0% found this document useful (0 votes)

47 views

A Survey of Machine Learning Techniques Applied To Software Defined Networking (SDN) : Research Issues and Challenges

This document surveys the application of machine learning techniques to software defined networking (SDN). It introduces related work and machine learning algorithms, and reviews how machine learning has been applied in SDN for traffic classification, routing optimization, quality of service prediction, resource management, and security.

Uploaded by

zed

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

47 views

A Survey of Machine Learning Techniques Applied To Software Defined Networking (SDN) : Research Issues and Challenges

Uploaded by

zed

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 39

This article has been accepted for publication in a future issue of this journal, but has not been

fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/COMST.2018.2866942, IEEE
Communications Surveys & Tutorials

A Survey of Machine Learning Techniques Applied

to Software Defined Networking (SDN): Research
Issues and Challenges
Junfeng Xie∗ , F. Richard Yu† , Tao Huang∗ , Renchao Xie∗ , Jiang Liu∗ , Chenmeng Wang‡ , and Yunjie Liu∗
∗ State Key Laboratory of Networking and Switching Technology

Beijing University of Posts and Telecommunications, Beijing 100876, P.R. China

† Dept. of Systems and Computer Eng., Carleton University, Ottawa, ON, Canada
‡ Chongqing Key Lab of Mobile Communications Technology

Chongqing University of Posts and Telecommunications, Chongqing 400065, P.R. China

Abstract—In recent years, with the rapid development of heterogeneous network infrastructure increases the complexity
current Internet and mobile communication technologies, the of networks and poses a number of challenges in effectively
infrastructure, devices and resources in networking systems are organizing, managing and optimizing network resources.
becoming more complex and heterogeneous. In order to efficiently
organize, manage, maintain and optimize networking systems, Deploying more intelligence in networks is one possible
more intelligence needs to be deployed. However, due to the way to solve these issues. A few years ago, a Knowledge Plane
inherently distributed feature of traditional networks, machine (KP) approach [1] has been proposed to bring automation,
learning techniques are hard to be applied and deployed to recommendation and intelligence to the Internet, by applying
control and operate networks. Software Defined Networking Machine Learning (ML) and cognitive techniques. However,
(SDN) brings us new chances to provide intelligence inside the
networks. The capabilities of SDN (e.g., logically centralized con- at the time of this writing, the KP has not been prototyped
trol, global view of the network, software-based traffic analysis, or deployed. One of the major reasons is the inherently
and dynamic updating of forwarding rules) make it easier to distributed feature of traditional network systems, where each
apply machine learning techniques. In this paper, we provide node, such as router or switch, can only view and act over
a comprehensive survey on the literature involving machine a small portion of the system. Learning from nodes that
learning algorithms applied to SDN. First, the related works
and background knowledge are introduced. Then, we present have only a small partial view of the complete system to
an overview of machine learning algorithms. In addition, we perform control beyond the local domain is very complex [2].
review how machine learning algorithms are applied in the realm Fortunately, recent advances in Software Defined Networking
of SDN, from the perspective of traffic classification, routing (SDN) will ease the complexity of learning.
optimization, Quality of Service (QoS)/Quality of Experience SDN decouples the control plane and the data plane. The
(QoE) prediction, resource management and security. Finally,
challenges and broader perspectives are discussed. network resources in SDN are managed by a logically cen-
tralized controller, which acts as the Networking Operating
Index Terms—Software defined networking, machine learning,
System (NOS). The SDN controller can program the network
traffic classification, resource management
dynamically. Furthermore, the centralized controller has a
global view of the network by monitoring and collecting the
I. I NTRODUCTION real-time network state and configuration data, as well as
Recently, with the rapid development of intelligent devices packet and flow-granularity information. Applying machine
(e.g., smart phones, smart cars and smart home devices) and learning techniques in SDN is suitable and efficient for the
network technologies (e.g., cloud computing and network vir- following reasons. First, recent advances in computing tech-
tualization), data traffic in our world is growing exponentially. nologies such as Graphics Processing Unit (GPU) and Tensor
In order to optimize the traffic distribution and manage a large Processing Unit (TPU) provide a good opportunity to apply
number of devices, networks are becoming more heteroge- promising machine learning techniques (e.g., deep neural net-
neous and complex. A production network usually involves works) in the network field [3], [4]. Second, data is the key to
a multitude of devices, runs a multitude of protocols, and the data-driven machine learning algorithms. The centralized
supports a multitude of applications. For example, in wireless SDN controller has a global network view, and is able to
networks, various types of cells with different transmission collect various network data, which facilitate the applications
coverage, power and working mechanisms (e.g., macro-cells, of machine learning algorithms. Third, based on the real-time
pico-cells, femto-cells, Relays, and RRHs), and different com- and historical network data, machine learning techniques can
munication technologies, such as ZigBee, WiMAX, IEEE bring intelligence to the SDN controller by performing data
802.11 ac/ad, Bluetooth and LTE, have been applied. The analysis, network optimization, and automated provision of
network services. Finally, the programmability of SDN enables
This work is jointly supported by the National Natural Science Foundation
of China (No. 61501042), the Fundamental Research Funds for the Central that the optimal network solutions (e.g., configuration and
Universities. (Corresponding author: Tao Huang.) resource allocation) made by machine learning algorithms can

1553-877X (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/COMST.2018.2866942, IEEE
Communications Surveys & Tutorials

be executed on the network in real time [5]. networks. Chen et al. [16] have studied the neural networks-
In this article, we survey the state-of-the-art machine learn- based solutions to solve problems in wireless networks such
ing techniques that can be developed and applied in SDN. Re- as communication, virtual reality and edge caching. Usama
search on adopting machine learning techniques to improve the et al. [4] have studied how to apply unsupervised learning
performance, smartness, efficiency and security of SDN will techniques in the domain of networking.
be discussed, followed by a brief introduction and summary Although machine learning techniques have been applied in
of future research directions in related areas with proper depth various domains, no existing works focus on the applications
and sufficient breadth. A road map of our approach is given of machine learning in the domain of SDN. To fill this
in Fig. 1. As shown in the figure, we identify five aspects gap, in this paper, we provide a comprehensive survey of
of the ML-based SDN, on which we would like to focus: machine learning techniques applied to SDN. We hope that
background knowledge, overview, machine learning in SDN, our discussion and exploration can give readers an overall
challenges and broader perspectives. understanding of this field and foster more subsequent studies
The rest of the article is organized as follows. First, related on this issue. In Table I, we provide a brief comparison of our
works are presented in Section II. Then, background knowl- paper with existing survey papers discussed above.
edge of SDN is briefly introduced in Section III. In Section
IV, we give a brief explanation of the most widely-used ML III. BACKGROUND K NOWLEDGE OF SDN
algorithms in SDN. Section V reviews how ML algorithms In this section, we present a brief background knowledge
are applied in the realm of SDN, from the perspective of of SDN from the perspectives of architecture and workflow of
traffic classification, routing optimization, Quality of Service SDN.
(QoS)/Quality of Experience (QoE) prediction, resource man-
agement and security, and provides a detailed explanation of
how machine learning efforts can be applied within each cat- A. Architecture of SDN
egory. Challenges and future research directions are discussed SDN has attracted widespread attention in recent years.
in Section VI, including high-quality training datasets, dis- The Open Networking Foundation (ONF) [17] is a nonprofit
tributed multi-controller platform, improving network security, consortium dedicated to the development, standardization,
cross-layer network optimization, and incrementally deployed and commercialization of SDN. The ONF gives a definition
SDN. In Section VII, we present some broader perspectives, of SDN as follows: “In the SDN architecture, the control
such as software defined edge computing, software defined plane and data plane are decoupled, network intelligence and
vehicular networks, software defined mobile networks, etc. state are logically centralized, and the underlying network
Finally, we conclude this study in Section VIII. infrastructure is abstracted from the applications” [18].
Based on the definition, a high-level SDN architecture is
presented, which is composed of three main planes, including
II. R ELATED WORK
data plane, control plane and application plane. The archi-
The applications of machine learning have attracted a lot of tectural components of each plane and their interactions are
attention. Patcha et al. [6] have given a detailed description shown in Fig. 2. In the following, we will give a detailed
of the applications of machine learning techniques in the representation of these three planes and their interactions.
domain of intrusion detection. Nguyen et al. [7] focus on 1) Data Plane: The data plane, also known as infrastructure
IP traffic classification by using machine learning. Bkassiny plane, is the lowest layer in SDN architecture. This plane is
et al. [8] have studied several challenging learning problems comprised of forwarding devices including physical switches
in Cognitive Radio Networks (CRNs), and surveyed existing and virtual switches. Virtual switches are software-based
ML-based methods to address them. How ML techniques switches, which can run on common operating systems such
can be applied to address common issues in wireless sensor as Linux. Open vSwitch [19], Indigo [20] and Pantou [21] are
networks has been surveyed in [9]. Wang et al. [10] have three implementations of virtual switches. Physical switches
presented the state-of-the-art Artificial Intelligence (AI)-based are hardware-based switches. There are two types of physical
techniques applied to evolve the heterogeneous networks, and switches, one is implemented on open network hardware
discussed future research challenges. Buczak et al. [11] have (e.g., NetFPGA [22]) and the other is implemented on net-
researched on ML and Data Mining (DM) methods for cyber working hardware vendors’ merchant switches. SwitchBlade
security intrusion detection. Klaine et al. [12] have surveyed [23] and ServerSwitch [24] are two NetFPGA-based physical
the machine learning algorithms and their solutions in self switches. Nowadays, many networking hardware vendors such
organizing cellular networks, and given valuable classification as HP, NEC, Huawei, Juniper and Cisco, have supported
and comparison. How to apply machine learning techniques to SDN protocols in their merchant switches. Virtual switches
improve the network traffic control has been surveyed in [13]. typically support complete features of SDN protocols, while
Similar to [6], Hodo et al. [14] also focus on ML-based In- physical switches lack the flexibility and feature completeness.
trusion Detection System (IDS). The main difference between However, physical switches generally have a higher flow
[6] and [14] is that deep learning-based IDS has also been forwarding rate than virtual switches.
described detailedly in [14]. Zhou et al. [15] focus on using These switches in data plane are responsible for forwarding,
machine learning techniques and cognitive radio technology to dropping and modifying packets based on policies received
enhance spectrum utilization and energy efficiency of wireless from the Control Plane (CP). They communicate with CP

Ⅲ. Background Knowledge of
SDN Ⅳ. Overview of Machine
Learning Algorithms
Architecture of SDN
Supervised Learning
Data Plane
Unsupervised Learning
Control Plane
Application Plane Semi-supervised Learning

Workflow of SDN Reinforcement Learning

ML-based SDN

Ⅴ. Machine Learning in Ⅶ. Broader Perspectives

SDN Ⅵ. Challenges and Future
Research Directions Software Defined Network Function
Traffic Classification Virtualization
High-quality Training Datasets
Routing Optimization Software Defined Edge Computing
Distributed Multi-controller
QoS/QoE Prediction Platform Software Defined Optical Networks
Resource Management Improving Network Security Software Defined Internet of Things
Security Cross-layer Network Software Defined Vehicular
Optimization Networks
Incrementally Deployed SDN Software Defined Mobile Networks
Software Defined Wireless Sensor
Networks

Fig. 1. Road map of ML-based SDN.

through Southbound Interfaces (SBIs), with which the CP can vices to exchange network state information and control
control the data plane’s processing and forwarding capabilities. policies with the CP and provide functions such as pro-
2) Control Plane: The control plane is the “brain” of SDN grammatic control of all device-capability advertisements,
systems, which can program network resources, update for- forwarding operations, event notifications and statistics
warding rules dynamically, and make network administration reports. To date, OpenFlow [31] promoted by ONF is
flexible and agile. The main component of CP is the logically the first and the most popular open standard SBI, but
centralized controller, which controls the communication be- it is not the only one. There exist other less popular
tween forwarding devices and applications. On one hand, the proposals such as OVSDB [32], ForCES [33], Protocol-
controller exposes and abstracts network state information of Oblivious Forwarding (POF) [34], NETCONF [35], LISP
the data plane to the application plane. On the other hand, the [36], OpFlex [37] and OpenState [38].
controller translates the requirements from applications into • The Northbound Interfaces (NBIs) are defined between
custom policies and distributes them to forwarding devices. the control plane and the application plane. Using NBIs,
Additionally, the controller provides essential functionalities applications can exploit the abstract network views pro-
that most of network applications need, such as shortest vided by the CP to express network behaviors and
path routing, network topology storage, device configuration requirements, and facilitate automation, innovation and
and state information notifications etc. There are many con- management of SDN networks. The ONF is trying to
troller architectures, such as NOX [25], POX [26], Floodlight define the standard NBIs and a common information
[27], Ryu [28], OpenDayLight [29] and Beacon [30]. Three model [39].
communication interfaces allow the controllers to interact: • The eastbound/westbound interfaces are used in the
southbound, northbound and eastbound/westbound interfaces. multi-controller SDN networks. When deploying SDN
in large-scale networks where a vast amount of data
• The SBIs are also named as Control-Data-Plane Inter- flows need to be processed, due to the limited processing
faces (CDPIs), which are defined between the control capacity of one controller, the large-scale networks are
plane and the data plane. They allow forwarding de-

TABLE I
A BRIEF COMPARISON OF OUR PAPER WITH EXISTING SURVEY PAPERS .

Ref. Published in Year Areas focused ML techniques

Network intrusion detec- Supervised and unsupervised learning
Patcha et al. [6] Computer networks 2007
tion
Internet traffic classifica- Supervised and unsupervised learning
Nguyen et al. [7] IEEE COMST 2008
tion
Supervised, unsupervised and reinforcement
Bkassiny et al. [8] IEEE COMST 2013 Cognitive radio networks learning

Supervised, unsupervised and reinforcement

Alsheikh et al. [9] IEEE COMST 2014 Wireless sensor networks learning

AI-based techniques
Wang et al. [10] IEEE Access 2015 Heterogeneous networks
Cyber security intrusion Supervised and unsupervised learning
Buczak et al. [11] IEEE COMST 2016
detection
Supervised, unsupervised and reinforcement
Self organizing cellular
Klaine et al. [12] IEEE COMST 2017 learning
networks
Deep learning
Fadlullah et al. [13] IEEE COMST 2017 Network traffic control
Network intrusion detec- Supervised and unsupervised learning
Hodo et al. [14] ArXiv 2017
tion
Supervised, unsupervised and reinforcement
Zhou et al. [15] ArXiv 2017 Wireless networks learning

Neural networks
Chen et al. [16] ArXiv 2017 Wireless networks
Unsupervised learning
Usama et al. [4] ArXiv 2017 Networking
Supervised, unsupervised and reinforcement
This paper - 2018 SDN learning

always partitioned into several domains. Each domain tributed Denial of Service (DDoS) attacks in SDN-based cloud
has its own controller. In order to provide a global computing systems, and discussed future research challenges.
network view to the upper-layer applications, the com- Fault management in SDN has been surveyed in [52], which
munication among multiple controllers is necessary to gives an identification and classification of the main fault
exchange information. The eastbound/westbound inter- management issues, and does valuable surveys and discussions
faces are responsible for the communication. Onix [40] about efforts that address those issues. Guck et al. [53] have
and HyperFlow [41] are two distributed control archi- studied the centralized QoS routing mechanisms in SDN,
tectures. Because their eastbound/westbound interfaces and introduced a novel Four-Dimensional (4D) evaluation
are private, they cannot communicate with each other. framework.
To enable the communication between different types of Due to the inherent advantages (e.g., logically centralized
SDN controllers, SDNi [42], East-West Bridge [43] and control, global view of the network, software-based traffic
Communication Interface for Distributed Control plane analysis, and dynamic updating of forwarding rules), SDN has
(CIDC) [44] have been proposed as eastbound/westbound been deployed in many networks, such as transport networks
interfaces to exchange network information. However, [54], optical networks [55], wireless networks [56], [57],
to the best of our knowledge, the eastbound/westbound Internet of Things (IoT) [58], edge computing [59], Wide
interfaces have not yet been standardized. Area Networks (WAN) [60], cloud computing [61], Network
3) Application Plane: The highest layer in the SDN archi- Function Virtualization (NFV) [62], [63].
tecture is the application plane, which is composed of business For a more insightful discussion on SDN, please refer to
applications. These applications can provide new services and [64]–[71].
perform business management and optimization. In general,
the applications can obtain the required network state in- B. Workflow of SDN
formation through controllers’ NBIs. Based on the received To understand the SDN architecture, it is important to recall
information and business requirements, the applications can its basic operation. Fig. 3 shows the working procedure of the
implement the control logic to change network behaviors. OpenFlow-based SDN network [72]. Each OpenFlow switch
The SDN-based applications have attracted a lot of attention has a flow table and uses the OpenFlow protocol to com-
from academia. Mendiola et al. [45] have discussed the impact municate with the SDN controller. The messages transmitted
of SDN on Traffic Engineering (TE) and surveyed the SDN- between the OpenFlow-based switches and the software-based
based TE solutions. Security in SDN has been surveyed in controller are standardized by the OpenFlow protocol [31].
[46]–[51]. Especially, Yan et al. [50] have researched on Dis- The flow table in the OpenFlow switch is comprised of flow

Network Virtualization Mobility Management Security Application

Application
Plane
Cloud Computing Network Monitoring Business Applications

Northbound
Interface (NBI)

OpenDayLight Floodlight OpenDayLight Floodlight

Control Plane Beacon Ryu Beacon Ryu

Eastbound and
Westbound
NOX POX NOX POX
Interface

Southbound
Interface (SBI)

Infrastructure
or Data Plane

Physical Switches
Virtual Switches

Fig. 2. The general SDN architecture. The data plane consists of physical and virtual forwarding devices. The southbound interface connects the data plane and
the control plane. The control plane is the “brain” of SDN architecture. The eastbound/westbound interface enables communication among multiple controllers.
The northbound interface connects the control plane and the application plane. The application plane is composed of SDN-based business applications.

entries to determine the processing actions of different packets Machine learning algorithms are basically distinguished into
on the data plane. When an OpenFlow switch receives a packet four categories: supervised, unsupervised, semi-supervised and
on the data plane, the packet header fields will be extracted and reinforcement learning, which are shown in Fig. 5. In this
matched against flow entries. If a matching entry is found, the section, many widely-used machine learning algorithms are
switch will process the packet locally according to the actions introduced. Each algorithm is briefly explained with some ex-
in matched flow entry. Otherwise, the switch will forward an amples. For a more insightful discussion on machine learning
OpenFlow PacketIn message to the controller (arrows 2 and 5). theory and its classical concepts, please refer to [73]–[76].
The packet header (or the whole packet, optionally) is included
in the OpenFlow PacketIn message. Then, the controller will A. Supervised Learning
send OpenFlow FlowMod messages to manage the switch’s
flow table by adding flow entries (arrows 3 and 6), which can Supervised learning is a kind of labelling learning technique.
be used to process subsequent packets of the flow. Supervised learning algorithms are given a labeled training
dataset (i.e., inputs and known outputs) to build the system
model representing the learned relation between the input and
IV. OVERVIEW OF M ACHINE L EARNING A LGORITHMS output. After training, when a new input is fed into the system,
Machine learning is evolved from a collection of powerful the trained model can be used to get the expected output [77],
techniques in AI areas and has been extensively used in data [78]. In the following, we will give a detailed representation of
mining, which allows the system to learn the useful structural widely-used supervised learning algorithms, such as k-nearest
patterns and models from training data. neighbor, decision tree, random forest, neural network, support
A machine learning approach usually consists of two main vector machine, Bayes’ theory, and hidden markov models.
phases: training phase and decision making phase as illustrated 1) k-Nearest Neighbor (k-NN): The k-NN is a supervised
in the Fig. 4. At the training phase, machine learning methods learning technique, where the classification of a data sample
are applied to learn the system model using the training is determined based on the k nearest neighbors of that un-
dataset. At the decision making phase, the system can obtain classified sample. The process of the k-NN algorithm is very
the estimated output for each new input by using the trained simple: if the most of the k nearest neighbors belong to a
model. certain class, the unclassified sample will be classified into that

Flow Table for SW2

Flow Table for SW1
Rule Action Stats
Rule Action Stats
Entry1 src_ip=192.168.100.3 drop …
inport=P1,
Entry1 output(P3) …
dst_ip=192.168.100.3
… … … …
… … … …

OpenFlow Controller Flow Table for SW2 after the

communication with Controller
Flow Table for SW1 after the
communication with Controller Rule Action Stats

Rule Action Stats Entry1 src_ip=192.168.100.3 drop …

inport=P1, src_ip=192.168.100.1,
Entry1 output(P3) … Entry2 output(P2) …
dst_ip=192.168.100.3 dst_ip=192.168.100.2
inport=P1, src_ip=192.168.100.2,
Entry2 output(P2) … (2) Entry3 output(P1) …
dst_ip=192.168.100.2 dst_ip=192.168.100.1
inport=P2, (3) (5) (6)
Entry3 output(P1) … … … … …
dst_ip=192.168.100.1
… … … …
P2 (4) P1 P2 (7)
P1
(1)
P3 (9) (8)
(10) SW1 SW2
192.168.100.2

192.168.100.1
Flow Table for SW3

Rule Action Stats

inport=P1,
Entry1 output(P2) …
dst_ip=192.168.100.3
OpenFlow Message … … … …
P1
Data Packet P2

SW3

192.168.100.3

Fig. 3. OpenFlow-based SDN network. The OpenFlow controller can manage the traffic forwarding by modifying flow entries in switches’ flow tables. For
example, by adding two flow entries (i.e., Entry2 and Entry3) at SW1 and SW2, the communications between 192.168.100.1 and 192.168.100.2 are allowed.
However, packets from 192.168.100.3 to 192.168.100.2 are denied at SW2 due to security policies.

and its neighbors, such as Chebyshev, City-block, Euclidean

Training dataset
and Euclidean squared. For a more insightful discussion on
Training input set k-NN, please refer to [79].
Training output set
2) Decision Tree (DT): The DT is one of the classification
techniques which performs classification through a learning
Training phase tree. In the tree, each node represents a feature (attribute) of
Machine learning methods
a data, all branches represent the conjunctions of features that
lead to classifications, and each leaf node is a class label. The
unlabeled sample can be classified by comparing its feature
Decision making phase values with the nodes of the decision tree [80], [81]. The DT
Estimated
Trained model
output has many advantages, such as intuitive knowledge expression,
simple implementation and high classification accuracy. ID3
[82], C4.5 [83] and CART [84] are three widely-used deci-
sion tree algorithms to perform the classification of training
New input
dataset automatically. The biggest difference among them is
the splitting criteria which are used to build decision trees. The
Fig. 4. The general processing procedure of a machine learning approach.
splitting criteria used by ID3, C4.5 and CART are Information
gain, Gain ratio and Gini impurity respectively. Ref. [85] gives
a detailed comparison of the three DT algorithms.
class. Fig. 6 shows a simple example of how k-NN algorithm 3) Random Forest: The random forest method [86], also
works. Specially, when k = 1, it becomes the nearest neighbor known as random decision forest, can be used for classifica-
algorithm. The higher the value of k is, the less effect the tion and regression tasks. A random forest consists of many
noise will have on the classification. Since the distance is the decision trees. To mitigate over-fitting of decision tree method
main metric of the k-NN algorithm, several functions can be and improve accuracy, the random forest method randomly
applied to define the distance between the unlabeled sample chooses only a subset of the feature space to construct each

