieves a detection rate exceeding 91.81% with a 0.55% false alarms rate at maximum. <s> BIB014 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> With the rapid growth of the Internet-of-Things (IoT), concerns about the security of IoT devices have become prominent. Several vendors are producing IP-connected devices for home and small office networks that often suffer from flawed security designs and implementations. They also tend to lack mechanisms for firmware updates or patches that can help eliminate security vulnerabilities. Securing networks where the presence of such vulnerable devices is given, requires a brownfield approach: applying necessary protection measures within the network so that potentially vulnerable devices can coexist without endangering the security of other devices in the same network. In this paper, we present IoT Sentinel, a system capable of automatically identifying the types of devices being connected to an IoT network and enabling enforcement of rules for constraining the communications of vulnerable devices so as to minimize damage resulting from their compromise. We show that IoT Sentinel is effective in identifying device types and has minimal performance overhead. <s> BIB015 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software Defined Networks (SDNs) provides a separation between the control plane and the forwarding plane of networks. The software implementation of the control plane and the built in data collection mechanisms of the OpenFlow protocol promise to be excellent tools to implement Machine Learning (ML) network control applications. A first step in that direction is to understand the type of data that can be collected in SDNs and how information can be learned from that data. In this work we describe a simple architecture deployed in an enterprise network that gathers traffic data using the OpenFlow protocol. We present the data-sets that can be obtained and show how several ML techniques can be applied to it for traffic classification. The results indicate that high accuracy classification can be obtained with the data-sets using supervised learning. <s> BIB016 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software Defined Networking (SDN) has recently emerged to become one of the promising solutions for the future Internet. With the logical centralization of controllers and a global network overview, SDN brings us a chance to strengthen our network security. However, SDN also brings us a dangerous increase in potential threats. In this paper, we apply a deep learning approach for flow-based anomaly detection in an SDN environment. We build a Deep Neural Network (DNN) model for an intrusion detection system and train the model with the NSL-KDD Dataset. In this work, we just use six basic features (that can be easily obtained in an SDN environment) taken from the forty-one features of NSL-KDD Dataset. Through experiments, we confirm that the deep learning approach shows strong potential to be used for flow-based anomaly detection in SDN environments. <s> BIB017 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> This paper is motivated by the emerging vision of an automated and data-driven optimization of communication networks, making it possible to fully exploit the flexibilities offered by modern network technologies and heralding an era of fast and self-adjusting networks. We build upon our recent study of machine-learning approaches to (statically) optimize resource allocations based on the data produced by network algorithms in the past. We take our study a crucial step further by considering dynamic scenarios: scenarios where communication patterns can change over time. In particular, we investigate network algorithms which learn from the traffic distribution (the feature vector), in order to predict global network allocations (a multi-label problem). As a case study, we consider a well-studied fc-median problem arising in Software-Defined Networks, and aim to imitate and speedup existing heuristics as well as to predict good initial solutions for local search algorithms. We compare different machine learning algorithms by simulation and find that neural network can provide the best abstraction, saving up to two-thirds of the algorithm runtime. <s> BIB018 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> In general, humans follow a routine with highly predictable daily movements. For instance, we commute from home to work on a daily basis and visit a selected set of places for commercial and recreational purposes during the nights and weekends. The use of mobile phones increases when commuting via public transportation, during lunch breaks, and at night. Such regular behavior creates predictable spatiotemporal fluctuations of traffic patterns. In this paper, we introduce a matheuristic for dynamic optical routing, which can be implemented as an application into a software-defined mobile carrier network. We use machine learning to predict tidal traffic variations in a mobile metro-core network, which allows us to solve off-line mixed-integer linear programming instances of an optical routing (and wavelength) assignment optimization problem. The optimal results are used to favor near-optimal on-line routing decisions. Results demonstrate the effectiveness of our on-line methodology, with results that match almost perfectly the behavior of a network that performs optical routing reconfiguration with a perfect, oracle-like traffic prediction and the solution of an optimization problem. <s> BIB019 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software-Defined Networks (SDN) is an emerging area that promises to change the way we design, build, and operate network architecture. It tends to shift from traditional network architecture of proprietary based to open and programmable network architecture. However, this new innovative and improved technology also brings another security burden into the network architecture, with existing and emerging security threats. The network vulnerability has become more open to intruders: the focus is now shifted to a single point of failure where the central controller is a prime target. Therefore, integration of intrusion detection system (IDS) into the SDN architecture is essential to provide a network with attack countermeasure. The work designed and developed a virtual testbed that simulates the processes of the real network environment, where a star topology is created with hosts and servers connected to the OpenFlow OVS-switch. Signature-based Snort IDS is deployed for traffic monitoring and attack detection, by mirroring the traffic destine to the servers. The vulnerability assessment shows possible attacks threat exist in the network architecture and effectively contain by Snort IDS except for the few which the suggestion is made for possible mitigation. In order to provide scalable threat detection in the architecture, a flow-based IDS model is developed. A flow-based anomaly detection is implemented with machine learning to overcome the limitation of signature-based IDS. The results show positive improvement for detection of almost all the possible attacks in SDN environment with our pattern recognition of neural network for machine learning using our trained model with over 97% accuracy. <s> BIB020 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software Networks built by combining Software Defined Networks (SDN), Network Function Virtualization (NFV) and Cloud principles call for agile and dynamic automation of management operations to ensure continuous provisioning and deployment of networked resources and services. In this context, efficient Service Level Agreements (SLA) management and anticipation of Service Level Objectives (SLO) breaches become essential to fulfill established service contracts with clients. In this paper, we design and specify a framework for cognitive SLA enforcement (using Artificial Neural Network learning) for networking services involving VNFs (Virtualized Network Functions) and SDN controllers. A proof of concept, a testbed description and an extensive evaluation assess the performance of the proposed framework. <s> BIB021 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Intrusion Detection Systems (IDS) are aimed at analyzing and detecting security problems. IDS based on anomaly detection and, in particular, on statistical analysis, inspect each traffic flow in order to get its statistical characterization, which represents the fingerprint of the flow. Software Defined Networking (SDN) is revolutionizing the networking industry by enabling programmability, easier management and faster innovation. These benefits are made possible by its centralized control plane architecture which allows the network to be programmed and controlled by one central entity. The fusion of these two technologies can lead to an innovative system of malware detection. This paper tries to join these two concepts in order to obtain the best from the two worlds. We use a well known machine learning scheme (Support Vector Machine) as core system for detecting malware by using only traffic features that can be extracted using an SDN controller. <s> BIB022 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Distributed Denial-of-Service (DDoS) flooding attack is one of the most serious threats to network security. Software-Defined Networking (SDN) has recently emerged as a new network management platform, and its centralized control architecture brings many new opportunities for defending against network attacks. In this paper, we propose FADM, an efficient and lightweight framework to detect and mitigate DDoS attacks in SDN. Firstly, the network traffic information is collected through the SDN controller and sFlow agents. Then an entropy-based method is used to measure network features, and the SVM classifier is applied to identify network anomalies. By adopting these methods together, the timeliness and accuracy of attack detection are effectively improved. To keep the major network functionality working, we propose an efficient attack mitigation mechanism based on the white-list and traffic migration. By introducing the mitigation agent to the network, attack traffic can be timely blocked while benign traffic can be forwarded as usual, which prevents the controller resources from being exhausted and ensures that legitimate users can access the network normally. The experimental results show that multiple DDoS attacks can be accurately detected and effectively mitigated by FADM, which enables the network to recover in a short time. <s> BIB023 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> The controller is a critical piece of the SDN architecture, where it is considered as the mastermind of SDN networks. Thus, its failure will cause a significant portion of the network to fail. Overload is one of the common causes of failure since the controller is frequently invoked by new flows. Even through SDN controllers are often replicated, the significant recovery