Machine learning techniques

Wij(1) Wij(2)
Supervised learning X1 a1(2) Y1
k-nearest neighbour

Decision tree X2 a2(2) Y2

Random forest
. . .
. . .
Neural network . . .
Support vector machine
Xm ak(2) Yn
Bayes’ theory
Input Layer Hidden Layer Output Layer
Hidden markov model

Unsupervised learning
Fig. 7. A basic neural network with three layers: an input layer, a hidden
layer and an output layer. An input has m features (i.e., X1 , X2 , . . . , Xm )
k-means
and the input can be assigned to n possible classes (i.e., Y1 , Y2 , . . . , Yn ).
Also, Wijl denotes the variable link weight between the ith neuron of layer l
Self-organizing map
and the jth neuron of layer l + 1, and alk denotes the activation function of
the kth neuron in layer l.
Semi-supervised learning

Reinforcement learning
units, which operate in parallel to learn experiential knowledge
Reinforcement learning from historical data [87]. The concept of neural networks is
inspired by the human brain, which uses basic components,
Deep reinforcement learning known as neurons to perform highly complex, nonlinear and
parallel computations. In a NN, its nodes are the equivalent
RL-based game theory
components of the neurons in the human brain. These nodes
use activation functions to perform nonlinear computations.
Fig. 5. Common machine learning algorithms applied to SDN. The most frequently used activation functions are the sigmoid
and the hyperbolic tangent functions [88]. Simulating the way
neurons are connected in the human brain, the nodes in a NN
are connected to each other by variable link weights.
A
A NN has many layers. The first layer is the input layer and
A the last layer is the output layer. Layers between the input
layer and the output layer are hidden layers. The output of
each layer is the input of the next layer and the output of
A A the last layer is the result. By changing the number of hidden
B
B layers and the number of nodes in each layer, complex models
can be trained to improve the performance of NNs. NNs are
B ?
B widely used in many applications, such as pattern recognition.
A The most basic NN has three layers, including an input layer,
B a hidden layer and an output layer, which is shown in Fig. 7.
B There are many types of neural networks, which are often
divided into two training types, supervised or unsupervised
[89]. In the following, we will give a detailed representation
of supervised neural networks which have been applied in the
Fig. 6. Example of k-NN algorithm, for k = 5. Among the five closest
neighbors, one neighbor belongs to class A and four neighbors belong to
field of SDN. In Subsection IV-B2, self-organizing map, a
class B. In this case, the unlabeled example will be classified into class B. representative type of unsupervised neural networks, will be
described.
a) Random NN: The random NN can be represented as
decision tree. The steps to classify a new data sample by using an interconnected network of neurons which exchange spiking
random forest method are: (a) put the data sample to each tree signals. The main difference between random NN and other
in the forest. (b) Each tree gives a classification result, which neural networks is that neurons in random NN exchange
is the tree’s “vote”. (c) The data sample will be classified into excitatory and inhibitory spiking signals probabilistically. In
the class which has the most votes. random NN, the internal excitatory state of each neuron
4) Neural Network (NN): A neural network is a computing is represented by an integer, which is called “potential”.
system made up of a large number of simple processing The potential value of each neuron rises when it receives

Output Output H1

Y Yt-1 Yt Yt+1
X2
H2 (Optimal hyperplane )
V W Unroll V V V
ht-1 ht ht+1
h
W W W W
RNN RNN RNN RNN
H3
U U U U

X Xt-1 Xt Xt+1 support vectors

margin
Input Input

Fig. 8. A typical recurrent NN and its unrolled form. Xt is the input at time
step t. ht is the hidden state at time step t. Yt is the output at time step t.
U , V and W are parameters in the recurrent NN.
X1

an excitatory spiking signal and drops when it receives an

Fig. 9. An example of SVM classifier with an optimal linear hyperplane.
inhibitory spiking signal. Neurons whose potential values are There are two classes in the figure, and each class has one support vector. As
strictly positive are allowed to send out excitatory or inhibitory it can be seen, there are many possible separating hyperplanes between two
spiking signals to other neurons according to specific neuron- classes, such as H1 , H2 and H3 , but only one optimal separating hyperplane
(i.e., H2 ) can maximize the margin.
dependent spiking rates. When a neuron sends out a spiking
signal, its potential value drops one. The random NN has been
used in classification and pattern recognition [90]. For a more form are shown in Fig. 8. Xt is the input at time step t. ht is
insightful discussion on random NN, please refer to [90]–[92]. the hidden state at time step t. ht captures information about
b) Deep NN: Neural networks with a single hidden layer what happened in all the previous time steps, so it is called
are generally referred to as shallow NNs. In contrast, neural “memory”. Yt is the output at time step t. U , V and W are
networks with multiple hidden layers between the input layer parameters in the recurrent NN. Unlike a traditional deep NN,
and the output layer are called deep NNs [93]–[95]. For a long which uses different parameters at each layer, the recurrent
time, shallow NNs are often used. To process high-dimensional NN shares the same parameters (i.e., U , V and W ) across all
data and to learn increasingly complex models, deep NNs time steps. This means that at each time step, the recurrent NN
with more hidden layers and neurons are needed. However, performs the same task, just with different inputs. In this way,
deep NNs increase the training difficulties and require more the total number of parameters needed to be trained is reduced
computing resources. In recent years, the development of greatly. Long Short-Term Memory (LSTM) [101], [102] is the
hardware data processing capabilities (e.g., GPU and TPU) and most commonly-used type of recurrent NNs, which has a good
the evolved activation functions (e.g., ReLU) make it possible ability to capture long-term dependencies. LSTM uses three
to train deep NNs [96]. In deep NNs, each layer’s neurons train gates (i.e., an input gate, an output gate and a forget gate) to
a feature representation based on the previous layer’s output, compute the hidden state.
which is known as feature hierarchy. The feature hierarchy 5) Support Vector Machine (SVM): SVM is another popular
makes deep NNs capable of handling large high-dimensional supervised learning method, invented by Vapnik and others
datasets. Due to the multiple-level feature representation learn- [103], which has been widely used in classification and pattern
ing, compared to other machine learning techniques, deep NNs recognition. The basic idea of SVM is to map the input
generally provide much better performance [96]. vectors into a high-dimensional feature space. This mapping
c) Convolutional NN: Convolutional NN and recurrent is achieved by applying different kernel functions, such as
NN are two major types of deep NNs. Convolutional NN [97], linear, polynomial and Radial Based Function (RBF). Kernel
[98] is a feed-forward neural network. Local sparse connec- function selection is an important task in SVM, which has
tions among successive layers, weight sharing and pooling are effect on the classification accuracy. The selection of kernel
three basic ideas of convolutional NN. Weight sharing means function depends on the training dataset. The linear kernel
that weight parameters of all neurons in the same convolution function works well if the dataset is linearly separable. If the
kernel are same. Local sparse connections and weight sharing dataset is not linearly separable, polynomial and RBF are two
can reduce the number of training parameters. Pooling can commonly-used kernel functions. In general, the RBF-based
be used to reduce the feature size while maintaining the SVM classifier has a relatively better performance than the
invariance of features. The three basic ideas reduce the training other two kernel functions [104], [105].
difficulties of convolutional NNs greatly. The objective of SVM is to find a separating hyperplane in
d) Recurrent NN: In feed-forward neural networks, the the feature space to maximize the margin between different
information is transmitted directionally from the input layer classes. Note that, the margin is the distance between the
to the output layer. However, recurrent NN [99], [100] is a hyperplane and the closest data points of each class. The cor-
stateful network, which can use internal state (memory) to responding closest data points are defined as support vectors.
handle sequential data. A typical recurrent NN and its unrolled An example of SVM classifier is shown in Fig. 9. From the

figure, there are many possible separating hyperplanes between

two classes, but only one optimal separating hyperplane can A B A B A B
maximize the margin. For a more insightful discussion on
SVM, please refer to [106]–[108]. C C C
6) Bayes’ Theory: Bayes’ theory uses the conditional prob-
ability to calculate the probability of an event occurring given
D D D
the prior knowledge of conditions that might be related to E E E
the event. The Bayes’ theory is defined mathematically as the
（a）（b）（c）
following equation:

P (E|H)P (H) A B A B
P (H|E) = (1)
P (E)
C C
where E is a new evidence, H is a hypothesis, P (H|E) is
the posterior probability that the hypothesis H holds given
the new evidence E, P (E|H) is the posterior probability that D D
of evidence E conditioned on the hypothesis H, P (H) is the E E
prior probability of hypothesis H, independent of evidence E, （e）（d）
and P (E) is the probability of evidence E.
In a classification problem, the Bayes’ theory learns a Fig. 10. Example of k-means algorithm, for k = 2. (a) Randomly choosing
probability model by using the training dataset. The evidence two data points as two centroids; (b) label each node with the closest centroid,
resulting that node A and B are a class, node C, D and E are another class;
E is a data sample, and the hypothesis H is the class to (c) assign new centroids; (d) label each node with the closest centroid again,
assign for the data sample. The posterior probability P (H|E) resulting that node A, B and C are a class, node D and E are another class;
represents the probability of a data sample belonging to a class. (e) the algorithm is converged.
In order to calculate the posterior probability P (H|E), P (H),
P (E) and P (E|H) need to be calculated first based on the
training dataset using the probability and statistics theories, similarity between them. The unsupervised learning techniques
which is the learning process of the probability model. When are widely used in clustering and data aggregation [76],
classifying a new input data sample, the probability model [78]. In the following, we will give a detailed representation
can be used to calculate multiple posterior probabilities for of widely-used unsupervised learning algorithms, such as k-
different classes. The data sample will be classified into the means and self-organizing map.
class with the highest posterior probability P (H|E). The 1) k-Means: The k-means algorithm is a popular unsuper-
advantage of the Bayes’ theory is that it requires a relatively vised learning algorithm, which is used to recognize a set of
small number of training dataset to learn the probability unlabeled data into different clusters. To implement the k-
model [109]. However, there is an important independence means algorithm, only two parameters (i.e., the initial dataset
assumption when using the Bayes’ theory. To facilitate the and the desired number of clusters) are needed. If the desired
calculation of P (E|H), the features of data samples in the number of clusters is k, the steps to resolve node clustering
training dataset are assumed to be independent of each other problem by using k-means algorithm are: (a) initialize k cluster
[110]. For a more insightful discussion on Bayes’ theory, centroids by randomly choosing k nodes; (b) use a distance
please refer to [109], [111]–[114]. function to label each node with the closest centroid; (c) assign
7) Hidden Markov Models (HMM): HMM is one kind of new centroids according to the current node memberships and
Markov models. Markov models are widely used in randomly (d) stop the algorithm if the convergence condition is valid,
dynamic environments which obey the memoryless property. otherwise go back to step (b). An example procedure of k-
The memoryless property of Markov models means that the means algorithm is shown in Fig. 10. For a more insightful
conditional probability distribution of future states only relates discussion on k-means, please refer to [78], [117].
to the value of the current state and is independent of all 2) Self-Organizing Map (SOM): SOM, also known as Self-
previous states [115], [116]. There are other Markov models, Organizing Feature Map (SOFM), is one of the most popular
such as Markov Chains (MC). The main difference between unsupervised neural network models. SOM is often applied
HMM and other models is that HMM is often applied in to perform dimensionality reduction and data clustering. In
environments where system states are partially visible or not general, SOM has two layers, an input layer and a map layer.
visible at all. When SOM is used to perform data clustering, the number
of neurons in the map layer is equal to the desired number
of clusters. Each neuron has a weight vector. The steps to
B. Unsupervised Learning resolve data clustering problem by using SOM algorithm are:
In contrast to supervised learning, an unsupervised learning (a) initialize the weight vector of each neuron in the map
algorithm is given a set of inputs without labels (i.e., there is layer; (b) choose a data sample from the training dataset; (c)
no output). Basically, an unsupervised learning algorithm aims use a distance function to calculate the similarity between
to find patterns, structures, or knowledge in unlabeled data by the input data sample and all weight vectors. The neuron
clustering sample data into different groups according to the whose weight vector has the highest similarity is called the

RL to SDN, the controller generally works as an agent and

Action (at)
State (st) the network is the environment. The controller monitors the
network status and learns to make decisions to control data
Agent Environment
forwarding. Fig. 11 shows a basic diagram of a RL system.
Specifically, at each time step t, the agent monitors a state st
and chooses an action at from the action space A, receives
State (st+1) an immediate reward rt which indicates how good or bad the
Reward r(st,at) action is, and transitions to the next state st+1 . The objective
of the agent is to learn the optimal behavior policy π which
Fig. 11. A basic diagram of a RL system. The agent takes an action according is a direct map from the state space S to the action space
to the current state and then receives a reward. r(st , at ) denotes the immediate A (π : S → A) to maximize the expected long-term reward.
reward that the agent receives after performing an action at at the state st .
From the behavior policy π, the agent can determine the best
corresponding action given a particular state. In RL, value
Best Matching Unit (BMU). The SOM algorithm is based on function is used to calculate the long-term reward of an action
competitive learning, which means that there is only one BMU given a state. The most well-known value function is Q-
each time. (d) The neighborhood of the BMU is calculated. (e) function, which is used by Q-learning to learn a table storing
The weight vectors of the neurons in the BMU’s neighborhood all state-action pairs and their long-term rewards [127].
(including the BMU itself) are adjusted towards the input data 2) Deep Reinforcement Learning (DRL): The main advan-
sample. (f) Stop the algorithm if the convergence condition tage of RL is that it works well without prior knowledge of
is valid, otherwise go back to step (b). For a more insightful an exact mathematical model of the environment. However,
discussion on SOM, please refer to [118], [119]. the traditional RL approach has some shortcomings, such
as low convergence rate to the optimal behavior policy π
and its inability to solve problems with high-dimensional
C. Semi-supervised Learning state space and action space. These shortcomings can be
Semi-supervised learning [120], [121] is a type of learning addressed by DRL [128]–[130]. The key idea of DRL is to
which uses both labeled and unlabeled data. Semi-supervised approximate the value function by leveraging the powerful
learning is useful for a few reasons. First, in many real-world function approximation property of deep NNs. After training
applications, the acquisition of labeled data is expensive and the deep NNs, given a state-action pair as input, DRL is able
difficult while acquiring a large amount of unlabeled data is to estimate the long-term reward. The estimation result can
relatively easy and cheap. Second, effective use of unlabeled guide the agent to choose the best action.
data during the training process actually tends to improve the 3) RL-based Game Theory: Game theory is a mathematical
performance of the trained model. In order to make the best tool that focuses on strategic interactions among rational
use of unlabeled data, assumptions have to be hold in semi- decision-makers. A game generally involves a set of players,
supervised learning, such as smoothness assumption, cluster a set of strategies and a set of utility functions. Players
assumption, low-density separation assumption, and manifold are decision-makers. Utility functions are used by players to
assumption. Pseudo Labeling [122], [123] is a simple and select optimal strategies. Cooperative game theory and non-
efficient semi-supervised learning technique. The main idea cooperative game theory are two branches of game theory.
of Pseudo Labeling is simple. Firstly, use the labeled data to In cooperative games, players cooperate and form multiple
train a model. Then, use the trained model to predict pseudo coalitions. Players choose strategies that maximize the utility
labels of the unlabeled data. Finally, combine the labeled of their coalitions. On the contrary, in non-cooperative games,
data and the newly pseudo-labeled data to train the model players compete against each other and choose strategies
again. There are other semi-supervised learning methods, such individually to maximize their own utility. In the network field,
as Expectation Maximization (EM), co-training, transductive it is often assumed that nodes are selfish [131]–[137]. Thus,
SVM and graph-based methods. Different methods rely on in this paper, we only focus on non-cooperative game theory.
different assumptions [124]. For example, EM builds on In non-cooperative games, players do not communicate with
cluster assumption, transductive SVM builds on low-density each other, and at the beginning of each play round, players
separation assumption, while graph-based methods build on do not have any information about the strategies selected
the manifold assumption. by the other players. At the end of each play round, all
players broadcast their selected strategies, which are the only
external information. However, each player’s utility can be
D. Reinforcement Learning affected by the other players’ strategies. In this case, adaptive
1) Reinforcement Learning (RL): Another quite popular learning methods should be used to predict the strategies of the
learning technique is RL [125], [126]. RL involves an agent, other players, based on which each player chooses its optimal
a state space S and an action space A. The agent is a strategy. RL is a widely-used adaptive learning method, which
learning entity which interacts with its environment to learn can help players select their optimal strategies by learning
the best action to maximize its long-term reward. The long- from historical information such as network status, the other
term reward is a cumulative discounted reward and relates to players’ strategies and the corresponding utility [132], [134],
both the immediate reward and future rewards. When applying [138]. Thus, RL-based game theory is an effective decision-

making technique. facilitates the traffic collection and analysis. Thus, the ML-
In summary, supervised learning algorithms are generally based approaches are generally implemented in the controller.
applied to conduct classification and regression tasks, while Many studies have been done to classify traffic from different
unsupervised and reinforcement learning algorithms are ap- perspectives, such as elephant flow-aware, application-aware
plied to conduct clustering and decision-making tasks re- and QoS-aware traffic classification. In this subsection, we will
spectively. In order to give readers a better understanding of summarize related studies.
machine learning algorithms, we provide a comparison of pros 1) Elephant Flow-aware Traffic Classification: Elephant
and cons of all the machine learning algorithms discussed flow-aware traffic classification aims to identify the elephant
above in Table II. flows and the mice flows. Elephant flows are the long-lived,
bandwidth-hungry flows, while mice flows are the short-lived,
V. M ACHINE L EARNING IN SDN delay-intolerant flows. In a data center, 80% of the traffic flows
The centralized SDN controller has a global network view, are mice flows. However, the majority of bytes are carried in
which makes the network easy to control and manage. Ma- elephant flows [142]. To control the traffic flows in data centers
chine learning techniques can bring intelligence to the SDN effectively, it is necessary to identify the elephant flows.
controller by performing data analysis, network optimization, Ref. [143] studies the traffic flow scheduling issue in a
and automated provision of network services. In other words, hybrid data center network. First, machine learning techniques
the learning capability enables the SDN controller to au- are used to do elephant flow-aware traffic classification at the
tonomously learn to make optimal decisions to adapt to the edge of the network. Then, the centralized SDN controller can
network environments. In this section, we review existing utilize the classification result to implement efficient traffic
machine learning efforts to address issues in SDN, such as flow optimization algorithms.
traffic classification, routing optimization, QoS/QoE predic- In [144], a cost-sensitive learning method is proposed in
tion, resource management and security. We will give readers SDN to detect elephant flows. The proposed elephant flow
a summary on how ML algorithms are applied in the realm detection strategy is composed of two stages. In the first stage,
of SDN. head packet measurement is adopted to distinguish suspicious
elephant flows from mice flows. In the second stage, decision
tree is used as the detection method to analyze whether these
A. Traffic Classification suspicious elephant flows are elephant flows or not.
Traffic classification is an important network function, 2) Application-aware Traffic Classification: Application-
which provides a way to perform fine-grained network man- aware traffic classification aims to identify the applications
agement by identifying different traffic flow types. With the of traffic flows. In [139], the authors study the application-
help of traffic classification, network operators can handle aware traffic classification in the enterprise network. A simple
different services and allocate network resources in a more OpenFlow-based SDN system is deployed in an enterprise net-
efficient way. work to collect traffic data. Then several classifier algorithms
The widely-used traffic classification techniques include are applied to classify traffic flows into different applications.
port-based approach, Deep Packet Inspection (DPI) and ma- Ref. [145] proposes MultiClassifier to identify applications
chine learning [139]–[141]. Port-based approach uses TCP by combining ML-based classifier and DPI-based classifier.
and UDP port numbers to determine applications. In the past, Upon a new flow arrival, ML-based classifier is first se-
many applications used well-known ports such as TCP port lected to do the classification. If the reliability of ML-based
80 for HTTP protocol. Nowadays, most applications run on classifier’s result is larger than a threshold value, it will
dynamic ports, which makes the port-based approach no longer be the MultiClassifier’s result directly. Otherwise, the DPI-
effective. based classification will be done. If DPI-based classifier does
DPI matches the payload of traffic flows with predefined not return “UNKNOW”, its result will be selected as the
patterns to identify the applications that traffic flows belong MultiClassifier’s result.
to. The patterns are defined by regular expressions. The DPI- Ref. [146] focuses on the classification of applications
based approach generally has high classification accuracy. running over UDP protocol. A behavioral classification en-
However, it has some shortcomings. First, DPI can only recog- gine is proposed to give an accurate application-aware traffic
nize applications whose patterns are available. The exponential classification. Specifically, SVM algorithm is used to classify
growth of applications makes the pattern update difficult and UDP traffic according to Netflow records (e.g., the counts of
impractical. Second, DPI incurs high computational cost as all received packets and bytes). Simulation results demonstrate
traffic flows need to be checked. Third, DPI cannot classify that the classification accuracy of the proposed SVM-based
encrypted traffic on the Internet. classification engine is over 90%.
ML-based approaches can correctly recognize encrypted Ref. [140] focuses on the mobile application classification.
traffic and incur much lower computational cost than DPI- A framework, called Atlas, is proposed to identify the mobile
based approach. Thus, ML-based approaches have been ex- applications. A crowd sourcing approach is used to collect
tensively studied. To do traffic classification, a large number ground truth data from end devices. The collected data is
of traffic flows are first collected, and then ML techniques used to train the decision tree. The trained model is able to
are applied to extract knowledge from the collected traffic identify the mobile applications of traffic flows. Simulation
flows. In SDN, the controller has a global network view, which results demonstrate that the average classification accuracy of

TABLE II
A DVANTAGES AND SHORTCOMINGS OF THE ML ALGORITHMS .