time can be an overkill for the availability of the entire network. In order to overcome the problem of the overloaded controller failure in SDN, this paper proposes a novel controller offload solution for failure mitigation based on a prediction module that anticipates the presence of a harmful long-term load. In fact, the long-standing load would eventually overwhelm the controller leading to a possible failure. To predict whether the load in the controller is short-term or long-term load, we used three different classification algorithms: Support Vector Machine, k-Nearest Neighbors, and Naive Bayes. Our evaluation results demonstrate that Support Vector Machine algorithm is applicable for detecting the type of load with an accuracy of 97.93% in a real-time scenario. Besides, our scheme succeeded to offload the controller by switching between the reactive and proactive mode in response to the prediction module output. <s> BIB024 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Due to the centralized control, network-wide monitoring and flow-level scheduling of software-defined-networking (SDN), it can be utilized to achieve quality of service (QoS) for cloud applications and services, such as voice over IP, video conference, and online games. However, most existing approaches stay at the QoS framework design and test level, while few works focus on studying the basic QoS techniques supported by SDN. In this paper, we enable SDN with QoS guaranteed abilities, which could provide end-to-end QoS routing for each cloud user service. First of all, we implement an application identification technique on SDN controller to determine required QoS levels for each application type. Then, we implement a queue scheduling technique on SDN switch. It queues the application flows into different queues and schedules the flows out of the queues with different priorities. At last, we evaluate the effectiveness of the proposed SDN-based QoS technique through both theoretical and experimental analysis. Theoretical analysis shows that our methods can provide differentiated services for the application flows mapped to different QoS levels. Experiment results show that when the output interface has sufficiently available bandwidth, the delay can be reduced by 28% on average. In addition, for the application flow with the highest priority, our methods can reduce 99.99% delay and increase 90.17% throughput on average when the output interface utilization approaches to the maximum bandwidth limitation. <s> BIB025 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> This paper proposes an application-aware multipath flow routing framework that integrates Machine Learning Techniques (MLT) in Software Defined Networks (SDN). Applications generated by the devices are diverse in nature, for each application bandwidth and delay requirements vary. The flows in the network compete for a constrained resource such as bandwidth or low latency path, an intelligent flow routing algorithm becomes a natural demand. Better overall network performance could be achieved only if the network is capable of prioritizing the flows and assign resources based on their application specific requirement. Our proposed, AMPS controller is capable of prioritizing each of the flow using MLT, and assign a path based on its classified priority. AMPS controller supports routing flows through different path even if the flows are between the same pair of nodes. The path finding algorithm employs Yen-K-shortest path algorithm, also it supports scalable flow routing for a large volume of flows. We have implemented the flow routing algorithm in OpenvSwitch as a proof of concept. A significant improvement is observed in comparison to SDN with traditional routing techniques involving a large number of flows. The proposed flow routing algorithm ensures high availability of an unloaded path for high priority flows even in a heavily loaded network. <s> BIB026 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Current era of networking world witnesses an increase in the number of devices that have intelligent component embedded in them, which leads to an unmanageable state. This has lead to a steady shift towards using Open Software Defined Networks to reduce operational expenditure. The whole of the intelligence lies in the central controller which obviously is the single point of failure. The attackers find it easy to bring down the whole network by saturating the control plane of the SDN which eventually leads to denial-of-service (DoS) to the data plane, through host location hijacking attack. The various strategies proposed to defend the SDN controller from host location hijack attack includes authentication of host which incurs overhead. In this paper we propose SLAMHHA, a Supervised Learning Approach to Mitigate Host location Hijacking Attack. SLAMHHA is implemented in the SDN controller which monitors the legitimacy of the hosts and identifies the clandestine users impersonating the hosts in the data plane. The SLAMHHA algorithm can be implemented in either of the two SDN controller setup (i.e.) in both centralized and decentralized controller setup, been used to set the flow rules and monitor the underlying network. MININET has been used to test the efficiency of the SLAMHHA algorithm. SLAMHHA algorithm was implemented in the POX controller. Numerical results show that SLAMHHA incurs less overhead in terms of CPU and memory consumption when compared to the authentication method. This algorithm blocks the attack within 3 seconds when 100 hosts are impersonated to perform DoS attack. Thus our proposed SLAMHHA algorithm mitigates the host location hijacking attack with less overhead. <s> BIB027 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Abstract The decision-tree based packet-classification algorithm field has seen many contributions since the first algorithm using a geometrical rule representation, HiCuts, has been proposed. While hardware reported implementations for this class of algorithms have proven that a high throughput can be reached, those algorithms are inherently facing a tradeoff between speed and memory consumption. This paper presents two extensions applicable to decision-tree based algorithms designed to tackle two of their common drawbacks. Applied together, they achieve a reduction of the number of memory accesses, while reducing the data structure size. The first contribution consists of a new rule-clustering method aimed for the reduction of the number of trees built. The second contribution relies on a leaf compression method that allows tackling the problem that stems from linear leaf traversal. Applied together, as shown by simulations, those two new methods improve the trade-off between search-time complexity and data structure size. These strategies provide gains in many contexts, although they are tailored for handling complex rule sets used in the context of Software Defined Networking. For sets of 100,000 and 10,000 rules, those two strategies reduce the number of memory accesses by a factor of 3 on average, while decreasing the size of the data structure by about 45% over EffiCuts, a well-known decision-tree based algorithm. <s> BIB028 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software defined networking (SDN) provides flexible management for datacenter networks with the flow-level control. Such the fine-grained management, however, consumes large amount of bandwidth between data and control planes, which results in the bottleneck in the scalability of SDN-based datacenters. "The elephant and mouse phenomenon" suggests that there are only very few elephant flows that carry the majority of bytes in datacenters so that it can improve management efficiency to detect and reroute elephant flows while leaving mice flows in data plane leveraging wildcard flow table in OpenFlow. Unfortunately, existing mechanisms for elephant flow detection suffer from high bandwidth consumption and long detection time. In this paper, we propose an efficient sampling and classification approach (ESCA) with the two-phase elephant flow detection. In the first phase, ESCA improves sampling efficiency by estimating the arrival interval of elephant flows and filtering out redundant samples using a filtering flow table. In the second phase, ESCA classifies samples with a new supervised classification algorithm based on correlation among data flows. The mathematical analysis proofs our ESCA outperforms related schemes. Extensive experiment results on real public datacenter traces further demonstrate that our ESCA can provide accurate detection with less sampled packets and shorter detection time. <s> BIB029 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> We estimate end-to-end service metrics from network device statistics. Our approach is based upon statistical, supervised learning, whereby the mapping from device-level to service-level metrics is learned from observations, i.e., through monitoring the system. The approach enables end-to-end performance prediction without requiring an explicit model of the system, which is different from traditional engineering techniques that use stochastic modeling and simulation. The fact that end-to-end service metrics can be estimated from local network statistics with good accuracy in the scenarios we consider suggests that service-level properties are “encoded” in network-level statistics. We show that the set of network statistics needed for estimation can be reduced to a set of measurements along the network path between client and service backend, with little loss in estimation accuracy. The reported work is largely experimental and its results have been obtained through testbed measurements from a video streaming service and a KV store over an OpenFlow network . <s> BIB030 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software-Defined Networking (SDN) is an emerging network architecture that decouples the control plane and the data plane to provide unprecedented programmability, automation, and network control. The SDN controller exercises centralized control over network software, and in doing so, it can monitor and respond to malicious traffic for network protection. This paper proposes a threat-aware system based on machine-learning for timely detection and response against network intrusion in SDN. Our proposed system consists of data preprocessing for feature selection, predictive data modeling for machine-learning and anomaly detection, and decision making for intrusion response in SDN. Due to the time-critical nature of SDN, we propose a practical approach utilizing machine-learning techniques to protect against network intrusion and reduce uncertainty in decision-making outcomes. The maliciousness of most uncertain network traffic subsets is evaluated with selected significant feature sets. Our experimental results show that the proposed approach achieves high performance and significantly reduces uncertainty in the decision process with a small number of feature