ML algorithm Problem type Advantages Shortcomings

• Computationally expensive due to the distance
calculation of each training data sample to
Classification, • Simple to implement
classify a new sample
k-NN • Flexible to choose distance functions
regression • Memory-intensive to store all the training
dataset

• Simple to understand decisions • Instability: even a small change in the training

• Ability of selecting the most discriminatory dataset can result in large changes of the DT
Classification, features model
DT
regression • Data classification without much calculation • Over-fitting: noise can cause the over-fitting of
• Handling both continuous and discrete data the DT model

• Work well on large training dataset

Classification, • Low training speed
• Reduced instability (relative to DT)
Random forest • Less effective to train imbalanced dataset
regression • Mitigate the over-fitting of the DT model

• Computationally expensive due to the require-

ment for tuning a large number of parameters
• Once trained, prediction is fast
• Hard for humans to interpret the trained NN
Classification, • Able to approximate an arbitrary function
model
Neural network • Work well on high-dimensional training
regression • There is little theory to guide researchers to
dataset
set the optimal NN structure (e.g., the number
of layers and nodes)

• Hard to train large dataset because the training

• Handle high-dimensional dataset well
Classification, is computationally expensive
• Work well on both linearly separable and non-
SVM • Less effective on noisier dataset due to over-
regression linearly separable dataset
fitting issues

• Simple to understand and implement • Rely on independence assumption, which is

Classification • Easy to train the model, even with a small not always the case in real world
Bayes’ theory
training dataset • Hard to handle continuous data

• Hard to train large dataset because the training

• Strong statistical foundation is computationally expensive
Classification • Work well in environments where system • Instability: even a small change of the HMM
HMM
states are partially visible parameters can affect the performance of the
HMM model dramatically

• Sensitive to initial points and outliers

• Simple to implement
Clustering • Computational cost is linear with the number
k-Means • Easy to interpret the clustering results
of training data

• Easy to understand the data mapping

• Computationally expensive, especially for
Clustering • Capable of handling high-dimensional dataset
SOM large maps with lots of training data
well

Classification, • Rely on assumptions such as manifold, cluster,

Semi-supervised • Use both labeled and unlabeled data
regression, and smoothness assumptions
learning
clustering
• Low convergence rate to the optimal behavior
• Work well without prior knowledge of an exact
Decision- policy π
mathematical model of the environment
RL • Hard to solve problems with high-dimensional
making • Once trained, decision making is fast
state space and action space

• Can handle problems with high-dimensional

state space and action space
Decision- • Rely on the powerful function approximation • Require lots of computational resources to
DRL and representation learning properties of deep train the model
making
neural networks
• After training, decision making is fast

applications. Then the labeled training dataset is used by semi-

Application Layer
supervised learning algorithms, such as Laplacian SVM, to
Network Management classify the traffic flows of unknown applications. In this
App Flow statistics
way, traffic flows of both known and unknown applications
API Ground truth
are categorized into different QoS classes. Simulation results
(app name, flow type) indicate that the system has a high classification accuracy (i.e.,
Control Layer
over 90%).
TV Engine 4) Analysis: From these related studies on the traffic clas-
Application Classifier
(decision tree) sification, we can give the following analysis and summary.
OpenFlow • Elephant flow-aware traffic classification is often applied
in data centers. One main objective of data centers is to
Data Layer Flow-type Classifier
(k-NN) schedule traffic flows rapidly. Fine-grained traffic classi-
end devices access devices fication methods (i.e., application-aware and QoS-aware
traffic classification) can increase the traffic processing
delay, so they are not suitable for data centers.
• Application-aware traffic classification is often applied
Fig. 12. High-level SDN-enabled TrafficVision architecture and the workflow
of TV Engine [148]. TV Engine has three major tasks: (1) Collecting flow for the fine-grained network management. However, with
statistics and ground-truth training data from end devices and access devices. the exponential growth of applications on the Internet,
(2) A decision tree classifier is applied to identify application name. (3) A
k-NN classifier is applied to identify flow types. it is impractical to identify all the applications. Exist-
ing works only identify the most popular applications.
For example, [139] uses ML approaches to identify the
Atlas is over 94% for the top 40 applications on Google Play. widely-used eight applications. [140] focuses on the top
In [147], deep NN is used to identify mobile applications. 40 applications on Google Play.
Mobile network traffic is collected from an experimental net- • QoS-aware traffic classification can be used by network
work. Five flow features (i.e., destination address, destination operators to optimize network resource allocation for
port, protocol type, TTL and packet size) are selected to train traffic flows according to their desired QoS.
a 8-layer deep NN model. Simulation results demonstrate • In general, supervised and semi-supervised learning al-
that the trained model can achieve 93.5% accuracy for the gorithms can be used for the traffic classification. Super-
identification of 200 mobile applications. vised learning algorithms need a labeled training dataset,
A mobile application often generates various flow types. in which traffic flows are labeled with known classes,
For example, Facebook application can generate video, voice, such as elephant flow, applications or QoS classes. DPI is
Instant Messaging (IM) and file sharing flows, and so on. To a common method to label traffic flows, but it incurs high
provide a fine-grained mobile application-aware traffic classi- computational cost when a large number of traffic flows
fication, it is necessary to identify both the mobile applications are labeled. Moreover, ever-increasing new applications
and the flow types. In [148], a fine-grained mobile application- also make supervised learning algorithms less effective.
aware traffic classification system, called TrafficVision, is pro- On the contrary, semi-supervised learning algorithms only
posed in SDN-enabled wireless edge network. TrafficVision need a small part of labeled data, so they are more
Engine (TV Engine) is the main component of TrafficVision. effective to do fine-grained traffic classification.
The high-level SDN-enabled TrafficVision architecture and the • The performance of supervised learning algorithms de-
workflow of TV Engine are shown in Fig. 12. The TV Engine pends on training datasets. Thus, in Table III, we provide
has three major tasks: (1) Collecting, storing and extracting a detailed comparison of the related works discussed
flow statistics and ground-truth training data from end devices above, from the perspectives of objective, learning model,
and access devices. (2) A decision tree classifier is used to training dataset input and output. In Table VIII, we
identify the application name, such as YouTube, Facebook, summarize the performance of the ML-based traffic clas-
Amazon etc. (3) A k-NN classifier is applied to identify the sification solutions, from the perspectives of complexity,
flow types, such as video content, audio file, video chat etc. lower bound, upper bound, and average classification
3) QoS-aware Traffic Classification: QoS-aware traffic accuracy.
classification aims to identify the QoS classes of traffic flows. • Because the experiments are conducted based on different
With the exponential growth of applications on the Internet, training datasets, we cannot compare the performance
it is difficult and impractical to identify all the applications. of different supervised learning algorithms directly. The
However, applications can be divided into different QoS experiments in [140], [141], [144] show that the classifi-
classes according to their QoS requirements (e.g., delay, jitter cation accuracy is related to the dimension and volume of
and loss rate). Many different applications may belong to a training datasets. In general, with the increasing of dimen-
QoS class. Thus, it is a more effective way to classify traffic sion and volume of training datasets, the classification
flows according to their QoS requirements. accuracy can be improved. Compared with conventional
In [141], a QoS-aware traffic classification system is pro- machine learning algorithms, deep learning algorithms
posed by leveraging semi-supervised learning algorithm and are more suitable for processing large high-dimensional
DPI. DPI is applied to label a part of traffic flows of known training datasets due to the ability of feature learning and

hierarchical feature extraction [147]. However, the deeper

the neural network is, the more time it takes to train the Input
neural network model. In other words, the deeper neural
network has higher complexity.
Dynamic
Routing

B. Routing Optimization Heuristic Algorithm Layer

Routing is a fundamental network function. In SDN, the Training
controller can control the routing of traffic flows by modifying
ML-based Meta-layer
flow tables in switches. For example, the controller can guide
switches to discard a traffic flow or route it through a specific
path. Inefficient routing decisions can lead to the over-loading Optimal Path

of network links and increase the end-to-end transmission

delay, which affect the overall performance of SDN. Thus, Output
how to optimize the routing of traffic flows is an important
research problem.
Shortest Path First (SPF) algorithm and heuristic algorithms Fig. 13. A dynamic routing architecture [150]. The architecture consists of a
[149] are two types of widely-used routing optimization ap- ML-based meta-layer and a heuristic algorithm layer. The input of heuristic
algorithm and its corresponding output are the training dataset of the ML-
proaches. SPF algorithm routes packets according to simple based meta-layer. After the training phase, the ML-based meta-layer can make
criteria such as hop-count or delay. Despite its simplicity, the the optimal routing decisions directly and independently.
SPF algorithm is a best-effort routing protocol and does not
make the best use of network resources [150]. Heuristic al-
gorithms (e.g., ant colony optimization algorithm) are another network traffic as the input, and the corresponding routing
approach to solve the routing optimization problem. The high solution calculated by heuristic algorithms as output, are used
computational complexity is the main shortcoming of heuristic to train the neural network model. After training, the trained
algorithms [150], [151]. neural network model can be applied to obtain the real-time
In SDN, the controller is responsible for calculating the heuristic-like results.
routing policy for each new flow. In this case, heuristic 2) RL-based Routing Optimization: RL algorithms are
algorithms are not suitable because they increase the com- generally applied to solve decision-making problems. When
putational burden of the controller. Many studies have tried to applying RL algorithms to optimize routing, the controller
solve the routing optimization problem using machine learn- works as an agent and the network is the environment. The
ing algorithms. Compared with heuristic algorithms, machine state space is composed of network and traffic states. The
learning algorithms have some advantages. On one hand, once action is the routing solution. The reward is defined based on
trained, machine learning algorithms can give the near-optimal optimization metrics such as network delay.
routing solutions quickly. On the other hand, machine learning The work in [152] presents a distributed intelligent routing
algorithms do not need an exact mathematical model of the protocol in SDN by using RL method. The proposed routing
underlying network. The routing optimization problem can protocol is able to select the optimal data transmission paths
be considered as a decision-making task. Thus, reinforcement according to the network status.
learning is an effective approach. Supervised learning algo- In [153], the authors study the routing optimization scheme
rithms are also applied by many studies to optimize routing. in the SDN-enabled inter-data center overlay network. A logi-
In the subsection, we will summarize related studies on routing cally centralized Cognitive Routing Engine (CRE) is proposed
optimization. to find the optimal overlay paths between geographically-
1) Supervised Learning-based Routing Optimization: La- dispersed data centers, by using random NN and RL. The
beled training datasets are the foundation of supervised learn- SDN-enabled overlay network with CRE is shown in Fig. 14.
ing algorithms. In general, when applying supervised learning Based on random NN and RL, the proposed CRE can work
algorithms to optimize routing, the network and traffic states well even in highly chaotic environments.
are often the input of the training datasets, and the correspond- Ref. [155] focuses on the routing optimization in multi-layer
ing routing solutions of heuristic algorithms are the output. By hierarchical SDN. A QoS-aware Adaptive Routing (QAR)
training supervised learning algorithms, the optimal heuristic- method is presented to enable time-efficient adaptive packet
like routing solutions can be obtained in real time. forwarding by utilizing RL algorithm. The routing path with
In [150], an architecture with supervised ML-based meta- the maximum QoS-aware reward is selected based on traffic
layer, shown as Fig. 13, is presented to solve the dynamic types and users’ applications.
routing problem. The ML-based meta-layer uses training In [156], DRL model is applied to optimize routing. The
dataset, which includes the input of heuristic algorithm and its objective of the DRL model is to select the optimal routing
corresponding output, to obtain real-time heuristic-like results. paths for all source-destination pairs given the traffic matrix
Ref. [151] proposes a dynamic routing framework called to minimize the network delay.
NeuRoute. In NeuRoute, LSTM is used to estimate future 3) Traffic Prediction: Traffic prediction is an important
network traffic. Then, the network state and the estimated research issue in the field of routing optimization. Traffic

TABLE III
ML- BASED TRAFFIC CLASSIFICATION SOLUTIONS IN SDN.

Ref. Objective Learning model Dataset input Dataset output

Elephant
Basic five-tuple and statistical flow Elephant flow, mice flow
[144] flow-aware Decision tree
features
classification
8 applications: YouTube,
12 flow features such as packet Vimeo, Facebook,
Application-
size, packet time stamp, inter- Linkedin, Skype,
[139] aware Random forest
arrival time, flow duration, and so Bittorrent, Web Browsing
classification
on (HTTP) and Dropbox

Application-
Not mentioned
[145] aware ML classifier Not mentioned
classification
8 applications: PPlive,
Application- Basic five-tuple and Netflow TVAnts, SopCast, Joost,
[146] aware SVM records (e.g., the counts of Edonkey, BitTorrent,
classification received packets and bytes) Skype, DNS

Application- Flow features such as the sizes of Top 40 applications in

[140] aware Decision tree the first ‘N’ packets, source and Google Play Store
classification destination ports and IP addresses
Application- Destination address, destination
200 mobile applications
[147] aware Deep NN port, protocol type, TTL and packet
classification size
Dataset 1: top 37 appli-
Application- cations in Google Play
Decision tree, k-
[148] aware Flow features summarized in [7] Store. Dataset 2: 45 appli-
NN
classification cations

Four QoS classes:

voice/video conference,
9 flow features such as the average
QoS-aware clas- Semi-supervised interactive data,
[141] packet inter-arrival time, Hurst pa-
sification learning streaming, bulk data
rameter, port number, and so on
transfer

prediction aims to predict the trend of traffic volume by

Link CRE
CRAM NMM PTM Other Apps analyzing the historical traffic information [157]. Based on
Discovery
traffic prediction results, the SDN controller can make traffic
routing decisions in advance and distribute the proactive
SDN Controller
routing policies to forwarding devices in the data plane to
guide traffic flow routing in the near future. In this way,
the SDN controller can take appropriate actions before traffic
congestion occurs. Furthermore, traffic prediction can facilitate
the proactive provision of network resources to improve QoS.
S1 S2
D1 D2 Ref. [158] focuses on the software defined mobile metro-
core network and studies the dynamic optical routing issue.
To solve the problem, the authors propose a dynamic optical
Data Plane Link S3
routing matheuristic algorithm, which includes three phases:
Control Plane Link D3 Off-Line Scheduling, Off-Line Planning and On-Line Routing.
S：OpenVSwitch Neural network is used in the Off-Line Scheduling phase to
D：Data Centre
forecast the network traffic load. The prediction results are
used to calculate the optimal resource allocation according
Fig. 14. The SDN-enabled overlay network with CRE [153]. CRE consists to the predicted traffic load in advance. Then the system
of three main modules: CRAM, NMM and PTM [154]. CRAM stands uses a minimum-cost path algorithm to make on-line routing
for Cognitive Routing Algorithm Module, NMM for Network Monitoring
Module, PTM for Pathto-OF Translator Module. CRAM uses random NN decisions.
and RL to find network paths which maximize the objective function set by In [159], a load balance strategy is proposed to optimize
the tenant’s traffic engineering policy. NMM is in charge of collecting required path load. Four flow features (i.e., transmission hop, transmis-
network state information to update the random NN in the CRAM. PTM is
responsible for converting the optimal paths found by the CRAM into the sion latency, packet loss rate and bandwidth utilization ratio)
appropriate OpenFlow messages, which guide the SDN controller to reroute are selected by the SDN controller to predict the load of each
the network traffic. path using neural network model. Then, the least loaded path
will be selected as the transmission path of new traffic flows.
Ref. [160] proposes a LSTM-based framework called

NeuTM to predict network traffic matrix. Real-world traffic per port and per flow granularity levels, based on which ML
data from the GEANT backbone network [161] is used to algorithms can be applied to perform the QoS/QoE prediction.
train the LSTM model. Simulation results demonstrate that In the following, the related research on ML-based QoS/QoE
the LSTM model converges quickly and has a good prediction prediction will be summarized.
performance. 1) QoS Prediction: QoS parameters (e.g., loss rate, delay,
4) Others: Ref. [162] focuses on the routing protocol in jitter and throughput) are related to network Key Performance
environments with strict compliance requirements. An efficient Indicators (KPIs) such as packet size, transmission rate and
risk-based swarm routing protocol is proposed. The proposed queue length, etc. Discovering the quantitative correlations
protocol first uses k-means algorithm to cluster network traffic between KPIs and QoS parameters can improve the QoS
into several clusters of risk ratios in an off-line mode. Then, management by predicting QoS parameters according to KPIs.
the Ant Colony Optimization (ACO) is used to select paths As QoS parameters are generally continuous data, the QoS
with minimized privacy exposure and compliance risks for a prediction problem can be considered as a regression task.
given data transmission session in an on-line mode. Thus, supervised learning is an effective approach.
5) Analysis: In Table IV, we provide a comparison of the Ref. [163] studies the network delay estimation. This paper
related works discussed above. From the related studies on the aims to train a model automatically to estimate the network
routing optimization, we can give the following analysis and delay given the traffic load and the overlay routing policy.
summary. Two different models (i.e., traditional M/M/1 network model
• Supervised learning algorithms, especially neural net- and neural network model) are proposed to perform delay
works, are effective to obtain the optimal heuristic-like estimation. The experimental results show that the NN-based
routing solutions. However, the main shortcoming is estimator has better performance than M/M/1 model in the
that the acquisition of labeled training datasets has high accuracy of delay estimation. However, as it is hard for humans
computational complexity. to interpret the trained NN model, compared with NN model,
• Compared with supervised learning algorithms, RL al- M/M/1 model is easier for humans to understand..
gorithms have some advantages. On one hand, RL al- In [164], a two-phase analysis mechanism is proposed in
gorithms do not need labeled training datasets. On the SDN to improve the QoS prediction. Firstly, decision tree is
other hand, optimization targets (e.g., energy efficiency, used to discover correlations between KPIs and QoS param-
throughput and delay) can be adjusted flexibly through eters. Then, a linear regression ML algorithm (i.e., M5Rules)
different reward functions. is applied to perform root cause analysis and discover each
• Traffic prediction can promote the implementation of KPI’s quantitative impact. The proposed mechanism can pre-
routing pre-design, which is an effective way to reduce dict traffic congestion and provide recommendations on QoS
the transmission delay in the data plane by modifying improvement.
switches’ flow tables in advance. Neural network models, Ref. [165] focuses on application-aware QoS estimation.
especially LSTM, are often used for traffic prediction. The authors use two learning methods (i.e., random forest
• The experiments in [151] show that the optimal neural and regression tree) to estimate two QoS metrics of Video-
network architecture (e.g., the number of hidden layers on-Demand (VoD) application (i.e., frame rate and response
and the number of neurons in each hidden layer) is prob- time) according to the collected operating system-granularity
lem dependent. Conducting experiments is an approach statistics, port-granularity statistics and flow-granularity statis-
to determine the optimal neural network architecture. tics. Additionally, in order to reduce the computational cost,
Specifically, based on the measurement of training time a forward-stepwise-selection technique is applied to reduce
and learning performance for different neural network the feature set size while maintaining a low level of QoS
architectures, researchers can choose the optimal neural estimation error. The simulation results demonstrate that the
network architecture which has the best tradeoff between application-aware QoS estimation accuracy is over 90%.
training time and learning performance. 2) QoE Prediction: QoE is a subjective metric to quantify
the user satisfaction of a service. A widely-used QoE metric
is Mean Opinion Score (MOS) [166], [167]. MOS divides the
C. QoS/QoE Prediction QoE values into five levels, including excellent, good, fair,
QoS parameters such as loss rate, delay, jitter and through- poor and bad. The QoE values are usually obtained using
put, are network-oriented metrics, which are usually used by subjective methods where a number of users are invited to
network operators to assess network performance. On the other rate the quality of a service. The subjective methods are time
hand, with the popularization and widespread of multimedia consuming. As the QoE values heavily rely on network QoS
technologies, user perception and satisfaction are becoming parameters (e.g., loss rate, delay, jitter and throughput), to
more and more important to both network operators and obtain the QoE values in real time, understanding how QoS
service providers. The notion of QoE has emerged as user- parameters affect the QoE values is very important. Machine
oriented metrics to assess the user satisfaction of a service. learning is an effective method to learn the relationship be-
Based on QoS/QoE prediction, network operators and service tween QoS parameters and the QoE values. As the QoE values
providers can offer high-quality services to increase customer are generally discrete data, the QoE prediction problem can
satisfaction and prevent customer churn. SDN is a centralized be considered as a classification task. Thus, the best way to
architecture and can collect statistics from the switches at do QoE prediction is supervised learning.

TABLE IV
ML- BASED ROUTING OPTIMIZATION SOLUTIONS IN SDN.

Ref. Objective Learning model Complexity Brief summary

Using ML-based meta-layer to obtain real-time heuristic-like
Routing
[150] Neural network Fair traffic routing results
optimization
Routing A ML-based dynamic routing framework called NeuRoute
[151] Neural network Fair
optimization
Using RL to select the optimal forwarding paths to minimize
Routing
[152] RL Fair network cost considering delay, loss rate and bandwidth
optimization
Using RL to select the optimal forwarding paths to maximize
Routing
[155] RL Fair QoS-aware reward
optimization
Using DRL to select the optimal forwarding paths to minimize
Routing
[156] DRL High network delay
optimization
Using NN model to predict traffic load which is used to calculate
[158] Traffic prediction Neural network Fair the optimal routing decisions in advance

Path load predic- Using NN model to predict the load of each path
[159] Neural network Fair
tion
Traffic matrix Using LSTM to predict network traffic matrix
[160] LSTM High
prediction
A ML-based data privacy preservation routing protocol in SDN
[162] Traffic clustering k-means Low

Ref. [166] focuses on the QoE prediction for video stream- solutions, from the perspectives of complexity, lower
ing services in SDN. Network parameters (e.g., RTT, jitter, bound, upper bound, and average prediction accuracy.
bandwidth and delay) are used to estimate the MOS value. Ref. [165] compares the performance of random forest
According to the estimation result, the SDN controller can and regression tree. Because random forest is an ensemble
adjust video parameters (e.g., resolution, frame per second and method that considers the results of many decision trees,
bitrate) to improve the QoE. the prediction accuracy of random forest is higher than
The authors of [167] use four ML algorithms (i.e., DT, regression tree. However, the complexity of regression
neural network, k-NN and random forest) to predict the tree is lower than random forest.
QoE values based on video quality parameters (SSIM and
VQM). Two metrics, Pearson correlation coefficient and Root- D. Resource Management
MeanSquare-Error, are applied to assess the performance of Efficient network resource management is the primary re-
these algorithms. quirement of network operators to improve network perfor-
3) Analysis: From the related studies on QoS/QoE predic- mance. SDN separates the control plane from the data plane,
tion, we can give the following analysis and summary. making the network programmable via a centralized controller
• QoS prediction aims to discover the quantitative corre- with a global network view. SDN facilitates network resource
lations between KPIs and QoS parameters, while QoE management to maximize the utilization of network resources.
prediction aims to discover the quantitative correlations In the following, we will review recent studies on resource
between QoS parameters and QoE values. In SDN, the management in SDN.
controller can use the prediction results to configure de- 1) Data Plane Resource Management: There are three
vices in the data plane flexibly to improve the QoS/QoE. types of resources in the data plane, including networking,
• QoS prediction is generally considered as a regression caching and computing resources. Networking resources, such
task, while QoE prediction is considered as a classifi- as spectrum, bandwidth and power, are used to deliver data
cation task. Thus, supervised learning techniques can be through networks to meet QoS/QoE requirements. Caching
used for QoS/QoE prediction. However, it is difficult to resources are used to store the frequently requested data at
collect a large labeled training dataset due to the cost and devices in the data plane. This way not only reduces the
time consumption of obtaining subjective QoE values. data transmission delay, but also decreases duplicate data
Semi-supervised learning algorithms only need a small transmission. With the development of new applications such
part of labeled data, so they are also effective for QoE as augmented reality and face recognition, more computational
prediction. capability is required to run these applications normally. Due
• The performance of supervised learning algorithms de- to the limited computing resources and battery capacity, users’
pends on training datasets. Thus, in Table V, we provide a devices tend to fail in handling all computing tasks. To offload
detailed comparison of the related works discussed above, computing tasks, computing resources have been deployed
from the perspectives of objective, learning model, train- closer to end users using Edge Computing technologies [168],
ing dataset input and output. In Table VIII, we summarize [169]. In the data plane, networking, caching and computing
the performance of the ML-based QoS/QoE prediction resources should be managed efficiently.

TABLE V
ML- BASED Q O S/Q O E PREDICTION SOLUTIONS IN SDN.

Ref. Objective Learning model Dataset input Dataset output

Network delay
[163] Delay prediction Neural network Traffic load and routing policy
QoS parameters (e.g.,
loss rate, delay, jitter and
[164] QoS prediction Decision tree 24 network KPIs
throughput)

Application- Operating system-granularity

Random forest, Frame rate, response time
[165] aware QoS statistics, port-granularity statistics
regression tree
prediction and flow-granularity statistics
Network parameters (e.g., RTT, jit- MOS value
[166] QoE prediction ML algorithm
ter, bandwidth and delay)
Decision tree,
neural network, Video quality parameters (SSIM MOS value
[167] QoE prediction
k-NN, random and VQM)
forest

There are two scenarios in SDN: single-tenancy and multi-

tenancy SDN network. In the first scenario, a logically cen-
tralized controller belonging to the single tenant can control RSU cloud with SDN
all resources in the data plane, while in the second scenario,
Cloud resource
resources in the data plane are shared by multiple tenants. OpenFlow manager
In multi-tenancy SDN network, tenants use their own SDN controller
Cloud
controllers to control their isolated resources in the data plane. Traditional
controller

a) Resource Allocation in Single-tenancy SDN Network: datacenters

Many works have studied the data plane resource allocation

in single-tenancy SDN network.
In [170], an integrated framework is proposed to enhance
the performance of sofware-defined virtualized Vehicular Ad-
hoc Network (VANET), by allocating the networking, caching
and computing resources dynamically. The resource alloca-
tion problem is formulated as a joint optimization problem,
considering the gains of networking, caching and computing.
A novel DRL algorithm is proposed to solve the complex
optimization problem and obtain the resource allocation policy.
Similar to [170], [171] focuses on the joint resource allocation
Data plane Control plane
optimization issue in smart cities.
Gateway to traditional datacenter
In [172], the authors propose a novel Roadside Unit (RSU)
cloud architecture, shown in Fig. 15. The RSU cloud is able
RSU Microdatacenter Traditional RSU
to instantiate, replicate, and migrate services dynamically. In
order to reduce reconfiguration cost, a RL-based heuristic
approach is designed to select configurations that minimize Fig. 15. RSU cloud architecture [172]. RSU cloud is composed of traditional
the long-term reconfiguration cost in the network. RSUs and RSU microdatacenters. Traditional RSUs as fixed roadside infras-
tructures can perform Vehicle-to-Infrastructure (V2I) and Vehicle-to-Vehicle
Content distribution is one of the most popular services in (V2V) communications. RSU microdatacenters are the fundamental compo-
people’s life. Content distribution optimization can improve nents of the RSU clouds, which host services to satisfy the demands of mobile
user satisfaction. Many works have studied the content distri- vehicles. The difference between traditional RSUs and RSU microdatacenters
is that additional hardware and software components are deployed in RSU
bution optimization in SDN. microdatacenters to provide virtualization and communication capabilities.
Ref. [173] presents a RL-based context-aware content distri-
bution scheme to improve the content distribution QoS. Based
on network status, such as content distribution time, network the HAS players into a small number of clusters and leveraging
throughput and network overhead, the proposed context-aware RL algorithm to make the bitrate and quality decisions in each
content distribution scheme can select the optimal protocol cluster. Experimental results demonstrate that compared with
(i.e., TCP/IP or Content Centric Networking (CCN)) to deliver six well-known bitrate adaptation schemes (e.g., BBA [175]
different services. and PANDA [176]), SDNHAS increases QoE fairness over
In [174], an intelligent streaming architecture called 33%, video stability over 32% and network resource utilization
SDNHAS is proposed in SDN to help the HTTP Adaptive over 29% on average.
Streaming (HAS) players decide the optimal bitrate and quality Ref. [177] focuses on the deployment of cache-enabled
when streaming media content over the Internet, by grouping Unmanned Aerial Vehicles (UAVs) in a Cloud Radio Access

Network (C-RAN) to optimize users’ QoE and UAVs’ transmit

power. ESN, a type of recurrent NNs, is used to predict the AC experts SDN Controller
content request distribution and mobility pattern of each user. Expert 1
Based on the prediction results, the optimal solutions related to advices
Expert 2 AC Decision Maker
the user-UAV association, each UAV’s location and the content ……
to cache at each UAV can be derived. decisions

b) Resource Allocation in Multi-tenancy SDN Network: Configuration

Monitoring
In multi-tenancy SDN network, resources in the data plane Management
are shared by multiple tenants. How to allocate data plane
resources among multiple tenants to maximize their utility is Southbound API
an important research issue.
Ref. [131] studies the RRH assignment issue among Mobile
Data Plane
Network Operators (MNOs) in C-RAN. The RRH assignment
problem is formulated as a non-cooperative game-theoretic
problem, where the players are RRHs, the action is MNO
selection, and the utility of each player is to maximize its
Received Signal Strength (RSS) level. In order to solve the
problem with low computational complexity, regret-matching- Fig. 16. A ML-based AC method in the SDN controller [178], [179]. Each
based learning algorithm is used by each player to select the expert is an online AC algorithm, such as Greedy, Agrawal [180] and AAP-pd
[181], [182]. AC Decision Maker selects the best decision from all experts
optimal set of MNOs. according to varying traffic conditions.
Ref. [132] studies the computation offloading issue in MEC.
The computation offloading problem is formulated as a non-
cooperative game-theoretic problem, where the players are availability.
MEC servers, the two actions of each player are active and Ref. [178], [179] focus on the admission control in SDN.
inactive, and the utility of each player is to minimize its energy A ML-based method in the SDN controller is proposed to
consumption. In the proposed game-theoretic model, the RL select the most proper AC algorithm from a pool of online
algorithm is applied by each player to learn the optimal action algorithms (experts) according to varying traffic conditions.
(i.e., active or inactive). The ML-based method is shown in Fig. 16.
In [133], the spectrum sharing problem in LTE and WiFi 2) Control Plane Resource Management: In this part, we
coexistence system is studied. In the coexistence system, LTE will review recent studies on control plane resource man-
and WiFi belong to different operators and have their own agement in SDN from resource allocation and controller
controllers, while LTE and WiFi share the same unlicensed placement.
spectrum resources. The spectrum sharing problem is formu- a) Control Plane Resource Allocation: The advances of
lated as a non-cooperative game-theoretic problem, where the network virtualization technologies facilitate the development
players are the two controllers, the action of each player is of multi-tenancy SDN network to share resources in the data
the amount of shared spectrum resources, and the utility of plane among multiple tenants. In multi-tenancy SDN network,
each player is to maximize the spectrum resource utilization. network hypervisors are introduced between the data plane
At the beginning of each play round, controllers use decision and the control plane. Network hypervisors allow tenants to
tree algorithm to predict the opponent’s network status. Then, use their own controllers to control their isolated resources
based on the prediction results, controllers make their optimal in the data plane. FlowVisor [183] and OpenVirteX [184] are
spectrum resource sharing decisions. two widely-used network hypervisors. Network hypervisors
Ref. [134] studies the network function assignment issue have to process all tenants’ control traffic between the data
in SDN/NFV system. The SDN/NFV system is considered plane and the control plane, but they generally have limited
as a network function market, where servers and users are computing resources (e.g., CPU). Thus, how to allocate the
the sellers and buyers of network functions respectively. The limited resources of network hypervisors among multiple
network function assignment problem is formulated as a two- tenants to guarantee the communication between each tenant’s
stage Stackelberg game, where servers act as leaders and data plane and control plane is an important research issue. In
users act as followers. Servers and users try to make their this scenario, ML algorithms generally run on the network
optimal decisions to maximize their utility and benefit. The hypervisors to optimize resource allocation.
existence of Stackelberg equilibrium has been proved, and the In [185], a resource monitor tool is used to monitor the CPU
RL algorithm is applied to converge to the equilibrium. consumption of network hypervisors, and the benchmarking
c) Admission Control (AC): The rapid growth of various tool hvbench is used to measure the control message rate.
devices in the data plane such as mobile phones and IoT The collected data is used to train three different regression
devices increases the service requests significantly. However, learning models to learn the mapping between the CPU con-
resources in the data plane are limited. Thus, admission control sumption and the control message rate. The trained mapping
in SDN is very important. The goal of admission control is models can be used to estimate whether network hypervisors
to manage a large number of service requests by accepting are overloaded in real time according to the measured control
or rejecting new incoming requests according to the resource message rate. The overload of network hypervisors has a

significant impact on the processing of each tenant’s control

Autonomic Manager
messages.
Ref. [186] goes a step further and extends the approach of Diagnoser DM AE
[185] to scenarios where the available computing resources
of hypervisors are fluctuant. A big change of the available Action
computing resources of hypervisors will make the current
mapping model invalid. To detect the resource change, the Monitor Orchestrator
CPU consumption information and the control message rate
information are collected continuously. Then, SVM is used to Sensor Data
compare the collected data and the current mapping model. If
most of the collected data in a time period do not fit the current Sensor Actuator
model, a big resource change has occurred. In this case, the
mapping model will be re-trained using the recently collected
Fig. 17. The intelligent control loop in SELFNET framework [191]. The
data. sensors in the network generate sensor data. The monitor analyzes and
b) Controller Placement: In SDN, the centralized con- aggregates the sensor data to detect network problems. The diagnoser is
troller has to process traffic flows from a large number of capable of diagnosing the root cause of network problems reported by the
monitor. Based on reasons of these problems, a set of corrective and preventive
switches deployed in different locations. The long distance methods are decided by the Decision-Maker (DM). Action Enforcer (AE) is
between the controller and switches will increase the traffic in charge of providing implementable actions to be enforced in the network
flow processing delay. In this case, the controller’s location infrastructure. The orchestrator and actuator are responsible for executing the
implementable actions.
has a significant impact on the network performance. Thus,
the controller placement problem should be studied seriously.
Heuristic algorithms are an approach to solve this problem. the next values of the system features at time t + 1 given
The high computational complexity is the main shortcoming of the numerical values of these features at time t. Secondly,
heuristic algorithms. Ref. [187], [188] have shown that super- the forecasted values of features are taken by decision tree
vised learning algorithms are effective to solve the controller algorithm to determine the most likely SLA Violation (SLAV)
placement problem. to occur. Then proactive management actions are taken to
In [187], [188], three supervised learning algorithms (i.e., avoid SLAV before they occur.
decision tree, neural network and logistic regression) are In [193], a statistical machine learning approach is proposed
applied to obtain the optimal controller’s locations. The input to increase the robustness of SDN-based Wireless Sensor
of training dataset used to train supervised learning algorithms Network (WSN) by predicting interference patterns over time.
is traffic distribution, and the output is the corresponding According to the interference prediction, the SDN controller
controller placement solutions of heuristic algorithms. After can modify network state to keep the system stable and to
training, the trained model can be applied to predict the prevent network malfunctions.
controller placement solutions in real time. On one hand, the 4) Analysis: In Table VI, we provide a comparison of the
predicted solutions are used directly as the optimal solutions. related works discussed above. From the related studies on
On the other hand, the predicted solutions can also be used as resource management, we can give the following analysis and
initial solutions of heuristic algorithms to reduce the algorithm summary.
runtime.
• The data plane resource allocation problem is generally
3) Others: Many works also have been done to solve other
issues related to resource management in SDN. considered as a decision-making task. In this case, RL
In [189], different ML approaches are used in a WiFi-Direct and ML-based game theory are two effective approaches.
network to estimate the number of active UEs, by leveraging RL is often used in the single-tenancy SDN network. In
only the network information available at the receiving nodes. multi-tenancy SDN network, resources in the data plane
Based on the prediction results of [189], the work in [190] are shared by multiple tenants. Each tenant’s utility can
estimates the remaining transmission time (i.e., the Estimated be affected by the resource allocation strategies of the
Time of Arrival (ETA)) during the file transmission in SDN- other tenants. Thus, ML-based game theory is suitable
based wireless networks. The accurate ETA prediction can to solve the data plane resource allocation problem in
help the clients to schedule their application-layer actions. multi-tenancy SDN network.
• Control plane resource allocation is generally considered
Ref. [191] studies the autonomic network management in
the software defined 5G systems. Autonomic Manager (AM) by network hypervisors to allocate their limited resources
is a key part to provide the network intelligence in the novel to multiple tenants. The mapping between the resource
management framework which is proposed by the SELFNET consumption and control message rate is very impor-
project. Diagnoser, Decision-Maker (DM) and Action Enforcer tant for control plane resource allocation. The mapping
(AE) are the three main functional blocks in AM. An intel- problem is generally considered as a regression task.
ligent control loop, shown in Fig. 17, is designed to provide Thus, supervised learning techniques can be used for the
the network intelligence in the SELFNET framework. mapping task. In the dynamic scenarios where the avail-
Ref. [192] studies the Service Level Agreements (SLA) able resources of hypervisors are fluctuant, the trained
management in SDN. Firstly, LSTM is used to calculate mapping model needs to be updated periodically.

TABLE VI
ML- BASED RESOURCE MANAGEMENT SOLUTIONS IN SDN.

Ref. Objective Learning model Complexity Brief summary

Using DRL to jointly allocate networking, caching and computing
Data plane re- resources in sofware-defined vehicular networks to maximize
[170] DRL High
source allocation network operators’ comprehensive revenue

Using DRL to jointly allocate networking, caching and computing

Data plane re- resources in smart cities to maximize network operators’ compre-
[171] DRL High
source allocation hensive revenue

Using RL to select the optimal configuration strategy to minimize

Service reconfig-
[172] RL Fair the long-term reconfiguration cost in VANET
uration
Using RL to select the optimal content delivery protocol (i.e.,
Content delivery
[173] RL Fair TCP/IP or CCN) to maximize the content distribution QoS
optimization
HAS traffic de- Using RL to select the optimal bitrate and quality to maximize
[174] livery optimiza- RL Fair users’ QoE when delivering HAS media content
tion
Cache-
Using ESN, a type of recurrent NNs, to predict the content request
enabled UAVs
[177] Recurrent NN High distribution and mobility pattern of each user
deployment
optimization
Regret-matching- Utilizing regret-matching-based game theory for RRH allocation
[131] RRH allocation based game Fair among MNOs to maximize RSS levels
theory
Using RL-based game theory method to solve the energy-efficient
Computation of- RL-based game
[132] Fair MEC server activation problem
floading in MEC theory
Using decision tree to predict the opponent’s network status, based
DT-based game on which the controllers make their optimal decisions to maximize
[133] Spectrum sharing Fair
theory the spectrum resource utilization

Using RL-based Stackelberg game theory to optimize the network

Network function RL-based game
[134] Fair function assignment between servers and users
assignment theory
Hypervisor
Using regression learning models to learn the mapping between
resource Regression learn-
[185] Low CPU consumption and control message rate
utilization ing model
estimation
Hypervisor Using SVM to calculate whether the recently collected data fits
[186] resource change SVM Fair the current mapping model
detection
Decision
Using supervised learning algorithms to obtain the controller
Controller place- tree, neural
[187] Fair placement solutions in real time
ment network, logistic
regression
Estimating the Different ML approaches to predict the number of active nodes
Naive Bayes,
[189] number of active Fair in a WiFi-Direct network
SVM, k-NN
nodes
Using LSTM to predict the values of system parameters, and using
SLA LSTM, decision
[192] High decision tree to determine the most likely SLA violation
management tree
Increasing Using ML techniques to predict interference patterns over time to
[193] robustness of ML approaches Fair increase the robustness of SDN-based WSN
WSN

E. Security anomaly-based IDS [195]–[198]. In signature-based IDS, hu-

mans are responsible for creating the signatures of known
Security is always an important aspect that needs to be attacks. When traffic flows arriving, signature-based IDS
considered by network operators. Only secure networks can be compares these traffic flows against the known signatures to
accepted and used by users. Intrusion detection is an important identify possible malicious activities. The signature-based IDS
element for network security. An Intrusion Detection System generally has high accuracy. However, it has some shortcom-
(IDS) is a device or software application and its objective is to ings. First, signature-based IDS can only recognize attacks
monitor the events in a network system and identify possible whose signatures are available. The growth of new attacks
attacks [194]. IDS is helpful for network operators to take makes the signature update difficult. Second, signature-based
appropriate actions before an attack occurs. IDS incurs high time consumption as all signatures need to be
Generally, there are two types of IDSs according to compared.
how they identify network attacks: signature-based IDS and

In contrast, anomaly-based IDS is a statistical method,

which uses the collected data related to the behavior of legiti- IoT-IDM
mate users to create a model. When traffic flows arriving, the Mitigation

traffic flows are compared with the model. The behavior which IoT Detection
has a significant deviation from the model will be marked Profile

as an anomaly. An advantage of anomaly-based IDS is that Feature Extractor

it can detect new types of attacks. Note that signature-based Device Manager Sensor Element
IDS is the type of payload-based traffic identification which
needs to inspect the whole payload of packets, while anomaly- API
based IDS is the type of flow-based traffic identification OpenFlow
SDN Controller
based on flow-granularity information such as packet header
information. In this paper, we focus on the anomaly-based Home Router
IDS.
Machine learning methods are widely used in anomaly-
Fig. 18. A typical smart home network architecture with IoT-IDM [203].
based IDS by training a model to identify normal activities and The IoT-IDM is composed of five key modules: Device Manager, Sensor
intrusions. The intrusion detection problem can be considered Element, Feature Extractor, Detection, and Mitigation. Device Manager is a
as a classification task. Thus, supervised learning algorithms database, known as IoT Profile, to store security related information of IoT
smart devices. Sensor Element is responsible for logging network activities on
are often applied for intrusion detection. a target smart device. Feature Extractor can extract features from the captured
In ML-based intrusion detection systems, the high dimen- network traffic. Detection is in charge of identifying suspicious activities. The
sionality of dataset input (i.e., flow features) has impact on the Mitigation module is able to take appropriate actions before the identified
attacks occur.
performance of ML algorithms. To speed up the process of
intrusion detection while maintaining high detection accuracy,
feature reduction is often done to reduce the dimensionality can reduce the traffic processing time while maintaining high
of dataset input. Feature selection and feature extraction are intrusion detection accuracy.
two well-known methods to reduce the dimensionality of flow Ref. [201] proposes an HMM-based Network Intrusion
features. Feature selection is a method to choose a subset of Detection System (NIDS) to predict malicious activities and
appropriate features from all flow features. Feature extraction enhance network security. Five selected flow features (i.e.,
is another way to reduce the dimensionality of flow features the length of the packet, source port, destination port, source
through feature transformation by extracting a set of new IP address and destination IP address) are used by HMM to
features from the original features. determine the maliciousness of a set of packets.
The capabilities of SDN (e.g., logically centralized control, Ref. [202] proposes a framework called ATLANTIC to
global view of the network, software-based traffic analysis, and perform anomaly traffic detection, classification and mitigation
dynamic updating of forwarding rules) facilitate the ML-based jointly in SDN. The ATLANTIC framework performs anomaly
intrusion detection and enhance the network security [199]. detection and classification in two phases: a lightweight phase
First, the global network view of the SDN controller simplifies and a heavyweight phase. The lightweight phase uses informa-
the collection and analysis of network traffic. Moreover, the tion theory to calculate deviations in the entropy of flow tables.
programmability of SDN makes it easy to react to network The heavyweight phase utilizes SVM algorithm to classify
attacks immediately when they are detected. Many studies the abnormal traffic. Then, ATLANTIC takes appropriate
have been done for ML-based intrusion detection in SDN, such mitigation actions to process malicious flows automatically
as coarse-grained intrusion detection, fine-grained intrusion and analyze unknown traffic flows manually by a human
detection and DDoS attack detection. In the following, the administrator.
related studies will be summarized. In [203], an intrusion detection and mitigation architecture,
1) Coarse-grained Intrusion Detection: Coarse-grained in- called IoT-IDM, is proposed in smart home environment to
trusion detection aims to classify traffic flows as normal and protect smart devices, by leveraging machine learning tech-
abnormal classes. niques to detect malicious activities. The IoT-IDM, shown in
Ref. [200] proposes a threat-aware system to perform detec- Fig. 18, is composed of five key modules: Device Manager,
tion and make response to network intrusion in SDN, which Sensor Element, Feature Extractor, Detection, and Mitiga-
is composed of data preprocessing, predictive data modeling, tion. An IoT-IDM prototype is implemented as a module of
and decision making and response subsystem. First, a forward Floodlight and the applicability and efficiency of IoT-IDM
feature selection strategy is used by the data preprocessing architecture have been demonstrated.
subsystem to select appropriate feature sets. Then, decision Ref. [204] leverages four ML algorithms (i.e., decision
tree and random forest algorithms are applied by the predictive tree, BayesNet, decision table and Naive Bayes) to predict
data modeling subsystem to detect malicious activities. Based the potential malicious connections and vulnerable hosts. The
on the intrusion detection results, the decision making and prediction results are used by the SDN controller to define
response subsystem uses reactive routing to install different security rules in order to protect the potential vulnerable
flow rules for different flow types. Comprehensive experiments hosts and restrict the access of potential attackers by blocking
have been done and the results show that by using the forward the entire subnet. The performance of these ML algorithms
feature selection strategy, the proposed threat-aware system is compared. The results indicate that BayesNet has better

performance than the other three algorithms, and the average IDS module to detect whether the hosts are anomalous or
prediction accuracy achieved by BayesNet is 91.68%. the authorized users. In this way, the processing time of the
In [205], deep NN model is used in SDN to detect intrusion Advanced IDS module is reduced because only hosts with
activities, by classifying traffic flows into normal and anomaly anomalous behaviors need to be analyzed.
classes. The deep NN model with an input layer, three hidden In [98], a deep learning model is used to detect DDoS
layers and an output layer is trained based on the NSL-KDD attacks in SDN. Recurrent NN and convolutional NN are
dataset [206]. When the SDN controller detects a network included in the deep learning model. The deep learning model
anomaly, the OpenFlow protocol is used to modify switches’ consists of an input layer, a forward recursive layer, a reverse
flow tables in order to prevent attacks. The experiment results recursive layer, a fully connected hidden layer and an output
show that the deep NN model has a good performance in layer. After the collection and analysis of network traffic
anomaly detection, and the average detection accuracy is feature information, the deep learning model is used for feature
75.75% when using only six basic flow features. reduction and DDoS attack detection.
Ref. [207] uses deep recurrent NN in an anomaly-based In [212], an SDN-based DDoS detection system is proposed.
IDS and proposes a Gated Recurrent Unit Recurrent Neural The system first extracts 68 flow features from the collected
Network (GRU-RNN) algorithm to detect intrusion. To speed network traffic, including 34 features from TCP flows, 20
up the intrusion detection and reduce the computational cost, features from UDP flows, and 14 features from ICMP flows.
only six flow features such as duration and protocol type are Then, a deep learning model is applied for feature reduction
used to train the GRU-RNN algorithm. and DDoS attack detection.
2) Fine-grained Intrusion Detection: Fine-grained intrusion 4) Others: There are other works related to the SDN
detection aims to give a fine-grained classification of network security.
traffic and identify different types of attacks. Ref. [213] studies the application software fault identifica-
The authors of [208] propose an improved behaviour-based tion in SDN. The application faults have significant impact on
SVM to categorize network attacks. To increase the intrusion the SDN network and other applications in the application
detection accuracy and speed up the learning of normal and plane. Two proof-of-concept examples of application faults
intrusive patterns, decision tree is used as a feature reduction are presented. ML approaches are utilized to detect these
approach to outrank raw features and select the most qualified application faults. The detection results can guide the SDN
features. These selected features are the input data to train the controller to take appropriate network response in real time.
SVM classifier. The authors of [214] focus on software defined firewall
In [209], a novel deep learning-based intrusion detection and propose a framework to match flows quickly and capture
method called NDAE is proposed. To speed up the intrusion user behavior efficiently. HMM is applied to capture state
detection while maintaining high detection accuracy, NDAE information of user behaviors and identify whether a network
combines the deep learning approach and random forest, where connection is legitimate or not. If an illegitimate connection
deep learning approach is applied for feature reduction, and is found, the firewall can block access of that connection in
random forest is used for traffic classification and intrusion time. Then, these information along with the corresponding
detection. packet’s fields are utilized to train a neural network model.
3) DDoS Attack Detection: DDoS attack is a major threat to The trained model is able to match flows quickly instead of
cyber security in SDN. The goal of a DDoS attack is to exhaust comparing a packet flow against each firewall filtering rule.
system resources by simultaneously sending a large number of In [215], machine learning approaches are applied in the
fake requests using many puppet machines so that legitimate SDN-based High Throughput Satellite (HTS) systems (shown
users’ requests are not processed. In SDN, the DDoS attack as Fig. 19) to predict feeder-link outage. Linear regression,
can exhaust the networking, storage and computing resources neural network and Bayes methods are used to predict SINR
in the data plane and the control plane, which will make in the future. If the SINR is below a given threshold, link
the SDN network unavailable. Thus, DDoS attack detection outage may happen. In the circumstance, the SDN controller
is important for the normal running of SDN networks. should reroute the network traffic and orchestrate the gateway
In [210], a lightweight DDoS attack detection method is handover operations.
proposed and implemented on a NOX-based SDN network. 5) Analysis: From these related works on network security,
The NOX controller collects traffic flow feature information we can give the following analysis and summary.
from OpenFlow switches. Then SOM [118], [119] is used • Fine-grained intrusion detection is often applied for fine-
to perform DDoS attack detection according to the collected grained network management. By identifying different
traffic flow features. types of attacks, the SDN controller can make appropriate
Ref. [211] implements a new IDS in the SDN controller reactions for each type of network attacks. However,
to detect DDoS attacks. The proposed IDS consists of two compared with coarse-grained intrusion detection, fine-
modules: Signature IDS and Advanced IDS. Different ML al- grained intrusion detection requires a more complex
gorithms, such as k-NN, Naive Bayes, k-means and k-medoids, labeled training dataset.
are utilized by the Signature IDS module to classify traffic • KDD99 [216] and NSL-KDD [206] are two widely-
flows as normal and abnormal and find a set of hosts with used datasets for IDS research. NSL-KDD is a modified
anomalous behaviors. Then, the packets sent by these hosts version of KDD99 dataset and has solved many inherent
with anomalous behaviors will be checked by the Advanced problems of KDD99 dataset. Thus, when researchers

Queue Manager and Naive Bayes) is compared and evaluated in [204].