sets. The results help the SDN controller to properly react against known or unknown attacks that cannot be prevented by signature-based network intrusion detection systems. <s> BIB031 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Our work in this paper presents a prediction of quality of experience based on full reference parametric (SSIM, VQM) and application metrics (resolution, bit rate, frame rate) in SDN networks. First, we used DCR (Degradation Category Rating) as subjective method to build the training model and validation, this method is based on not only the quality of received video but also the original video but all subjective methods are too expensive, don't take place in real time and takes much time for example our method takes three hours to determine the average MOS (Mean Opinion Score). That's why we proposed novel method based on machine learning algorithms to obtain the quality of experience in an objective manner. Previous researches in this field help us to use four algorithms: Decision Tree (DT), Neural Network, K nearest neighbors KNN and Random Forest RF thanks to their efficiency. We have used two metrics recommended by VQEG group to assess the best algorithm: Pearson correlation coefficient r and Root-Mean-Square-Error RMSE. The last part of the paper describes environment based on: Weka to analyze ML algorithms, MSU tool to calculate SSIM and VQM and Mininet for the SDN simulation. <s> BIB032 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software-defined networks (SDN) are vulnerable to most of the attacks that traditional networks are vulnerable to. In addition, SDN has introduced new vulnerabilities through its unique architecture such as those related to the southbound and northbound controller interfaces. In this paper, we introduce a lightweight flow-based Intrusion Detection System (IDS) that periodically gathers statistical information about flows from SDN OpenFlow switches, and analyzes traffic information by extracting and aggregating a set of features. The proposed IDS system proved to be accurate with a high detection rate at 0.98 measured by the F1 score of the classification model and a relatively low false alarm rate. <s> BIB033 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Providing fine grained traffic measurement is crucial for many network management tasks such as traffic engineering, anomaly detection, traffic accounting, and load balancing. Software-defined networks can potentially enable fine-grained measurement by providing statistics for each forwarding rule of an OpenFlow-enabled switch. However, providing fine grained traffic measurement in a scalable fashion in hardware switches poses significant challenges due to the limitations in the size of the TCAMs that fit only a relatively small number of rules compared to the number of active flows in the network. In this paper, we present DeepFlow, a framework for scalable software-defined measurement that relies on an efficient mechanism that a) adaptively detect the most active source and destination prefixes in the network, b) collects fine-grained flow-size measurements for the most active prefixes and coarse grained for the less active ones, and c) uses historical measurements in order to train a cloud-based Deep Learning model that can be used to provide short-term predictions whenever exact flow counters cannot be placed at a switch due to its limited resources. Thus the number of fine-grained flows measured can increase significantly without the need to use other flow sampling solutions that loose accuracy. An extensive experimental evaluation using a prototype implementation and real network traces shows that DeepFlow can provide very high accuracy for estimating flow sizes at various aggregation levels. <s> BIB034 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> This paper introduces NeuRoute, a dynamic routing framework for Software Defined Networks (SDN) entirely based on machine learning, specifically, Neural Networks. Current SDN/OpenFlow controllers use a default routing based on Dijkstra algorithm for shortest paths, and provide APIs to develop custom routing applications. NeuRoute is a controller-agnostic dynamic routing framework that (i) predicts traffic matrix in real time, (ii) uses a neural network to learn traffic characteristics and (iii) generates forwarding rules accordingly to optimize the network throughput. NeuRoute achieves the same results as the most efficient dynamic routing heuristic but in much less execution time. <s> BIB035 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software-Defined Networking (SDN) is an emerging networking paradigm that provides an advanced programming capability and moves the control functionality to a centralized controller. This paper proposes a two-stage novel intelligent approach that takes advantage of the SDN approach to detect Denial of Service (DoS) flooding attacks based on calculation of packet rate as the first step and followed by Support Vector Machine (SVM) classification as the second step. Flow concept is an essential idea in OpenFlow protocol, which represents a common interface between an SDN switch and an SDN controller. Therefore, our system calculates the packet rate of each flow based on flow statistics obtained by SDN controller. Once the packet rate exceeds a predefined threshold, the system will activate the packet inspection unit, which, in turn, will use the (SVM) algorithm to classify the previously collected packets. The experimental