Strategy (Congestion
estimation) The results indicate that BayesNet has better performance
SDN NCC/GW
Rerouting
SINR Manager than the other three algorithms. The experiments in [211]
Controller Manager (Outage
Engine estimation)
SAT show that Baysian algorithm has better performance than
k-NN. Compared with conventional machine learning
algorithms, deep learning is better for intrusion detection
due to its multiple-level feature representation capability.
Ref. [205] compares the deep learning algorithm with
three other ML algorithms (i.e., Bayes’ theory, SVM and
NCC1 GW1
decision tree). The experimental results show that the
deep learning algorithm has higher intrusion detection
NCC2 GW2 NCC3 GW3
accuracy. However, the complexity of the deep learning
algorithm is higher than the other three ML algorithms
S1 (i.e., Bayes’ theory, SVM and decision tree). The ex-
periments in [98] indicate that increasing the volume of
S2 S3
training datasets not only improves the performance of
SINR information
Queue status
deep learning model significantly, but also increases the
Rerouting configuration (OpenFlow) training time and complexity of deep learning model.
Therefore, there is a tradeoff between detection perfor-
mance and model complexity.
Finally, the ML-based solutions discussed in the section and
Fig. 19. An example of SDN-based HTS system [215]. NCC stands for
Network Control Centre, GW for gateway. The NCC/GW Manager collects the their pros and cons are compared in Table IX and Table X.
SINR information from NCCs and Queue status from GWs. These information
is used by machine learning techniques to estimate the outage and congestion.
Rerouting Engine decides policies based on the estimation results to modify VI. C HALLENGES AND F UTURE R ESEARCH D IRECTIONS
network state through the SDN controller. Despite current works being done in SDN, with the require-
ments of robustness and maturity in the area, many significant
research challenges remain to be addressed prior to widespread
want to simulate the performance of ML-based intrusion implementation of a fully intelligent SDN in the near future. In
detection methods, it is better to use the NSL-KDD this section, we discuss challenges and present future research
dataset. directions. Furthermore, the role of ML algorithms to address
• To enhance network security, real-time intrusion detec- these challenges is also discussed.
tion is required. Feature reduction is an effective way
to optimize system performance and speed up attack A. High-quality Training Datasets
detection. As mentioned above, feature selection and In order to improve the estimation or classification accuracy
feature extraction are two well-known methods to reduce of the models trained by machine learning techniques, enough
flow features. Most of the related works select flow training datasets are needed [2]. What is sufficient training
features according to researchers’ experience. Decision data in networking? Therefore, it is a research direction to
tree is another feature selection method by analyzing raw study the relationship between the training dataset size, the
features and choosing the most qualified features [208]. network characteristics, and the performance of the machine
Deep learning is a widely-used feature extraction method learning models. On the other hand, progress in machine learn-
due to its strong feature representation capability [217]. ing algorithms heavily depends on the availability of high-
• The performance of supervised learning algorithms de- quality standardized training datasets. However, it is difficult
pends on training datasets. Thus, in Table VII, we provide to obtain high-quality annotated network flow samples across a
a detailed comparison of the related works discussed broad range of applications [139]. To solve this problem, one
above, from the perspectives of objective, feature reduc- possible approach is to public datasets, which is a common
tion method, intrusion detection method, training dataset, solution in several popular machine learning applications, such
training dataset input and output. In Table VIII, we as image recognition [220]. In this respect, it is necessary
summarize the performance of the ML-based intrusion to initiate similar activities for the publication of datasets in
detection solutions, from the perspectives of complexity, networking AI field.
lower bound, upper bound, and average detection accu-
racy.
• As the intrusion detection problem can be considered as B. Distributed Multi-controller Platform
a classification task, supervised learning algorithms are Network scalability is a critical issue in SDN. When a single
often applied to detect abnormal activities. Ref. [200] controller is deployed in the control plane, with the increasing
points out that random forest has better performance than of network size and the number of flows, the controller usually
decision tree. The performance of four machine learning faces the scalability issue due to the computation limitation of
algorithms (i.e., decision tree, BayesNet, decision table, a controller [221]. Distributed multi-controller platforms [40],

TABLE VII
ML- BASED INTRUSION DETECTION SOLUTIONS IN SDN.

Feature Intrusion
Ref. Objective reduction detection Training dataset Dataset input Dataset output
method method
Coarse- A forward
2 classes: normal and
grained feature
[200] DT, RF KDD99 Ten features anomaly
intrusion selection
detection strategy
Five features: the length
Coarse-
of the packet, source port, 2 classes: normal and
grained Collected
[201] - HMM destination port, source IP anomaly
intrusion network traffic
address and destination IP
detection
address
Coarse-
2 classes: normal and
grained Collected
[202] - SVM IP address, transport port anomaly
intrusion network traffic
detection
Coarse-
2 classes: normal and
grained Collected Three features such as
[203] - SVM attack
intrusion network traffic inter-packet time interval
detection
DT,
Coarse-
BayesNet, Attacker IP, attacked host, 2 classes: normal and
grained
[204] - decision LongTail [218] number of attempts in an attack
intrusion
table, Naive attack, and timestamp
detection
Bayes
Coarse- Six features: duration,
2 classes: normal and
grained protocol type, source
[205] - Deep NN NSL-KDD anomaly
intrusion bytes, destination bytes,
detection count and service count
Coarse-
2 classes: normal and
grained Recurrent Six features such as dura-
[207] - NSL-KDD anomaly
intrusion NN tion and protocol type
detection
5 classes: normal and
Fine-grained four types of network
[208] intrusion DT SVM KDD99 23 features attacks (i.e., DoS,
detection U2R, R2L and Probe)

5 classes: normal and

Fine-grained four types of network
KDD99, NSL-
[209] intrusion Deep NN RF 41 features attacks (i.e., DoS,
KDD
detection U2R, R2L and Probe)

Six features such as av-

2 classes: normal and
DDoS attack Collected erage of packets per flow
[210] - SOM DDoS
detection network traffic and average of bytes per
flow
Naive Bayes,
2 classes: normal and
DDoS attack k-NN, k- Collected
[211] - - DDoS
detection means, network traffic
k-medoids
2 classes: normal and
DDoS attack ISCX dataset
[98] Deep NN Deep NN 20 features DDoS
detection [219]
8 classes: normal and
68 features: 34 from TCP
DDoS attack Collected seven types of DDoS
[212] Deep NN Deep NN flows, 20 from UDP flows
detection network traffic attacks
and 14 from ICMP flows
Application
ML
[213] fault - Using ML approaches to detect application software faults in SDN
approaches
identification
Firewall Neural
[214] performance - network, A ML-based software defined firewall to process packets quickly
optimization HMM
Feeder- Neural
Developing a feeder-link outage prediction algorithm in the SDN-
[215] link outage - network,
based HTS system
prediction Bayes

TABLE VIII
P ERFORMANCE OF THE ML- BASED SOLUTIONS IN SDN.

Classification accuracy
Ref. Learning model Complexity
Lower bound Upper bound Average
[144] Decision tree Low 85% 98% >90%
[139] Random forest Fair 73.6% 96% 86.4%
[145] ML classifier Low - - >85%
[146] SVM Fair 78% 99.9% >90%
Traffic [140] Decision tree Low 82% 100% 94%
Classification [147] Deep NN High 85% 100% 93.5%
Decision tree Low 85% 100% 95.5%
[148]
k-NN Low 70% 99.1% >90%
Semi-supervised
[141] Fair 81% 92% >90%
learning
[150] Neural network Fair 83.2% 88.2% 84.81%
Routing
[151] Neural network Fair 95.5% 97.85% 97%
Optimization
[159] Neural network Fair 87% 96% 93%
[163] Neural network Fair - - Over 98%
[164] Decision tree Low - - Not mentioned
Random forest Fair 71% 98% Over 90%
[165]
Regression tree Low 68% 98% Over 90%
QoS/QoE [166] ML algorithm Low - - Not mentioned
Prediction The Pearson corre-
Decision tree,
lation coefficient of
neural network,
[167] Fair - - four ML algorithms
k-NN, random
are 0.79, 0.68, 0.75
forest
and 0.8 respectively
Naive Bayes Low 85.1% 99.3% 92%
Linear SVM Fair 86.1% 99.8% 92.8%
Resource [189]
Radial SVM Fair 87.1% 99.1% 93.1%
Management
k-NN Low 87.2% 99.6% 93.4%
[192] Decision tree Low 82.2% 90.9% 87.4%
Decision tree Low 45.02% 91.18% 82.48%
[200]
Random forest Fair 45.02% 99.41% 98.75%
[201] HMM Fair - - 88%
[202] SVM Fair - - 88.7%
[203] SVM Fair - - 96.2%
Decision tree Low 78.62% 91.4% 86.19%
BayesNet Low 73.56% 99.89% 91.68%
[204]
Decision table Low 70.36% 99.99% 88.52%
Naive Bayes Low 67.7% 99.52% 87.78%
Deep NN: 75.75%,
decision tree: 74%,
[205] Deep NN High 72.05% 91.7%
SVM: 70.9%, Bayes’
theory: 45%
RNN: 89%, SVM:
[207] Recurrent NN High - -
Security 65.67%
[208] DT + SVM Fair 97.52% 99.79% 97.55%
NSL-KDD dataset:
[209] Deep NN + RF High - 97.73%/99.79% 85.42%, KDD99
dataset: 97.85%
[210] SOM Low - - 98.61%
Naive Bayes, k- Naive Bayes: 94%, k-
[211] NN, k-means, k- Low - - NN: 90%, k-means:
medoids 86%, k-medoids: 88%
[98] Deep NN High 94.39% 99.79% 97.56%
[212] Deep NN High - - 95.65%
[213] ML approaches Low - - -
Neural network,
[214] Fair - - -
HMM
Neural network,
[215] Fair - - -
Bayes

TABLE IX
A DVANTAGES AND SHORTCOMINGS OF THE ML- BASED SOLUTIONS .

Ref. Advantages Shortcomings

Both accuracy and cost-sensitive are considered The classification of elephant flows with different
[144]
when detecting elephant flows. QoS requirements has not been considered.
A single OpenFlow switch is deployed in an enter-
[139] Only TCP traffic is taken into account.
prise network to collect data.
MultiClassifier is proposed for application classifica- Calculation consumption of the SDN controller is
[145]
tion. high and the scheme cannot scale to a large network.
SVM algorithm is used to classify UDP traffic ac-
[146] Only UDP traffic is taken into account.
cording to Netflow records.
Traffic
A crowd sourcing approach is used to collect ground
Classification [140] Only 40 Android applications are tested.
truth data from end devices.
Flow features are selected manually to train the deep
[147] Deep NN is used to identify mobile applications.
NN model.
Users’ mobile devices need run an “agent” software
[148] Both application name and flow types are identified.
to communicate with the SDN controller.
Applications with time-dynamic QoS requirements
Network traffic is classified into different QoS
[141] are not considered.
classes.
The heuristic algorithm’s input and its corresponding
[150] output are the training dataset of the ML-based meta- The dynamic network topology is not considered.
layer.
Neural network model is applied to obtain real-time Only network delay is considered while ignoring the
[151]
heuristic-like routing solutions. load balance of the total network traffic.
RL method is applied to improve the performance of The proposed routing protocol is tested in a virtual
[152]
routing protocols. SDN.
Random NN and RL are used to find the optimal
[153] Only one cloud tenant is considered.
network paths.
Routing A multi-layer hierarchical SDN scenario is investi- Only the QoS requirements of widely-used applica-
[155]
Optimization gated. tions are taken into account.
Only network delay is considered, while other per-
[156] DRL model is applied for routing optimization.
formance like throughput is ignored.
Neural network model is applied to predict network The route change and link congestion are not con-
[158]
traffic load in advance. sidered.
Neural network model is used to predict the load of
[159] The dynamic network topology is not considered.
each path.
K-means method is used to cluster network traffic The controller’s load is high.
[162]
into several clusters of risk ratios in an off-line mode.
A linear regression algorithm is applied to perform
The comparison between different machine learning
[164] root cause analysis and discover each KPI’s quanti-
algorithms is not considered.
tative impact.
Two learning methods are used to estimate The overhead of the used feature selection method
[165]
QoS/QoE application-aware QoS metrics. is high.
Prediction A ML-based approach and adaptive video delivery
Other services such as video conference and real-
[166] service are combined to provide a better QoE for
time applications are not analyzed.
video streaming service.
QoS parameters such as response time and transmis-
Four machine learning algorithms are used to predict
[167] sion delay are not considered.
QoE values.
An integrated framework is proposed to improve
the performance of vehicular networks by allocating Energy efficiency issue in the integrated framework
[170]
the networking, caching and computing resources is not considered.
jointly.
An integrated framework is proposed to improve
the performance of applications in smart cities by Energy efficiency issue in the integrated framework
[171]
allocating the networking, caching and computing is not considered.
resources jointly.
RL is utilized to minimize the long-term reconfigu- The overall complexity of the RSU cloud system is
[172]
ration cost. not discussed.
Resource
RL method is used to select the optimal protocol
Management [173] Calculating time of the proposed algorithm is long.
(i.e., TCP/IP or CCN) to deliver different services.
Only three features (i.e., device resolution, content
A cluster-based mechanism is presented to increase
[174] type and user expectation) are considered to optimize
the scalability of the SDNHAS system.
each HAS player’s QoE.
ESN is used to predict the content request distribu-
[177] Only the downlink transmission is considered.
tion and mobility pattern of each user.
A ML-based game theoretical approach is applied
[131] Information exchange is required among RRHs.
for efficient RRH assignment among MNOs.
Game theory is applied by MEC servers to make The offloaded computing tasks are assumed to be
[132]
activation decisions. equally divided among the active servers.
Decision tree algorithm is used to predict the oppo- The energy efficiency issue is not considered.
[133]
nent’s network status.
Continued on next page

TABLE X
A DVANTAGES AND SHORTCOMINGS OF THE ML- BASED SOLUTIONS ( CONTINUED ).

Continued from previous page

Ref. Advantages Shortcomings
RL algorithm is applied to converge to the equilib-
[134] The price charged to users is constant.
rium of Stackelberg game.
Three learning models are used to learn the mapping
The available computing resource of hypervisors are
[185] between the hypervisor’s CPU consumption and the
constant.
control message rate.
SVM is used to detect the change of hypervisors’ Only the computing resource (i.e., CPU) is taken into
[186]
available computing resource in dynamic scenarios. account.
Resource
ML algorithms are used to obtain the real-time Features such as network connectivity are not con-
Management [187]
controller placement solutions. sidered.
Only the information available at the receiving nodes The selection of master nodes in a D2D WiFi-Direct
[189]
is used to estimate the number of active UEs. network is not considered.
LSTM and decision tree are used to predict the most
[192] Only two use cases are discussed.
likely SLA Violation.
Statistical machine learning is used to predict inter- Comprehensive experiments have not been done.
[193]
ference patterns in WSN.
Reactive routing is used to install different flow rules Relevant contextual information is not considered in
[200]
for different flow types. the intrusion detection system.
Each of the selected features (e.g., the length of the
HMM is used to predict malicious activities and
[201] packet and source port) is treated as an independent
enhance network security.
event.
Unknown traffic flows are analyzed manually by a
[202] SVM is utilized to identify abnormal activities.
human administrator.
The intrusion detection and mitigation process of all
Machine learning techniques are used to detect ma-
[203] smart devices in a home network are not feasible by
licious activities of smart devices.
using IoT-IDM.
Four machine learning algorithms are used to predict
The entire subnet is blocked to prevent potential
[204] the potential malicious connections and vulnerable
attacks.
hosts.
Deep NN model is applied to classify traffic flows Only six features are utilized to train the deep NN
[205]
into normal and anomaly classes. model.
[207] Deep recurrent NN is used in an anomaly-based IDS. Only six features are considered to detect intrusion.
Security Decision tree is used as a feature reduction approach Comparison between SVM and other ML algorithms
[208]
to select the most qualified features. is not given.
The performance of the proposed NDAE based on
Deep learning is applied for feature reduction, and
[209] real-world backbone network traffic has not been
random forest is used for intrusion detection.
evaluated.
Which hosts are launching attacks cannot be deter-
[210] SOM is used to detect DDoS attack in SDN.
mined precisely.
Different machine learning algorithms are used to
[211] Only the DDoS attack is considered.
classify network traffic as normal and abnormal.
The SDN controller has a high overhead when per-
[212] Deep learning is applied to detect DDoS attack. forming feature extraction and DDoS attack detec-
tion.
The scalability of the proposed method is not dis-
HMM is applied to identify whether a network
[214] cussed when the number of firewall filtering rules is
connection is legitimate or not.
large.
A full SDN-based network architecture has not been
ML approaches are used to predict feeder-link outage
[215] designed.
in HTS system.

[155], [222], [223] have been proposed to solve the scalability to process inter-domain traffic flows based on the global view
issue. In general, a distributed multi-controller platform is of the entire network. In order to reduce the system response
composed of a logically centralized root controller and several time, the root controller can deploy the trained RL models
local controllers. The root controller has a global view of on the local controllers periodically. The trained RL models
the entire network and has full accessibility to all of the will guide the local controllers to process inter-domain traffic
switches. On the contrary, each local controller has network flows directly. The multi-level RL scheme not only reduces
status information in a domain and can only control part of the processing delay of traffic flows, but also improves the
the switches. scalability of the SDN network.
In order to optimize the routing of intra-domain and inter- Due to the single point failure of the controller, reliability
domain traffic flows, a multi-level RL scheme can be used, is another critical issue in SDN. To solve the reliability
where the root controller is the higher-level learning agent and issue of the SDN controller, a cluster of controllers can be
the local controllers are the lower-level learning agents. Each deployed to control and manage an SDN network. When a
lower-level learning agent learns to make the optimal decisions flow table update request arrives, it can be processed by a
to route intra-domain traffic flows based on its local network cluster of controllers. It is interesting to study how to select
status information, while the higher-level learning agent aims an optimal controller to process the flow table update request.