results showed that our system was able to detect DoS flooding attacks with 96.25% accuracy and 0.26% false alarm rate. <s> BIB036 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Multimedia traffic has drastically grown in the last few years. In addition, some of the last paradigms proposed, like the Internet of Things (IoT), adds new types of traffic and applications. Software-defined networks (SDNs) improve the capability of network management. Combined with SDN, artificial intelligence (AI) can provide solutions to network problems based on classification and estimation techniques. In this paper, we propose an artificial intelligence system for detecting and correcting errors in multimedia transmission in a surveillance IoT environment connected through a SDN. The architecture, algorithm, and messages of the SDN are detailed. The AI system design is described, and the test-bed and the data set are explained. The AI module consists of two different parts. The first one is a classifying part, which detects the type of traffic that is sent through the network. The second part is an estimator that informs the SDN controller on which kind of action should be executed to guarantee the quality of service and quality of experience. Results show that with the actions performed by the network, like jitter can be reduced up to 70% of average and losses can be reduced from 9.07% to nearly 1.16%. Moreover, the presented AI module is able to detect critical traffic with 77% accuracy. <s> BIB037 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software-defined networking (SDN) is a new paradigm that allows developing more flexible network applications. SDN controller, which represents a centralized controlling point, is responsible for running various network applications as well as maintaining different network services and functionalities. Choosing an efficient intrusion detection system helps in reducing the overhead of the running controller and creates a more secure network. In this study, we investigate the performance of the well-known anomaly-based intrusion detection approaches in terms of accuracy, false alarm rate, precision, recall, f1-measure, area under ROC curve, execution time and Mc Nemar's test. Precisely, we focus on supervised machine-learning approaches where we use the following classifiers: Decision Trees (DT), Extreme Learning Machine (ELM), Naive Bayes (NB), Linear Discriminant Analysis (LDA), Neural Networks (NN), Support Vector Machines (SVM), Random Forest (RT), K Nearest-Neighbour (KNN), AdaBoost, RUSBoost, LogitBoost and BaggingTrees where we employ the well-known NSL-KDD benchmark dataset to compare the performance of each one of these classifiers. <s> BIB038 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Abstract While traditional networks depend on a fully distributed control plane, Software Defined Networks (SDNs), the rapidly emerging area in computer networking, utilize a centralized control plane. SDNs bring in many benefits such as fine-grained control, possibility of optimal routing, and resource management within the network. As a result, SDNs find wider deployments in certain segments of networking such as data center networks. In addition, SDN approach is a potential candidate for the control plane design in 5G networks. Despite the benefits, SDNs face certain issues such as the possibility of single point failure, the communication overhead between switches and controllers, and more importantly the security as well as trustability of the control plane. Due to the centralized nature of the control plane, it is important to detect the presence of compromised control plane in an SDN. Compromised control plane refers to the situation where one or more of the controllers in an SDN are compromised by malwares, resulting in deviation from the normal control plane behavior. Developing new solutions for detecting the presence of compromised controllers is exacerbated by the lack of appropriate SDN traffic data sets. As a result, existing literature lacks solutions to detect the presence of a compromised control plane. Of particular interest is the case where SDN controller-specific threats hide their presence from end-users and administrators of the network. Our contributions in this paper include the following: (i) identification of five threat vectors that represent compromised controllers in SDNs, (ii) creation of a large volume of OpenFlow traffic traces in order for studying various SDN threat vectors, (iii) proposal of nine novel OpenFlow-specific features that capture the above mentioned threat vectors, and (iv) study of machine-learning based detection technique for compromised control plane using six classifiers. The OpenFlow traffic trace data set, we created, is made available for the use of larger research community. We carried out detailed experimental studies that show the efficacy of our scheme in detecting the presence of compromised controllers. Our results indicate that Random Forest is the most suitable machine learning classifier that provides about 97% accuracy. <s> BIB039 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Security is one of the main concerns facing the development of new projects in networking and communications. Another challenge is to verify that a system is working exactly as specified. On the other hand, advances in Artificial Intelligence (AI) technology have opened up new markets and opportunities for progress in critical areas such as network