RL algorithm is a possible approach to solve the problem. In optimization, such as physical layer parameters adaptation,
this case, the network hypervisor works as a learning agent. resource allocation, topology construction, routing mechanism
The agent aims to maximize network utility by selecting an and congestion control. Therefore, it is interesting to study the
optimal controller to process the flow table update request ML-based cross-layer optimization approaches in SDN.
according to the health condition, resource usage, as well as
other information of each controller. E. Incrementally Deployed SDN
Despite the promising prospect of SDN, its deployment
C. Improving Network Security
needs to update all network switches to be SDN-aware. In the
The separation of data plane and control plane reduces the circumstance, the widespread deployment of pure commercial
complexity of network devices and provides a flexible network SDN would not be done in the near future. The incremental
management. Since switches in the data plane do not have any deployment [228], [229] is a feasible solution. In such a
intelligence, they just send raw data packets to the controller. network, SDN switches and controllers are incrementally
Unfortunately, this behavior introduces a serious vulnerability deployed in the traditional network and only parts of the
which can be used by attackers to overload the controller network traffic is controlled by the controller. In this scenario,
through a large number of flow requests. ML-based anomaly how to perform effective traffic engineering and optimize
detection is often used by the SDN controller to detect and resource allocation remains an active research direction. One
process network attacks. However, anomaly detection is an possible solution is that the SDN controller communicates with
adversarial problem where malicious attackers are continually the other traditional network nodes to exchange link weights,
trying to create new attacks to avoid detection of the controller. available bandwidth and topology information. In this way,
In this case, using historical data to train ML models may not the SDN controller gets the required network information.
be an effective method to detect attacks due to the crafting of By analyzing these information, as well as collected flow
new attacks. Generative Adversarial Network (GAN) [224] is statistics information from SDN-enabled switches, machine
a possible approach to solve the problem by predicting new learning algorithms can be utilized to create models, with
attacks. which resource allocation optimization and traffic engineering
GAN is comprised of two neural networks. One neural can be performed effectively.
network, called the generator, generates new data, while the
other neural network, called the discriminator, is responsible
VII. S OME B ROADER P ERSPECTIVES
for evaluating the new data for authenticity according to the
real training dataset. The generator and discriminator train Since SDN has attracted widespread attention and been
themselves together to make the generated new data more real- studied widely, its development can be influenced by a lot
istic. GAN can be employed to generate possible new attacks’ of other technologies. In the mean time, the SDN architecture
data based on the historical data. After training ML models by also impacts both wired and wireless networks, such as vehicle
using the generated new data and the historical data, the trained networks, cellular networks (e.g., 4G and 5G networks) and
ML models can detect the known attacks and possible new sensor networks. In this section, some broader perspectives of
attacks. Based on the attack detection, the controller is able to applications of ML-based SDN in different network scenarios
modify flow tables in switches in advance to prevent network are presented.
attacks and limit the communication between the control plane
and the data plane. A. Software Defined Network Function Virtualization
Network Function Virtualization (NFV) [230] is a promis-
D. Cross-layer Network Optimization ing technology to enable a more flexible and open network
Traditionally, networking is divided into different layers, architecture, by virtualizing network functions and decoupling
and a set of protocols are designed for communications network functions from the underlying specialized hardware.
between adjacent layers. In traditional networks, direct com- NFV makes network reconfiguration quick and adaptive. In
munications between non-adjacent layers are not allowed. addition, it can reduce ISPs’ capital expenditures for scaling
Recent studies [225]–[227] show that sharing information up the network. NFV and SDN are two closely related
between non-adjacent layers can improve network perfor- technologies to make the network easy to control and manage.
mance significantly. However, the cross-layer design breaks The difference between them is that SDN is applied to control
the principle of modularity and makes the network so complex network resources, while NFV focuses on the softwarization
that traditional approaches are inadequate to optimize such of network functions by using virtualization technologies.
networks. Fortunately, ML algorithms can be utilized for the Integrated with SDN, the software defined NFV architecture is
cross-layer network optimization. able to jointly optimize network functions and resources [62],
In SDN, the controller has a global network view and can [231]. The goal of the software defined NFV architecture is to
collect the cross-layer information from all different layers, automate network configuration, provision and management.
such as channel state information at the physical layer, packet ML can promote the dynamic service provision and the
information at the data link/network layers, and application in- network resource utilization optimization in software defined
formation at application layer. Then the collected information NFV systems. Now many works have been done to reduce
can be used by machine learning algorithms to do the network the service providing cost and improve the utilization of

network resources by using ML techniques, especially RL C. Software Defined Optical Networks

algorithms. In [232], Markov Decision Process (MDP) and Optical networks have high transmission capacities and are
Bayesian learning method are applied to optimize the dynamic widely deployed in our modern information systems. On the
resource allocation for NFV components. Ref. [233] focuses other hand, the specific optical transmission and switching
on the Service Function Chaining (SFC) in NFV. RL is used characteristics, such as burst, circuit and packet switching
to create service chains dynamically based on the resource on wavelength channels, make it difficult to control optical
usage condition to enable efficient service providing. The networks. To solve the problem, Software Defined Optical
network function assignment issue has been studied in [134]. Network (SDON) [55], [242] has been proposed to enable
The network function assignment problem is formulated as a the networking applications to use underlying optical network
two-stage Stackelberg game, where servers act as the sellers infrastructure dynamically and efficiently, by leveraging the
of network functions and users act as the buyers of network ability of logically centralized control in SDN.
functions. RL algorithm is applied to obtain the optimal The main difference between optical networks and other
network function assignment strategy. networks is the optical physical layer of optical networks
where lightpaths are established to transmit data. The Quality
of Transmission (QoT) of a lightpath can be affected by many
network parameters such as baud rate, code rate, modulation
B. Software Defined Edge Computing
format, and so on. In order to improve the design and planning
With the popularity of smartphones and wearable gadgets, of optical networks, QoT prediction prior to the deployment
such as smart glass, smart watch and smart bracelet, Edge of a new lightpath is very important. Supervised learning
Computing as a novel paradigm has attracted widespread algorithms are effective methods to perform QoT prediction.
attention. In recent years, a few Edge Computing architectures In [243], k-NN and random forest are used to predict QoT
have been presented, such as Cloudlet [234], Edge Comput- according to the lightpath total length, traffic volume, the
ing [235], Fog Computing [236], Mobile Cloud Computing longest link length, modulation format and the number of
(MCC) [237], Mist Computing [238] and Mobile-Edge Com- lightpath links. Ref. [244] uses neural network as the QoT
puting (MEC) [239]. prediction tool.
Fault management is another critical task in optical net-
A critical role of Edge Computing is computation offloading
works. Lightpaths have high data transmission capacities,
of computation-intensive tasks from the less capable devices
so the failure of several lightpaths can result in huge data
to the powerful edge servers, hence extending the battery
losses. Supervised learning algorithms are effective data-driven
life time of the devices as well as speeding up the process
methods to manage network faults based on historical failure
of computation-intensive tasks. Computation offloading is a
incidents [245]. In [246], statistical machine learning tech-
challenging problem due to the dynamic mobile environment
niques are used for failure localization by predicting each
such as mobility, heterogeneity, varying network conditions
link’s failure probability. Ref. [247] uses neural network to
and user requirements. The computation offloading problem
assess the network performance by predicting the blocking
is generally considered as a decision-making task. Supervised
probability of optical networks.
learning algorithms, especially neural networks, are effective
In addition, in order to provide flexible, reconfigurable and
to obtain the optimal heuristic-like offloading decisions. Ref.
economical end-to-end services, RL is often utilized to allocate
[240] focuses on the computation offloading problem from
resources in the optical network infrastructure components
mobile users’ perspective, and uses a deep learning approach
efficiently. In [248], RL is applied for resource allocation
to decide which tasks are offloaded to edge servers. An
optimization to meet the service requirements.
exhaustive-based optimal offloading algorithm is utilized to
In summary, ML is an effective data-driven method to
obtain the labeled training dataset, which is used to train the
improve the performance of optical networks by facilitating
deep learning model. RL is another effective approach for
the flexible optical transmission management and the cost-
decision-making tasks. In [241], the computation offloading
effective resource utilization.
problem is considered from edge servers’ perspective. RL
algorithm is used by edge servers to allocate their limited com-
puting resources according to the dynamic resource requests D. Software Defined Internet of Things
from mobile users. In the future, nearly everything will be connected to the
Although many works have been done for computation Internet, from traditional communication tools (e.g., laptops
offloading, only local network information is used by mobile and smartphones) to home appliances (e.g., refrigerators and
users and edge servers to make decisions. To use computing garage doors). Typically, an Internet of Things (IoT) archi-
resources more efficiently, global network information, includ- tecture can provide different applications such as intelligent
ing available computing resources of edge servers, resource transportation systems [249], smart health-care [250], [251],
requirements from mobile users and dynamic network condi- and smart energy systems [252]–[254], by leveraging large-
tions, should be considered to make computation offloading scale distributed embedded systems to connect billions of
decisions. In this case, the software defined Edge Computing sensors and RFID nodes. In order to manage the rapidly
is proposed to meet the requirements of mobile users and increasing number of devices, an intelligent, efficient, secure,
improve the utilization of computing resources [59]. cost-effective and scalable IoT needs to be designed. In this

case, the software defined IoT architecture [255] is proposed approaches make data forwarding decisions based on link
to satisfy the requirements of IoT. In the software defined IoT information among vehicles. In [266], [267], fuzzy logic
architecture, the billions of connected devices are controlled is employed to evaluate wireless links by considering link
by the network operators and users remotely, and the real-time quality, the available bandwidth and vehicles’ mobility. Then,
information is collected to provide intelligent services [58]. the evaluation results are used by Q-learning algorithm to
There is no doubt that IoT devices will generate a large select the optimal route. In [268], a collaborative Learning
amount of data [256]. ML techniques are often applied to pro- Automata (LA)-based routing strategy is proposed to select
cess these data. Most of the ML algorithms generally require the optimal path with minimum delay adaptively according
many storage and computing resources, thus a natural way to to vehicle-related information such as vehicle density and
train ML models is to use a centralized approach. However, distance from RSUs. A ML-assisted Route Selection (MARS)
transferring huge amounts of raw data to the centralized SDN system is proposed by [269] to optimize routing decisions. The
controller consumes a lot of network bandwidth. In order to re- k-means algorithm is applied to predict vehicles’ movement.
duce network bandwidth consumption and improve the system Based on the prediction results, routing paths with better
response time, edge computing is often used to pre-process the transmission capacity will be selected to transmit information.
raw data [257]–[259]. Then, the reduced intermediate data is Different from topology-based routing approaches, position-
transferred to the centralized SDN controller. This way not based routing approaches make data forwarding decisions
only reduces the amount of transferred data, but also speeds based on vehicles’ position information [270]. In [271], a city
up the training of ML models in the SDN controller. By is divided into multiple grids. Vehicles in different grids select
deploying the trained ML models on edge servers, the system the optimal next-hop grid to transmit information by using Q-
can improve the response time of IoT services. learning algorithm.
Network security is an important research direction in IoT. Topology-based routing approaches can select the neighbor
Supervised learning algorithms have been applied to enhance vehicle with a better link condition to transmit information,
security of the edge computing-based IoT systems. In [260], but they may make the local optimal decisions due to the lack
deep NN is used to perform anomaly detection at edge servers. of destination vehicles’ position information. On the contrary,
SVM is employed by [261] to analyze sensor data and detect position-based routing approaches can decrease the communi-
anomaly activities. Ref. [262] uses deep learning to detect the cation hops by selecting the neighbor vehicle that is closest
IoT cyber-attacks in edge networks. to the destination vehicle, but their major shortcoming is the
In summary, the combination of SDN, edge computing and instability of the selected route caused by weak signal strength
ML techniques can promote the deployment of IoT systems due to the lack of link information. Thus, to improve the
and the development of IoT services. routing decisions in vehicular networks, both link information
and vehicles’ position information should be considered.
E. Software Defined Vehicular Networks The global network view of the SDN controller simplifies
With the advancement of information communication and the collection and analysis of network information. In this
technology, smart vehicles have attracted widespread atten- case, the Software Defined Vehicular Network (SDVN) [272]
tion in recent years. To enable the implementation of smart has been presented to reduce the communication cost and
vehicles, it is essential for vehicles to access the Internet improve the network performance. Based on the collected
and communicate with each other through vehicular networks link and position information, ML techniques such as LSTM
[263]. Vehicular networks aim to provide comfort and conve- can be used to predict the movement of vehicles and the
nience for drivers and passengers, improve traffic efficiency topology change of vehicular networks. Then, the prediction
and enhance vehicle road safety by sharing real-time traffic results can be used by the SDN controller to make data
information among vehicles, such as traffic jams, accident forwarding decisions by using RL algorithms. Thus, ML
prone areas, hurdles and other important traffic information techniques can promote the implementation of SDVN and
[264]. In vehicular networks, a vehicle usually has multiple enable an intelligent, safe and efficient vehicular network.
network interfaces (e.g., WiFi, DSRC, UMTS, WiMax and
Bluetooth) to communicate with RSUs and ambient vehicles.
However, due to the intrinsic characteristics of vehicular F. Software Defined Mobile Networks
networks such as diverse vehicle densities, sparse distribution After several decades of development, mobile networks
of RSUs, high mobility of vehicles, dynamic traffic conditions have evolved to 5G [273], which is expected to support
and application requirements [265], designing an efficient data an increasing number of connected devices, provide higher
forwarding system for vehicular networks is a challenging user data rate, enable higher mobile data traffic per geo-
task. graphical area, reduce transmission delay and network energy
Unicast, multicast and broadcast are three routing ap- consumption. Besides the specific performance requirements,
proaches. Multicast and broadcast are not energy efficient 5G also needs to support heterogeneous services, devices and
due to the redundant transmission of traffic information. access networks [274]. To meet challenges from the hetero-
Unicast routing approach transmits traffic information to the geneous wireless environments, the complexity of network
intended destination through a specific path. Unicast rout- management, the increasing mobile traffic demand and diverse
ing approach can be divided into two categories: topology- service requirements in 5G mobile networks, ML techniques
based and position-based routing. Topology-based routing have been utilized to deploy more intelligence in mobile

networks. Generally, ML algorithms are applied to achieve algorithms are applied in the realm of SDN was discussed
self-configuration, self-optimization and self-healing functions in detail, from the perspective of traffic classification, routing
[12]. optimization, QoS/QoE prediction, resource management and
Self-configuration focuses on the configuration and deploy- security. We also discussed significant research challenges and
ment of mobile networks to make the network operable. future research directions in ML-based SDN, including high-
ML algorithms are often used to configure network param- quality training datasets, distributed multi-controller platform,
eters automatically, such as operational parameters, radio improving network security, cross-layer network optimization,
related parameters and other network parameters. The self- and incrementally deployed SDN. Finally, we explored some
optimization function aims to optimize network performance broader perspectives, such as software defined edge comput-
and update network parameters by continuously monitoring ing, software defined vehicular networks, software defined
the network environment. ML algorithms can be used in many mobile networks, etc.
aspects, such as mobility management, handover parameter In summary, research on applying ML algorithms in SDN is
optimization, load balancing and resource optimization. The quite broad and many challenges lay ahead. Nevertheless, it is
objectives of self-healing function are failure detection, failure favorable for the network community to address the challenges
analysis and fast failure recovery. ML algorithms are mainly and go forward. This article attempts to briefly explore how
used for fault detection, fault classification and cell outage ML algorithms work and when they should be used to solve
management. Ref. [12] has surveyed the machine learning problems in SDN. We hope that our discussion and exploration
algorithms and their solutions to achieve the self-configuration, may open a new avenue for the development of SDN and the
self-optimization and self-healing functions. implementation of a more intelligent network.
Data is very important for ML algorithms. The global
network view of the SDN controller simplifies the collection R EFERENCES
and analysis of network information. In this case, the Software [1] D. D. Clark, C. Partridge, J. C. Ramming, and J. T. Wroclawski,
Defined Mobile Network (SDMN) has been presented to “A knowledge plane for the Internet,” in Proc. ACM SIGCOMM’03,
Karlsruhe, Germany, 2003, pp. 3–10.
promote the implementation of intelligent mobile networks by [2] A. Mestres, A. Rodriguez-Natal, J. Carner, P. Barlet-Ros, E. Alarcón,
utilizing software oriented design [57]. M. Solé, V. Muntés-Mulero, D. Meyer, S. Barkai, M. J. Hibbett,
G. Estrada, K. Ma’ruf, F. Coras, V. Ermagan, H. Latapie, C. Cassar,
J. Evans, F. Maino, J. Walrand, and A. Cabellos, “Knowledge-defined
G. Software Defined Wireless Sensor Networks networking,” SIGCOMM Comput. Commun. Rev., vol. 47, no. 3, pp.
2–10, sep. 2017.
In recent years, the development of smart sensors has pro- [3] M. Wang, Y. Cui, X. Wang, S. Xiao, and J. Jiang, “Machine learning
moted the advancements of Wireless Sensor Network (WSN). for networking: Workflow, advances and opportunities,” IEEE Network,
vol. 32, no. 2, pp. 92–99, March 2018.
The WSN is composed of a large number of small, inexpensive [4] M. Usama, J. Qadir, A. Raza, H. Arif, K.-L. A. Yau, Y. Elkhatib,
and intelligent sensor nodes capable of monitoring and collect- A. Hussain, and A. Al-Fuqaha, “Unsupervised machine learning for
ing environmental information such as temperature, pressure, networking: Techniques, applications and research challenges,” arXiv
preprint arXiv:1709.06599, 2017.
humidity and movement. However, smart sensors generally [5] G. Xu, Y. Mu, and J. Liu, “Inclusion of artificial intelligence in
have limited storage resource, energy, computational capability communication networks and services,” ITU Journal: ICT Discoveries,
and communication bandwidth. These device constraints bring no. 1, pp. 1–6, Oct. 2017.
[6] A. Patcha and J.-M. Park, “An overview of anomaly detection tech-
several challenges in heterogeneous nodes management and niques: Existing solutions and latest technological trends,” Computer
network configuration. SDN is an emerging network paradigm Networks, vol. 51, no. 12, pp. 3448–3470, 2007.
to simplify network management and configuration. Recently, [7] T. T. T. Nguyen and G. Armitage, “A survey of techniques for internet
traffic classification using machine learning,” IEEE Commun. Surveys
there is an increasing trend of integrating WSN with SDN to Tutorials, vol. 10, no. 4, pp. 56–76, Fourth Quarter 2008.
foster efficiency and sustainability in WSN [275]. In this case, [8] M. Bkassiny, Y. Li, and S. K. Jayaweera, “A survey on machine-
the Software Defined WSN (SDWSN) model [275], [276] is learning techniques in cognitive radios,” IEEE Commun. Surveys Tu-
torials, vol. 15, no. 3, pp. 1136–1159, Third Quarter 2013.
proposed. Machine learning algorithms play a critical role in [9] M. A. Alsheikh, S. Lin, D. Niyato, and H. P. Tan, “Machine learning
SDWSN to manage a mass of heterogeneous sensor nodes, in wireless sensor networks: Algorithms, strategies, and applications,”
optimize the resource utilization in each node, as well as to IEEE Commun. Surveys Tutorials, vol. 16, no. 4, pp. 1996–2018, Fourth
Quarter 2014.
schedule communication links flexibly and efficiently. Now [10] X. Wang, X. Li, and V. C. M. Leung, “Artificial intelligence-based
ML techniques have been adopted to address many issues in techniques for emerging heterogeneous network: State of the arts,
WSN, such as routing optimization, node clustering and data opportunities, and challenges,” IEEE Access, vol. 3, pp. 1379–1391,
2015.
aggregation, event detection and query processing, localization [11] A. L. Buczak and E. Guven, “A survey of data mining and machine
[277], intrusion detection [278], fault detection, and so on. learning methods for cyber security intrusion detection,” IEEE Com-
Ref. [9] has surveyed the machine learning algorithms and mun. Surveys Tutorials, vol. 18, no. 2, pp. 1153–1176, Second Quarter
2016.
their solutions to solve these issues in WSN. [12] P. V. Klaine, M. A. Imran, O. Onireti, and R. D. Souza, “A survey
of machine learning techniques applied to self organizing cellular
VIII. C ONCLUSION networks,” IEEE Commun. Surveys Tutorials, vol. PP, no. 99, pp. 1–1,
2017.
This article provided a survey of current ML techniques [13] Z. M. Fadlullah, F. Tang, B. Mao, N. Kato, O. Akashi, T. Inoue, and
applied to SDN. We began our discussion with related survey K. Mizutani, “State-of-the-art deep learning: Evolving machine intelli-
gence toward tomorrow’s intelligent network traffic control systems,”
papers and background knowledge of SDN. Thereafter, an IEEE Commun. Surveys Tutorials, vol. 19, no. 4, pp. 2432–2455, Fourth
overview of ML algorithms was presented. Then, how ML Quarter 2017.

[14] E. Hodo, X. Bellekens, A. Hamilton, C. Tachtatzis, and R. Atkinson, the switch,” SIGCOMM Comput. Commun. Rev., vol. 44, no. 2, pp.
“Shallow and deep networks intrusion detection system: A taxonomy 44–51, 2014.
and survey,” arXiv preprint arXiv:1701.02145, 2017. [39] Open Networking Foundation, “Common Information
[15] X. Zhou, M. Sun, G. Y. Li, and B.-H. Juang, “Machine learning and Model Overview. V1.2,” 2016. [Online]. Available:
cognitive technology for intelligent wireless networks,” arXiv preprint https://www.opennetworking.org/wp-content/uploads/2014/10/TR-
arXiv:1710.11240, 2017. 513 CIM Overview 1.2.pdf
[16] M. Chen, U. Challita, W. Saad, C. Yin, and M. Debbah, “Machine [40] T. Koponen, M. Casado, N. Gude, J. Stribling, L. Poutievski, M. Zhu,
learning for wireless networks with artificial intelligence: A tutorial on R. Ramanathan, Y. Iwata, H. Inoue, T. Hama et al., “Onix: A distributed
neural networks,” arXiv preprint arXiv:1710.02913, 2017. control platform for large-scale production networks,” in OSDI, vol. 10,
[17] “Open Networking Foundation,” Jun. 2014. [Online]. Available: 2010, pp. 1–6.
https://www.opennetworking.org/ [41] A. Tootoonchian and Y. Ganjali, “Hyperflow: A distributed control
[18] S. Sezer, S. Scott-Hayward, P. K. Chouhan, B. Fraser, D. Lake, plane for OpenFlow,” in Proc. Enterprise Networking’10, 2010, pp.
J. Finnegan, N. Viljoen, M. Miller, and N. Rao, “Are we ready for 3–3.
SDN? implementation challenges for software-defined networks,” IEEE [42] H. Yin, H. Xie, T. Tsou, D. Lopez, P. Aranda, and R. Sidi, “SDNi:
Commun. Magazine, vol. 51, no. 7, pp. 36–43, July. 2013. A message exchange protocol for Software Defined Networks (SDNs)
[19] “Open vSwitch,” May. 2018. [Online]. Available: across multiple domains,” IETF Draft, 2012.
https://www.openvswitch.org/ [43] P. Lin, J. Bi, and Y. Wang, “East-west bridge for SDN network
[20] “Indigo: Open Source OpenFlow Switches,” May. 2018. [Online]. peering,” in Frontiers in Internet Technologies. Springer, 2013, pp.
Available: http://www.projectfloodlight.org/indigo/ 170–181.
[21] “Pantou: OpenFlow 1.3 for OpenWRT,” May. 2018. [Online]. Avail- [44] F. Benamrane, R. Benaini et al., “An east-west interface for distributed
able: https://github.com/CPqD/ofsoftswitch13/wiki/OpenFlow-1.3-for- SDN control plane: Implementation and evaluation,” Computers &
OpenWRT Electrical Engineering, vol. 57, pp. 162–175, 2017.
[22] J. W. Lockwood, N. McKeown, G. Watson, G. Gibb, P. Hartke, [45] A. Mendiola, J. Astorga, E. Jacob, and M. Higuero, “A survey on the
J. Naous, R. Raghuraman, and J. Luo, “NetFPGA: An open platform contributions of software-defined networking to traffic engineering,”
for gigabit-rate network switching and routing,” in Proc. IEEE MSE’07, IEEE Commun. Surveys Tutorials, vol. 19, no. 2, pp. 918–953, Second
San Diego, CA, USA, June 2007, pp. 160–161. Quarter 2017.
[23] M. B. Anwer, M. Motiwala, M. b. Tariq, and N. Feamster, “Switch- [46] I. Ahmad, S. Namal, M. Ylianttila, and A. Gurtov, “Security in software
Blade: A platform for rapid deployment of network protocols on defined networks: A survey,” IEEE Commun. Surveys Tutorials, vol. 17,
programmable hardware,” in Proc. ACM SIGCOMM’10, New Delhi, no. 4, pp. 2317–2346, Fourth Quarter 2015.
India, 2010, pp. 183–194. [47] S. Scott-Hayward, S. Natarajan, and S. Sezer, “A survey of security in
[24] G. Lu, C. Guo, Y. Li, Z. Zhou, T. Yuan, H. Wu, Y. Xiong, R. Gao, software defined networks,” IEEE Commun. Surveys Tutorials, vol. 18,
and Y. Zhang, “ServerSwitch: A programmable and high performance no. 1, pp. 623–654, First Quarter 2016.
platform for data center networks,” in NSDI, vol. 11, 2011, pp. 2–2. [48] D. B. Rawat and S. R. Reddy, “Software defined networking architec-
[25] N. Gude, T. Koponen, J. Pettit, B. Pfaff, M. Casado, N. McKeown, ture, security and energy efficiency: A survey,” IEEE Commun. Surveys
and S. Shenker, “NOX: Towards an operating system for networks,” Tutorials, vol. 19, no. 1, pp. 325–346, First Quarter 2017.
SIGCOMM Comput. Commun. Rev., vol. 38, no. 3, pp. 105–110, July. [49] S. T. Ali, V. Sivaraman, A. Radford, and S. Jha, “A survey of securing
2008. networks using software defined networking,” IEEE Trans. Reliability,
[26] M. McCauley, “About Pox,” 2013. [Online]. Available: vol. 64, no. 3, pp. 1086–1097, Sept. 2015.
http://www.noxrepo.org/pox/about-pox/ [50] Q. Yan, F. R. Yu, Q. Gong, and J. Li, “Software-Defined Networking
[27] Floodlight, “Project Floodlight open source software for (SDN) and Distributed Denial of Service (DDoS) attacks in cloud com-
building softwaredefined networks,” 2012. [Online]. Available: puting environments: A survey, some research issues, and challenges,”
http://www.projectfloodlight.org/ IEEE Commun. Surveys Tutorials, vol. 18, no. 1, pp. 602–622, First
[28] Ryu, “Ryu SDN Framework,” 2013. [Online]. Available: Quarter 2016.
http://osrg.github.io/ryu/ [51] T. Dargahi, A. Caponi, M. Ambrosin, G. Bianchi, and M. Conti, “A
[29] J. Medved, R. Varga, A. Tkacik, and K. Gray, “OpenDaylight: To- survey on the security of stateful SDN data planes,” IEEE Commun.
wards a model-driven SDN controller architecture,” in Proc. IEEE Surveys Tutorials, vol. 19, no. 3, pp. 1701–1725, Third Quarter 2017.
WoWMoM’14, Sydney, NSW, June. 2014, pp. 1–6. [52] P. Fonseca and E. Mota, “A survey on fault management in software-
[30] D. Erickson, “The Beacon OpenFlow controller,” in Proc. ACM SIG- defined networks,” IEEE Commun. Surveys Tutorials, vol. PP, no. 99,
COMM Workshop HotSDN’13, Hong Kong, China, 2013, pp. 13–18. pp. 1–1, 2017.
[31] N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, [53] J. W. Guck, A. V. Bemten, M. Reisslein, and W. Kellerer, “Unicast QoS
J. Rexford, S. Shenker, and J. Turner, “OpenFlow: Enabling innovation routing algorithms for SDN: A comprehensive survey and performance
in campus networks,” SIGCOMM Comput. Commun. Rev., vol. 38, evaluation,” IEEE Commun. Surveys Tutorials, vol. PP, no. 99, pp. 1–1,
no. 2, pp. 69–74, Mar. 2008. 2017.
[32] B. Pfaff and B. Davie, “The open vSwitch database [54] R. Alvizu, G. Maier, N. Kukreja, A. Pattavina, R. Morro, A. Capello,
management protocol,” Dec. 2013. [Online]. Available: https://rfc- and C. Cavazzoni, “Comprehensive survey on T-SDN: Software-
editor.org/rfc/rfc7047.txt defined networking for transport networks,” IEEE Commun. Surveys
[33] A. Doria, J. H. Salim, R. Haas, H. Khosravi, W. Wang, L. Dong, Tutorials, vol. PP, no. 99, pp. 1–1, 2017.
R. Gopal, and J. Halpern, “Forwarding and control element [55] A. S. Thyagaturu, A. Mercian, M. P. McGarry, M. Reisslein, and
separation (ForCES) protocol specification,” Tech. Rep., 2010. W. Kellerer, “Software Defined Optical Networks (SDONs): A com-
[Online]. Available: https://rfc-editor.org/rfc/rfc5810.txt prehensive survey,” IEEE Commun. Surveys Tutorials, vol. 18, no. 4,
[34] H. Song, “Protocol-oblivious forwarding: Unleash the power of SDN pp. 2738–2786, Fourth Quarter 2016.
through a future-proof forwarding plane,” in Proc. ACM SIGCOMM [56] I. T. Haque and N. Abu-Ghazaleh, “Wireless software defined net-
Workshop HotSDN’13, Hong Kong, China, 2013, pp. 127–132. working: A survey and taxonomy,” IEEE Commun. Surveys Tutorials,
[35] R. Enns, M. Bjorklund, and J. Schoenwaelder, “Network configuration vol. 18, no. 4, pp. 2713–2737, Fourth Quarter 2016.
protocol (NETCONF),” Jun. 2011. [Online]. Available: http://www.rfc- [57] T. Chen, M. Matinmikko, X. Chen, X. Zhou, and P. Ahokangas,
editor.org/rfc/rfc6241.txt “Software defined mobile networks: Concept, survey, and research
[36] D. Farinacci, D. Lewis, D. Meyer, and V. Fuller, “The directions,” IEEE Commun. Magazine, vol. 53, no. 11, pp. 126–133,
locator/ID separation protocol (LISP),” Jan. 2013. [Online]. Available: Nov. 2015.
http://www.rfc-editor.org/rfc/rfc6830.txt [58] S. Bera, S. Misra, and A. V. Vasilakos, “Software-defined networking
[37] M. Smith, M. Dvorkin, Y. Laribi, V. Pandey, P. Garg, for internet of things: A survey,” IEEE Internet of Things Journal,
and N. Weidenbacher, “OpFlex control protocol,” IETF, Apr. vol. PP, no. 99, pp. 1–1, 2017.
2014. [Online]. Available: http://www.ietf.org/internet-drafts/draft- [59] A. C. Baktir, A. Ozgovde, and C. Ersoy, “How can edge computing
smith-opflex-00.txt benefit from software-defined networking: A survey, use cases, and
[38] G. Bianchi, M. Bonola, A. Capone, and C. Cascone, “OpenState: Pro- future directions,” IEEE Commun. Surveys Tutorials, vol. PP, no. 99,
gramming platform-independent stateful OpenFlow applications inside pp. 1–1, 2017.
[60] O. Michel and E. Keller, “SDN in wide-area networks: A survey,” in
Proc. IEEE SDS’17, Valencia, Spain, 2017, pp. 37–42.

[61] R. Jain and S. Paul, “Network virtualization and software defined [89] K. Lee, D. Booth, and P. Alam, “A comparison of supervised and
networking for cloud computing: A survey,” IEEE Commun. Magazine, unsupervised neural networks in predicting bankruptcy of Korean
vol. 51, no. 11, pp. 24–31, Nov. 2013. firms,” Expert Systems with Applications, vol. 29, no. 1, pp. 1–16,
[62] Y. Li and M. Chen, “Software-defined network function virtualization: 2005.
A survey,” IEEE Access, vol. 3, pp. 2542–2553, 2015. [90] S. Timotheou, “The random neural network: A survey,” The Computer
[63] C. Liang and F. R. Yu, “Wireless network virtualization: A survey, some Journal, vol. 53, no. 3, pp. 251–267, 2010.
research issues and challenges,” IEEE Commun. Surveys Tutorials, [91] S. Basterrech and G. Rubino, “A tutorial about random neural networks
vol. 17, no. 1, pp. 358–380, First Quarter 2015. in supervised learning,” arXiv preprint arXiv:1609.04846, 2016.
[64] B. A. A. Nunes, M. Mendonca, X. N. Nguyen, K. Obraczka, and [92] H. Bakirciouglu and T. Koccak, “Survey of random neural network
T. Turletti, “A survey of software-defined networking: Past, present, and applications,” European Journal of Operational Research, vol. 126,
future of programmable networks,” IEEE Commun. Surveys Tutorials, no. 2, pp. 319–330, 2000.
vol. 16, no. 3, pp. 1617–1634, Third Quarter 2014. [93] Y. LeCun, Y. Bengio, and G. Hinton, “Deep learning,” Nature, vol.
[65] Y. Jarraya, T. Madi, and M. Debbabi, “A survey and a layered taxonomy 521, no. 7553, p. 436, 2015.
of software-defined networking,” IEEE Commun. Surveys Tutorials, [94] J. Baker, “Artificial neural networks and
vol. 16, no. 4, pp. 1955–1980, Fourth Quarter 2014. deep learning,” Feb. 2015. [Online]. Avail-
[66] W. Xia, Y. Wen, C. H. Foh, D. Niyato, and H. Xie, “A survey able: http://lancs.ac.uk/b̃akerj1/pdfs/ANNs/Artificial neural networks-
on software-defined networking,” IEEE Commun. Surveys Tutorials, report.pdf
vol. 17, no. 1, pp. 27–51, First Quarter 2015. [95] J. Schmidhuber, “Deep learning in neural networks: An overview,”
[67] F. Hu, Q. Hao, and K. Bao, “A survey on software-defined network and Neural Networks, vol. 61, pp. 85–117, 2015.
OpenFlow: From concept to implementation,” IEEE Commun. Surveys [96] G. Pandey and A. Dukkipati, “Learning by stretching deep networks,”
Tutorials, vol. 16, no. 4, pp. 2181–2206, Fourth Quarter 2014. in International Conference on Machine Learning, 2014, pp. 1719–
[68] J. Xie, D. Guo, Z. Hu, T. Qu, and P. Lv, “Control plane of software 1727.
defined networks: A survey,” Computer Communications, vol. 67, no. [97] A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification
Supplement C, pp. 1 – 10, 2015. with deep convolutional neural networks,” in Advances in Neural
[69] C. Trois, M. D. D. Fabro, L. C. E. de Bona, and M. Martinello, “A Information Processing Systems, 2012, pp. 1097–1105.
survey on SDN programming languages: Toward a taxonomy,” IEEE [98] C. Li, Y. Wu, X. Yuan, Z. Sun, W. Wang, X. Li, and L. Gong, “Detec-
Commun. Surveys Tutorials, vol. 18, no. 4, pp. 2687–2712, Fourth tion and defense of DDoS attack-based on deep learning in OpenFlow-
Quarter 2016. based SDN,” International Journal of Communication Systems, 2018.
[70] T. Huang, F. R. Yu, C. Zhang, J. Liu, J. Zhang, and Y. Liu, “A survey on [99] T. Mikolov, M. Karafiát, L. Burget, J. Černockỳ, and S. Khudanpur,
large-scale Software Defined Networking (SDN) testbeds: Approaches “Recurrent neural network based language model,” in Eleventh Annual
and challenges,” IEEE Commun. Surveys Tutorials, vol. 19, no. 2, pp. Conference of the International Speech Communication Association,
891–917, Second Quarter 2017. 2010.
[71] A. Blenk, A. Basta, M. Reisslein, and W. Kellerer, “Survey on [100] H. Sak, A. Senior, and F. Beaufays, “Long short-term memory recurrent
network virtualization hypervisors for software defined networking,” neural network architectures for large scale acoustic modeling,” in Fif-
IEEE Commun. Surveys Tutorials, vol. 18, no. 1, pp. 655–685, First teenth Annual Conference of the International Speech Communication
Quarter 2016. Association, 2014.
[72] OpenFlow Switch Consortium, “OpenFlow Switch [101] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural
Specification Version 1.0 of OpenFlow,” Dec. Computation, vol. 9, no. 8, pp. 1735–1780, 1997.
2009. [Online]. Available: https://www.opennetworking.org/wp- [102] X. Li and X. Wu, “Constructing long short-term memory based deep
content/uploads/2013/04/openflow-spec-v1.0.0.pdf recurrent neural networks for large vocabulary speech recognition,” in
[73] M. Mohammed, M. B. Khan, and E. B. M. Bashier, Machine Learning: Proc. IEEE ICASSP’15, Brisbane, QLD, Australia, April 2015, pp.
Algorithms and Applications. CRC Press, 2016. 4520–4524.
[74] S. Marsland, Machine Learning: An Algorithmic Perspective. CRC [103] V. N. Vapnik and V. Vapnik, Statistical Learning Theory. Wiley New
Press, 2015. York, 1998, vol. 1.
[75] M. Kubat, An Introduction to Machine Learning. Springer, 2016. [104] B. Yekkehkhany, A. Safari, S. Homayouni, and M. Hasanlou, “A com-
[76] E. Alpaydin, Introduction to Machine Learning. MIT Press, 2014. parison study of different kernel functions for SVM-based classification
[77] S. B. Kotsiantis, I. Zaharakis, and P. Pintelas, “Supervised machine of multi-temporal polarimetry SAR data,” The International Archives
learning: A review of classification techniques,” Emerging Artificial of Photogrammetry, Remote Sensing and Spatial Information Sciences,
Intelligence Applications in Computer Engineering, vol. 160, pp. 3– vol. 40, no. 2, p. 281, 2014.
24, 2007. [105] A. Patle and D. S. Chouhan, “SVM kernel functions for classification,”
[78] J. Friedman, T. Hastie, and R. Tibshirani, The Elements of Statistical in Proc. IEEE ICATE’13, Mumbai, India, Jan 2013, pp. 1–9.
Learning. Springer Series in Statistics New York, 2001, vol. 1. [106] I. Steinwart and A. Christmann, Support Vector Machines. Springer
[79] T. Cover and P. Hart, “Nearest neighbor pattern classification,” IEEE Science & Business Media, 2008.
Trans. Information Theory, vol. 13, no. 1, pp. 21–27, Jan. 1967. [107] M. Martı́nez-Ramón and C. Christodoulou, “Support vector machines
[80] L. Breiman, J. Friedman, C. J. Stone, and R. A. Olshen, Classification for antenna array processing and electromagnetics,” Synthesis Lectures
and Regression Trees. CRC Press, 1984. on Computational Electromagnetics, vol. 1, no. 1, pp. 1–120, 2005.
[81] J. Han, J. Pei, and M. Kamber, Data Mining: Concepts and Techniques. [108] H. Hu, Y. Wang, and J. Song, “Signal classification based on spectral
Elsevier, 2011. correlation analysis and SVM in cognitive radio,” in Proc. IEEE
[82] J. R. Quinlan, “Induction of decision trees,” Machine Learning, vol. 1, AINA’08, Okinawa, Japan, March. 2008, pp. 883–887.
no. 1, pp. 81–106, 1986. [109] G. E. Box and G. C. Tiao, Bayesian Inference in Statistical Analysis.
[83] S. Karatsiolis and C. N. Schizas, “Region based support vector machine John Wiley & Sons, 2011, vol. 40.
algorithm for medical diagnosis on Pima Indian Diabetes dataset,” in [110] J. Bakker, “Intelligent traffic classification for detecting DDoS attacks
Proc. IEEE BIBE’12, Larnaca, Cyprus, Nov. 2012, pp. 139–144. using SDN/OpenFlow,” Victoria University of Wellington, pp. 1–142,
[84] W. R. Burrows, M. Benjamin, S. Beauchamp, E. R. Lord, D. Mc- 2017.
Collor, and B. Thomson, “CART decision-tree statistical analysis [111] N. Friedman, D. Geiger, and M. Goldszmidt, “Bayesian network
and prediction of summer season maximum surface ozone for the classifiers,” Machine Learning, vol. 29, no. 2-3, pp. 131–163, 1997.
Vancouver, Montreal, and Atlantic regions of Canada,” Journal of [112] F. V. Jensen, An Introduction to Bayesian Networks. UCL Press
Applied Meteorology, vol. 34, no. 8, pp. 1848–1862, 1995. London, 1996, vol. 210.
[85] A. Kumar, P. Bhatia, A. Goel, and S. Kole, “Implementation and [113] D. Heckerman et al., “A tutorial on learning with Bayesian networks,”
comparison of decision tree based algorithms,” International Journal of Nato Asi Series D Behavioural And Social Sciences, vol. 89, pp. 301–
Innovations & Advancement in Computer Science, vol. 4, pp. 190–196, 354, 1998.
May. 2015. [114] T. D. Nielsen and F. V. Jensen, Bayesian Networks and Decision
[86] L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. Graphs. Springer Science & Business Media, 2009.
5–32, 2001. [115] L. R. Rabiner, “A tutorial on hidden markov models and selected
[87] S. Haykin, Neural Networks: A Comprehensive Foundation. Prentice applications in speech recognition,” Proceedings of the IEEE, vol. 77,
Hall PTR, 1994. no. 2, pp. 257–286, Feb. 1989.
[88] S. Haykin and N. Network, “A comprehensive foundation,” Neural
Networks, vol. 2, no. 2004, p. 41, 2004.

[116] P. Holgado, V. A. VILLAGRA, and L. Vazquez, “Real-time multistep [142] T. Benson, A. Akella, and D. A. Maltz, “Network traffic characteristics
attack prediction based on hidden markov models,” IEEE Trans. of data centers in the wild,” in Proc. ACM IMC’10, Melbourne,
Dependable and Secure Computing, vol. PP, no. 99, pp. 1–1, 2017. Australia, 2010, pp. 267–280.
[117] T. Kanungo, D. M. Mount, N. S. Netanyahu, C. D. Piatko, R. Sil- [143] M. Glick and H. Rastegarfar, “Scheduling and control in hybrid data
verman, and A. Y. Wu, “An efficient k-means clustering algorithm: centers,” in Proc. IEEE PHOSST’17, San Juan, Puerto Rico, July. 2017,
Analysis and implementation,” IEEE Trans. Pattern Analysis and pp. 115–116.
Machine Intelligence, vol. 24, no. 7, pp. 881–892, Jul. 2002. [144] P. Xiao, W. Qu, H. Qi, Y. Xu, and Z. Li, “An efficient elephant flow
[118] T. Kohonen, “The self-organizing map,” Neurocomputing, vol. 21, no. detection with cost-sensitive in SDN,” in Proc. IEEE INISCom’15,
1-3, pp. 1–6, 1998. Tokyo, Japan, March. 2015, pp. 24–28.
[119] M. M. Van Hulle, “Self-organizing maps,” in Handbook of Natural [145] Y. Li and J. Li, “MultiClassifier: A combination of DPI and ML
Computing. Springer, 2012, pp. 585–622. for application-layer classification in SDN,” in Proc. IEEE ICSAI’14,
[120] X. Zhu, “Semi-supervised learning literature survey,” Citeseer, pp. 1– Shanghai, China, Nov. 2014, pp. 682–686.
59, 2005. [146] D. Rossi and S. Valenti, “Fine-grained traffic classification with Net-
[121] X. Zhou and M. Belkin, “Semi-supervised learning,” in Academic Press flow data,” in Proc. ACM IWCMC’10, Caen, France, 2010, pp. 479–
Library in Signal Processing. Elsevier, 2014, vol. 1, pp. 1239–1269. 483.
[122] D.-H. Lee, “Pseudo-label: The simple and efficient semi-supervised [147] A. NAKAO and P. DU, “Toward in-network deep machine learning
learning method for deep neural networks,” in Workshop on Challenges for identifying mobile applications and enabling application specific
in Representation Learning, ICML, vol. 3, 2013, p. 2. network slicing,” IEICE Trans. Communications, p. 2017CQI0002,
[123] H. Wu and S. Prasad, “Semi-supervised deep learning using Pseudo 2014.
labels for hyperspectral image classification,” IEEE Trans. Image [148] M. Uddin and T. Nadeem, “TrafficVision: A case for pushing software
Processing, vol. 27, no. 3, pp. 1259–1270, March 2018. defined networks to wireless edges,” in Proc. IEEE MASS’16, Brasilia,
[124] O. Chapelle, B. Scholkopf, and A. Zien, “Semi-supervised learning Brazil, Oct. 2016, pp. 37–46.
(chapelle, o. et al., eds.; 2006)[book reviews],” IEEE Trans. Neural [149] R. Hajlaoui, H. Guyennet, and T. Moulahi, “A survey on heuristic-based
Networks, vol. 20, no. 3, pp. 542–542, 2009. routing methods in vehicular ad-hoc network: Technical challenges and
[125] R. S. Sutton and A. G. Barto, Reinforcement Learning: An Introduction. future trends,” IEEE Sensors Journal, vol. 16, no. 17, pp. 6782–6792,
MIT Press Cambridge, 1998, vol. 1, no. 1. Sept. 2016.
[126] L. P. Kaelbling, M. L. Littman, and A. W. Moore, “Reinforcement [150] L. Yanjun, L. Xiaobo, and Y. Osamu, “Traffic engineering framework
learning: A survey,” Journal of Artificial Intelligence Research, vol. 4, with machine learning based meta-layer in software-defined networks,”
pp. 237–285, 1996. in Proc. IEEE ICNIDC’14, Beijing, China, Sept. 2014, pp. 121–125.
[127] C. J. Watkins and P. Dayan, “Q-learning,” Machine Learning, vol. 8, [151] A. Azzouni, R. Boutaba, and G. Pujolle, “NeuRoute: Predictive
no. 3-4, pp. 279–292, 1992. dynamic routing for software-defined networks,” arXiv preprint
[128] K. Arulkumaran, M. P. Deisenroth, M. Brundage, and A. A. Bharath, arXiv:1709.06002, 2017.
“Deep reinforcement learning: A brief survey,” IEEE Signal Processing [152] S. Sendra, A. Rego, J. Lloret, J. M. Jimenez, and O. Romero,
Magazine, vol. 34, no. 6, pp. 26–38, Nov. 2017. “Including artificial intelligence in a routing protocol using software
[129] Y. Li, “Deep reinforcement learning: An overview,” arXiv preprint defined networks,” in Proc. IEEE ICC Workshops’17, Paris, France,
arXiv:1701.07274, 2017. May. 2017, pp. 670–674.
[130] Y. He, C. Liang, R. Yu, and Z. Han, “Trust-based social networks [153] F. Francois and E. Gelenbe, “Optimizing secure SDN-enabled inter-
with computing, caching and communications: A deep reinforcement data centre overlay networks through cognitive routing,” in Proc. IEEE
learning approach,” IEEE Trans. Network Science and Engineering, pp. MASCOTS’16, London, UK, Sept. 2016, pp. 283–288.
1–1, 2018. [154] ——, “Towards a cognitive routing engine for software defined net-
[131] O. Narmanlioglu and E. Zeydan, “Learning in SDN-based multi- works,” in Proc. IEEE ICC’16, Kuala Lumpur, Malaysia, May. 2016,
tenant cellular networks: A game-theoretic perspective,” in Proc. IEEE pp. 1–6.
INM’17, Lisbon, Portugal, May. 2017, pp. 929–934. [155] S. C. Lin, I. F. Akyildiz, P. Wang, and M. Luo, “QoS-aware adaptive
[132] S. Ranadheera, S. Maghsudi, and E. Hossain, “Mobile edge computa- routing in multi-layer hierarchical software defined networks: A rein-
tion offloading using game theory and reinforcement learning,” arXiv forcement learning approach,” in Proc. IEEE SCC’16, San Francisco,
preprint arXiv:1711.09012, 2017. CA, USA, June. 2016, pp. 25–33.
[133] F. Cai, Y. Gao, L. Cheng, L. Sang, and D. Yang, “Spectrum sharing [156] G. Stampa, M. Arias, D. Sanchez-Charles, V. Muntes-Mulero,
for LTE and WiFi coexistence using decision tree and game theory,” and A. Cabellos, “A deep-reinforcement learning approach for
in Proc. IEEE WCNC’16, Doha, Qatar, April 2016, pp. 1–6. software-defined networking routing optimization,” arXiv preprint
[134] S. DOro, L. Galluccio, S. Palazzo, and G. Schembra, “A game arXiv:1709.07080, 2017.
theoretic approach for distributed resource allocation and orchestration [157] Á. López-Raventós, F. Wilhelmi, S. Barrachina-Muñoz, and B. Bellalta,
of softwarized networks,” IEEE Journal on Selected Areas in Commu- “Machine learning and software defined networks for high-density
nications, vol. 35, no. 3, pp. 721–735, March 2017. WLANs,” arXiv preprint arXiv:1804.05534, 2018.
[135] H.-Y. Shi, W.-L. Wang, N.-M. Kwok, and S.-Y. Chen, “Game theory [158] R. Alvizu, S. Troia, G. Maier, and A. Pattavina, “Matheuristic with
for wireless sensor networks: A survey,” Sensors, vol. 12, no. 7, pp. machine-learning-based prediction for software-defined mobile metro-
9055–9097, 2012. core networks,” IEEE/OSA Journal of Optical Communications and
[136] H. Zhang, J. Du, J. Cheng, K. Long, and V. C. M. Leung, “Incomplete Networking, vol. 9, no. 9, pp. D19–D30, Sept. 2017.
CSI based resource optimization in SWIPT enabled heterogeneous [159] C. Chen-Xiao and X. Ya-Bin, “Research on load balance method
networks: A non-cooperative game theoretic approach,” IEEE Trans. in SDN,” International Journal of Grid and Distributed Computing,
Wireless Communications, vol. 17, no. 3, pp. 1882–1892, March 2018. vol. 9, no. 1, pp. 25–36, 2016.
[137] J. Xie, R. Xie, T. Huang, J. Liu, F. R. Yu, and Y. Liu, “Caching resource [160] A. Azzouni and G. Pujolle, “NeuTM: A neural network-based
sharing in radio access networks: A game theoretic approach,” Frontiers framework for traffic matrix prediction in SDN,” arXiv preprint
of Information Technology & Electronic Engineering, vol. 17, no. 12, arXiv:1710.06799, 2017.
pp. 1253–1265, 2016. [161] “GEANT Network,” May. 2018. [Online]. Available:
[138] A. Agrawal and D. Jaiswal, “When machine learning meets AI https://www.geant.org/Projects/GEANT Project GN4
and game theory,” Stanford University, Machine Learning Final Year [162] K. K. Budhraja, A. Malvankar, M. Bahrami, C. Kundu, A. Kundu, and
Projects, pp. 1–5, 1981. M. Singhal, “Risk-based packet routing for privacy and compliance-
[139] P. Amaral, J. Dinis, P. Pinto, L. Bernardo, J. Tavares, and H. S. preserving SDN,” in Proc. IEEE CLOUD’17, Honolulu, CA, USA, June.
Mamede, “Machine learning in software defined networks: Data col- 2017, pp. 761–765.
lection and traffic classification,” in Proc. IEEE ICNP’16, Singapore, [163] J. Carner, A. Mestres, E. Alarcn, and A. Cabellos, “Machine learning-
Singapore, Nov. 2016, pp. 1–5. based network modeling: An artificial neural network model vs a
[140] Z. A. Qazi, J. Lee, T. Jin, G. Bellala, M. Arndt, and G. Noubir, theoretical inspired model,” in Proc. IEEE ICUFN’17, Milan, Italy,
“Application-awareness in SDN,” in Proc. ACM SIGCOMM’13, Hong 2017, pp. 522–524.
Kong, China, 2013, pp. 487–488. [164] S. Jain, M. Khandelwal, A. Katkar, and J. Nygate, “Applying big data
[141] P. Wang, S. C. Lin, and M. Luo, “A framework for QoS-aware traffic technologies to manage QoS in an SDN,” in Proc. IEEE CNSM’16,
classification using semi-supervised machine learning in SDNs,” in Montreal, QC, Canada, Oct. 2016, pp. 302–306.
Proc. IEEE SCC’16, San Francisco, CA, USA, June. 2016, pp. 760–
765.