resiliency, health, education, energy, economic inclusion, social welfare, and the environment. AI is expected to play an increasing role in defensive and offensive measures to provide a rapid response to react to the landscape of evolving threats. Software Defined Networking (SDN), being centralized by nature, provides a global view of the network. It is the flexibility and robustness offered by programmable networking that lead us to consider the integration of these two concepts, SDN and AI. Inspired by the fascinating tactics of the human immunity system, we aim to design a general hybrid Artificial Intelligence Resiliency System (ARS) that strikes a good balance between centralized and distributed security systems that may be applicable to different network environments. In addition, we aim to investigate and leverage the latest AI techniques to improve network performance in general and resiliency in particular. <s> BIB040 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software Defined Network separates the control plane from network equipment and has great advantage in network management as compared with traditional approaches. With this paradigm, the security issues persist to exist and could become even worse because of the flexibility on handling the packets. In this paper we propose an effective framework by integrating SDN and machine learning to detect and categorize P2P network traffics. This work provides experimental evidence showing that our approach can automatically analyze network traffic and flexibly change flow entries in OpenFlow switches through the SDN controller. This can effectively help the network administrators manage related security problems. <s> BIB041 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> Software Defined Networking (SDN) has emerged as a key enabler for future agile Internet architecture. Nevertheless, the flexibility provided by SDN architecture manifests several new design issues in terms of network security. These issues must be addressed in a unified way to strengthen overall network security for future SDN deployments. Consequently, in this paper, we propose a Gated Recurrent Unit Recurrent Neural Network (GRU-RNN) enabled intrusion detection systems for SDNs. The proposed approach is tested using the NSL-KDD dataset, and we achieve an accuracy of 89% with only six raw features. Our experiment results also show that the proposed GRU-RNN does not deteriorate the network performance. Through extensive experiments, we conclude that the proposed approach exhibits a strong potential for intrusion detection in the SDN environments. <s> BIB042 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> This paper presents NeuTM, a framework for network Traffic Matrix (TM) prediction based on Long Short-Term Memory Recurrent Neural Networks (LSTM RNNs). TM prediction is defined as the problem of estimating future network traffic matrix from the previous and achieved network traffic data. It is widely used in network planning, resource management and network security. Long Short-Term Memory (LSTM) is a specific recurrent neural network (RNN) architecture that is well-suited to learn from data and classify or predict time series with time lags of unknown size. LSTMs have been shown to model long-range dependencies more accurately than conventional RNNs. NeuTM is a LSTM RNN-based framework for predicting TM in large networks. By validating our framework on real-world data from GEEANT network, we show that our model converges quickly and gives state of the art TM prediction performance. <s> BIB043 </s> Artificial Intelligence Enabled Software Defined Networking: A Comprehensive Overview <s> Supervised learning in SDN <s> In recent years, software defined networking (SDN) has become a novel network architecture and design by employing manageable software between the control and data planes. Many SDN-based intrusion detection systems (IDS) have been proposed in recent researches. On the other hand, deep learning has emerged as an explosive growth in research and industry. The application of deep learning on IDS has been studied in many security-critical scenarios. However, some reports has indicated the vulnerability of adversarial attacks on deep learning IDS system with intentional perturbation injection or manipulation. It is important for the empowered IDS system employing deep learning to be responsible for not leading misclassification. Therefore, exploring the impact on the adversarial attacks over SDN networks or security-critical scenarios applying deep learning is an important step to confront such urgent issues. In this paper, we will conduct the SDN-based experiments on adversarial attacks for deep learning detecting system. We propose a novel class of adversarial attacks that exploits the vulnerability of the deep learning classifiers in SDN environment. Three typical deep learning models combining with four different adversarial testing will be conducted in the simulation for complete analysis. <s> BIB044
In this context, neural networks BIB004 BIB018 BIB019 BIB020 BIB005 BIB006  BIB021 BIB007 BIB001 , support vector machine BIB007 BIB001 BIB002 BIB008 BIB009 BIB022 BIB010  BIB023 , decision trees BIB036 BIB037 BIB024 BIB025 BIB026 BIB003 BIB027   BIB011 BIB012 BIB028 BIB029 BIB013 BIB014 , ensemble methods  BIB038 BIB030 BIB031 BIB015 BIB032 BIB016  BIB033 BIB039 BIB040 BIB041 and supervised deep learning BIB042 BIB017 BIB034 BIB035 BIB043 BIB044 approaches were the most used supervised learning techniques in SDN.