[165] R. Pasquini and R. Stadler, “Learning end-to-end application QoS from [187] M. He, P. Kalmbach, A. Blenk, W. Kellerer, and S. Schmid,
OpenFlow switch statistics,” in Proc. IEEE NETSOFT’17, Bologna, “Algorithm-data driven optimization of adaptive communication net-
Italy, 2017, pp. 1–9. works,” in Proc. IEEE ICNP’17, Toronto, ON, Canada, Oct. 2017, pp.
[166] A. B. Letaifa, “Adaptive QoE monitoring architecture in SDN net- 1–6.
works: Video streaming services case,” in Proc. IEEE IWCMC’17, [188] A. Blenk, P. Kalmbach, W. Kellerer, and S. Schmid, “O’Zapft is: Tap
Valencia, Spain, 2017, pp. 1383–1388. your network algorithm’s big data!” in Proc. ACM Big-DAMA’17, Los
[167] T. Abar, A. B. Letaifa, and S. E. Asmi, “Machine learning based QoE Angeles, CA, USA, 2017, pp. 19–24.
prediction in SDN networks,” in Proc. IEEE IWCMC’17, Valencia, [189] D. D. Testa, M. Danieletto, G. M. D. Nunzio, and M. Zorzi, “Estimating
Spain, 2017, pp. 1395–1400. the number of receiving nodes in 802.11 networks via machine learning
[168] R. Huo, F. R. Yu, T. Huang, R. Xie, J. Liu, V. C. M. Leung, and techniques,” in Proc. IEEE GLOBECOM’16, Washington, DC, USA,
Y. Liu, “Software defined networking, caching, and computing for Dec. 2016, pp. 1–7.
green wireless networks,” IEEE Commun. Magazine, vol. 54, no. 11, [190] D. D. Testa, M. Danieletto, and M. Zorzi, “A machine learning
pp. 185–193, November 2016. based ETA estimator for WiFi transmissions,” IEEE Trans. Wireless
[169] C. Wang, Y. He, F. R. Yu, Q. Chen, and L. Tang, “Integration of net- Communications, vol. PP, no. 99, pp. 1–1, 2017.
working, caching, and computing in wireless systems: A survey, some [191] W. Jiang, M. Strufe, and H. Schotten, “Autonomic network manage-
research issues, and challenges,” IEEE Commun. Surveys Tutorials, ment for software-defined and virtualized 5G systems,” in Proc. VDE
vol. 20, no. 1, pp. 7–38, First Quarter 2018. European Wireless’17, Dresden, Germany, May. 2017, pp. 1–6.
[170] Y. He, F. R. Yu, and A. Boukerche, “Deep reinforcement learning based [192] J. Bendriss, I. G. B. Yahia, and D. Zeghlache, “Forecasting and
resource management in software-defined and virtualized vehicular ad anticipating SLO breaches in programmable networks,” in Proc. IEEE
hoc networks,” in Proc. ACM DIVANet’17, Miami Beach, FL, Nov. ICIN’17, Paris, France, March. 2017, pp. 127–134.
2017. [193] C. Orfanidis, “Ph.D. forum abstract: Increasing robustness in WSN
[171] Y. He, F. R. Yu, N. Zhao, V. C. M. Leung, and H. Yin, “Software- using software defined network architecture,” in Proc. ACM/IEEE
defined networks with mobile edge computing and caching for smart IPSN’16, Vienna, Austria, April. 2016, pp. 1–2.
cities: A big data deep reinforcement learning approach,” IEEE Com- [194] K. Scarfone and P. Mell, “Guide to Intrusion Detection and Prevention
mun. Magazine, vol. 55, no. 12, pp. 31–37, Dec. 2017. Systems (IDPS),” NIST Special Publication, vol. 800, no. 2007, p. 94,
[172] M. A. Salahuddin, A. Al-Fuqaha, and M. Guizani, “Software-defined 2007.
networking for RSU clouds in support of the internet of vehicles,” IEEE [195] D. Kwon, H. Kim, J. Kim, S. C. Suh, I. Kim, and K. J. Kim, “A
Internet of Things Journal, vol. 2, no. 2, pp. 133–144, April.2015. survey of deep learning-based network anomaly detection,” Cluster
[173] R. Haw, M. G. R. Alam, and C. S. Hong, “A context-aware content Computing, pp. 1–13, 2017.
delivery framework for QoS in mobile cloud,” in Proc. IEEE AP- [196] J. Ashraf and S. Latif, “Handling intrusion and DDoS attacks in
NOMS’14, Hsinchu, Taiwan, Sept. 2014, pp. 1–6. software defined networks using machine learning techniques,” in Proc.
[174] A. Bentaleb, A. C. Begen, R. Zimmermann, and S. Harous, “SDNHAS: IEEE NSEC’14, Rawalpindi, Pakistan, Nov. 2014, pp. 55–60.
An SDN-enabled architecture to optimize QoE in HTTP adaptive [197] N. Sultana, N. Chilamkurti, W. Peng, and R. Alhadad, “Survey on
streaming,” IEEE Trans. Multimedia, vol. 19, no. 10, pp. 2136–2151, SDN based network intrusion detection system using machine learning
Oct. 2017. approaches,” Peer-to-Peer Networking and Applications, pp. 1–9, 2018.
[175] T.-Y. Huang, R. Johari, N. McKeown, M. Trunnell, and M. Watson, “A [198] J. Ibrahim and S. Gajin, “SDN-based intrusion detection system,”
buffer-based approach to rate adaptation: Evidence from a large video Infoteh Jahorina, vol. 16, pp. 621–624, March. 2017.
streaming service,” in Proc. ACM SIGCOMM’14, Chicago, Illinois, [199] M. Khairi, S. Ariffin, N. A. Latiff, A. Abdullah, and M. Hassan,
USA, 2014, pp. 187–198. “A review of anomaly detection techniques and Distributed Denial of
[176] Z. Li, X. Zhu, J. Gahm, R. Pan, H. Hu, A. C. Begen, and D. Oran, Service (DDoS) on Software Defined Network (SDN),” Engineering,
“Probe and adapt: Rate adaptation for HTTP video streaming at scale,” Technology & Applied Science Research, vol. 8, no. 2, pp. 2724–2730,
IEEE Journal on Selected Areas in Communications, vol. 32, no. 4, pp. 2018.
719–733, April. 2014. [200] C. Song, Y. Park, K. Golani, Y. Kim, K. Bhatt, and K. Goswami,
[177] M. Chen, M. Mozaffari, W. Saad, C. Yin, M. Debbah, and C. S. Hong, “Machine-learning based threat-aware system in software defined net-
“Caching in the sky: Proactive deployment of cache-enabled unmanned works,” in Proc. IEEE ICCCN’17, Vancouver, BC, Canada, July. 2017,
aerial vehicles for optimized quality-of-experience,” IEEE Journal on pp. 1–9.
Selected Areas in Communications, vol. 35, no. 5, pp. 1046–1061, May [201] T. Hurley, J. E. Perdomo, and A. Perez-Pons, “HMM-based intrusion
2017. detection system for software defined networking,” in Proc. IEEE
[178] S. Paris, J. Leguay, L. Maggi, M. Draief, and S. Chouvardas, “Online ICMLA’16, Anaheim, CA, USA, Dec. 2016, pp. 617–621.
experts for admission control in SDN,” in Proc. IEEE NOMS’16, [202] A. S. da Silva, J. A. Wickboldt, L. Z. Granville, and A. Schaeffer-Filho,
Istanbul, Turkey, April. 2016, pp. 1003–1004. “ATLANTIC: A framework for anomaly traffic detection, classification,
[179] J. Leguay, L. Maggi, M. Draief, S. Paris, and S. Chouvardas, “Admis- and mitigation in SDN,” in Proc. IEEE NOMS’16, Istanbul, Turkey,
sion control with online algorithms in SDN,” in Proc. IEEE NOMS’16, April. 2016, pp. 27–35.
Istanbul, Turkey, April. 2016, pp. 718–721. [203] M. Nobakht, V. Sivaraman, and R. Boreli, “A host-based intrusion de-
[180] S. Agrawal and N. R. Devanur, “Fast algorithms for online stochastic tection and mitigation framework for smart home IoT using OpenFlow,”
convex programming,” in Proc. ACM SODA’15, San Diego, California, in Proc. IEEE ARES’16, Salzburg, Austria, Aug. 2016, pp. 147–156.
2015, pp. 1405–1424. [204] S. Nanda, F. Zafari, C. DeCusatis, E. Wedaa, and B. Yang, “Predicting
[181] N. Buchbinder and J. Naor, “Improved bounds for online routing and network attack patterns in SDN using machine learning approach,” in
packing via a primal-dual approach,” in Proc. IEEE FOCS’06, Berkeley, Proc. IEEE NFV-SDN’16, Palo Alto, CA, USA, Nov. 2016, pp. 167–
CA, USA, Oct. 2006. 172.
[182] N. Buchbinder and J. S. Naor, “Online primal-dual algorithms for [205] T. A. Tang, L. Mhamdi, D. McLernon, S. A. R. Zaidi, and M. Ghogho,
covering and packing,” Mathematics of Operations Research, vol. 34, “Deep learning approach for network intrusion detection in software
no. 2, pp. 270–286, 2009. defined networking,” in Proc. IEEE WINCOM’16, Fez, Morocco, Oct.
[183] R. Sherwood, G. Gibb, K.-K. Yap, G. Appenzeller, M. Casado, 2016, pp. 258–263.
N. McKeown, and G. M. Parulkar, “Can the production network be [206] S. Revathi and A. Malathi, “A detailed analysis on NSL-KDD dataset
the testbed?” in OSDI, vol. 10, 2010, pp. 1–6. using various machine learning techniques for intrusion detection,”
[184] A. Al-Shabibi, M. De Leenheer, M. Gerola, A. Koshibe, G. Parulkar, International Journal of Engineering Research and Technology. ESRSA
E. Salvadori, and B. Snow, “OpenVirteX: Make your virtual SDNs Publications, 2013.
programmable,” in Proc. ACM HotSDN’14, Chicago, Illinois, USA, [207] T. Tang, S. A. R. Zaidi, D. McLernon, L. Mhamdi, and M. Ghogho,
2014, pp. 25–30. “Deep recurrent neural network for intrusion detection in SDN-based
[185] C. Sieber, A. Basta, A. Blenk, and W. Kellerer, “Online resource networks,” in Proc. IEEE NetSoft’18, Montreal, Canada, 2018.
mapping for SDN network hypervisors using machine learning,” in [208] P. Wang, K. M. Chao, H. C. Lin, W. H. Lin, and C. C. Lo, “An efficient
Proc. IEEE NETSOFT’16, Seoul, South Korea, June. 2016, pp. 78–82. flow control approach for SDN-based network threat detection and
[186] C. Sieber, A. Obermair, and W. Kellerer, “Online learning and adap- migration using support vector machine,” in Proc. IEEE ICEBE’16,
tation of network hypervisor performance models,” in Proc. IEEE Macau, China, Nov. 2016, pp. 56–63.
INM’17, Lisbon, Portugal, May. 2017, pp. 1204–1212. [209] N. Shone, T. N. Ngoc, V. D. Phai, and Q. Shi, “A deep learning
approach to network intrusion detection,” IEEE Trans. Emerging Topics
in Computational Intelligence, vol. 2, no. 1, pp. 41–50, Feb 2018.

[210] R. Braga, E. Mota, and A. Passito, “Lightweight DDoS flooding attack [234] M. Satyanarayanan, P. Bahl, R. Caceres, and N. Davies, “The case for
detection using NOX/OpenFlow,” in Proc. IEEE LCN’10, Denver, CO, VM-based cloudlets in mobile computing,” IEEE Pervasive Computing,
USA, Oct. 2010, pp. 408–415. vol. 8, no. 4, pp. 14–23, Oct. 2009.
[211] L. Barki, A. Shidling, N. Meti, D. G. Narayan, and M. M. Mulla, [235] H. H. Pang and K. L. Tan, “Authenticating query results in edge
“Detection of distributed denial of service attacks in software defined computing,” in Proc. IEEE ICDE’04, Boston, MA, USA, USA, March.
networks,” in Proc. IEEE ICACCI’16, Jaipur, India, Sept. 2016, pp. 2004, pp. 560–571.
2576–2581. [236] F. Bonomi, R. Milito, J. Zhu, and S. Addepalli, “Fog computing and
[212] Q. Niyaz, W. Sun, and A. Y. Javaid, “A deep learning based DDoS its role in the internet of things,” in Proc. ACM MCC’12, Helsinki,
detection system in Software Defined Networking (SDN),” arXiv Finland, 2012, pp. 13–16.
preprint arXiv:1611.07400, 2016. [237] H. T. Dinh, C. Lee, D. Niyato, and P. Wang, “A survey of mobile
[213] L. J. Jagadeesan and V. Mendiratta, “Programming the network: cloud computing: Architecture, applications, and approaches,” Wireless
Application software faults in software-defined networks,” in Proc. Communications and Mobile Computing, vol. 13, no. 18, pp. 1587–
IEEE ISSREW’16, Ottawa, ON, Canada, Oct. 2016, pp. 125–131. 1611, 2013.
[214] Z. Din and J. de Oliveira, “Anomaly free on demand stateful software [238] J. S. Preden, K. Tammeme, A. Jantsch, M. Leier, A. Riid, and
defined firewalling,” in Proc. IEEE ICCCN’17, Vancouver, BC, Canada, E. Calis, “The benefits of self-awareness and attention in Fog and Mist
July. 2017, pp. 1–9. computing,” Computer, vol. 48, no. 7, pp. 37–45, July. 2015.
[215] M. Mongelli, T. D. Cola, M. Cello, M. Marchese, and F. Davoli, [239] P. Mach and Z. Becvar, “Mobile edge computing: A survey on archi-
“Feeder-link outage prediction algorithms for SDN-based high- tecture and computation offloading,” IEEE Commun. Surveys Tutorials,
throughput satellite systems,” in Proc. IEEE ICC’16, Kuala Lumpur, vol. 19, no. 3, pp. 1628–1656, Third Quarter 2017.
Malaysia, May. 2016, pp. 1–6. [240] S. Yu, X. Wang, and R. Langar, “Computation offloading for mobile
[216] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A detailed edge computing: A deep learning approach,” in Proc. IEEE PIMRC’17,
analysis of the KDD CUP 99 data set,” in Proc. IEEE CISDA’09, Montreal, QC, Canada, Oct. 2017, pp. 1–6.
Ottawa, ON, Canada, July. 2009, pp. 1–6. [241] M. G. R. Alam, Y. K. Tun, and C. S. Hong, “Multi-agent and
[217] L. F. Maim, . L. P. Gmez, F. J. G. Clemente, M. G. Prez, and reinforcement learning based code offloading in mobile fog,” in Proc.
G. M. Prez, “A self-adaptive deep learning-based system for anomaly IEEE ICOIN’16, Kota Kinabalu, Malaysia, Jan. 2016, pp. 285–290.
detection in 5G networks,” IEEE Access, vol. 6, pp. 7700–7712, 2018. [242] P. N. Ji, “Software defined optical network,” in Proc. IEEE ICOCN’12,
[218] LongTail, “LongTail Log Analysis Dashboard,” May. 2018. [Online]. Chonburi, Thailand, Nov. 2012, pp. 1–4.
Available: http://longtail.it.marist.edu/honey/dashboard.shtml [243] C. Rottondi, L. Barletta, A. Giusti, and M. Tornatore, “Machine-
[219] “UNB ISCX intrusion detection evaluation dataSet,” May. 2018. learning method for quality of transmission prediction of unestablished
[Online]. Available: http://www.unb.ca/cic/datasets/ids.html lightpaths,” IEEE/OSA Journal of Optical Communications and Net-
[220] “Imagenet database,” May. 2018. [Online]. Available: working, vol. 10, no. 2, pp. A286–A297, Feb. 2018.
http://www.image-net.org/ [244] M. Bouda, S. Oda, O. Vassilieva, M. Miyabe, S. Yoshida, T. Katagiri,
[221] D. Kreutz, F. M. V. Ramos, P. E. Verssimo, C. E. Rothenberg, Y. Aoki, T. Hoshida, and T. Ikeuchi, “Accurate prediction of quality of
S. Azodolmolky, and S. Uhlig, “Software-defined networking: A com- transmission based on a dynamically configurable optical impairment
prehensive survey,” Proceedings of the IEEE, vol. 103, no. 1, pp. 14–76, model,” IEEE/OSA Journal of Optical Communications and Network-
Jan. 2015. ing, vol. 10, no. 1, pp. A102–A109, Jan. 2018.
[222] S. Hassas Yeganeh and Y. Ganjali, “Kandoo: A framework for effi- [245] D. Rafique, T. Szyrkowiec, H. Grieer, A. Autenrieth, and J. P. Elbers,
cient and scalable offloading of control applications,” in Proc. ACM “Cognitive assurance architecture for optical network fault manage-
HotSDN’12, Helsinki, Finland, 2012, pp. 19–24. ment,” Journal of Lightwave Technology, vol. 36, no. 7, pp. 1443–1450,
[223] J. McCauley, A. Panda, M. Casado, T. Koponen, and S. Shenker, April. 2018.
“Extending SDN to large-scale networks,” Open Networking Summit, [246] T. Panayiotou, S. P. Chatzis, and G. Ellinas, “Leveraging statisti-
pp. 1–2, 2013. cal machine learning to address failure localization in optical net-
[224] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, works,” IEEE/OSA Journal of Optical Communications and Network-
S. Ozair, A. Courville, and Y. Bengio, “Generative adversarial nets,” in ing, vol. 10, no. 3, pp. 162–173, March. 2018.
Advances in Neural Information Processing Systems, 2014, pp. 2672– [247] D. R. B. de Araujo, C. J. A. Bastos-filho, and J. F. Martins-filho,
2680. “Methodology to obtain a fast and accurate estimator for blocking
[225] C. She, C. Yang, and T. Q. S. Quek, “Cross-layer optimization for ultra- probability of optical networks,” IEEE/OSA Journal of Optical Com-
reliable and low-latency radio access networks,” IEEE Trans. Wireless munications and Networking, vol. 7, no. 5, pp. 380–391, May. 2015.
Communications, vol. PP, no. 99, pp. 1–1, 2017. [248] G. Zervas, K. Banias, B. R. Rofoee, N. Amaya, and D. Simeonidou,
[226] G. Liu, Z. Ma, X. Chen, Z. Ding, R. Yu, and P. Fan, “Cross-layer power “Multi-core, multi-band and multi-dimensional cognitive optical net-
allocation in non-orthogonal multiple access systems for statistical QoS works: An architecture on demand approach,” in Proc. IEEE IC-
provisioning,” IEEE Trans. Vehicular Technology, vol. PP, no. 99, pp. TON’12, Coventry, UK, July. 2012, pp. 1–4.
1–1, 2017. [249] J. A. Guerrero-ibanez, S. Zeadally, and J. Contreras-Castillo, “Inte-
[227] A. Y. Al-Zahrani, F. R. Yu, and M. Huang, “A joint cross-layer and gration challenges of intelligent transportation systems with connected
colayer interference management scheme in hyperdense heterogeneous vehicle, cloud computing, and internet of things technologies,” IEEE
networks using mean-field game theory,” IEEE Trans. Vehicular Tech- Wireless Communications, vol. 22, no. 6, pp. 122–128, Dec. 2015.
nology, vol. 65, no. 3, pp. 1522–1535, March. 2016. [250] L. Hu, M. Qiu, J. Song, M. S. Hossain, and A. Ghoneim, “Software
[228] C. E. Rothenberg, M. R. Nascimento, M. R. Salvador, C. N. A. defined healthcare networks,” IEEE Wireless Communications, vol. 22,
Corrêa, S. Cunha de Lucena, and R. Raszuk, “Revisiting routing control no. 6, pp. 67–75, Dec. 2015.
platforms with the eyes and muscles of software-defined networking,” [251] A. Samanta, S. Bera, and S. Misra, “Link-quality-aware resource
in Proc. ACM HotSDN’12, Helsinki, Finland, 2012, pp. 13–18. allocation with load balance in wireless body area networks,” IEEE
[229] S. Agarwal, M. Kodialam, and T. V. Lakshman, “Traffic engineering in Systems Journal, vol. PP, no. 99, pp. 1–8, 2015.
software defined networks,” in Proc. IEEE INFOCOM’13, Turin, Italy, [252] Y. Kim and Y. Lee, “Automatic generation of social relationships
April. 2013, pp. 2211–2219. between internet of things in smart home using SDN-based home
[230] H. Hawilo, A. Shami, M. Mirahmadi, and R. Asal, “NFV: State of the cloud,” in Proc. IEEE WAINA’15, Gwangiu, South Korea, March. 2015,
art, challenges, and implementation in next generation mobile networks pp. 662–667.
(vEPC),” IEEE Network, vol. 28, no. 6, pp. 18–26, Nov. 2014. [253] S. Bera, S. Misra, and J. J. P. C. Rodrigues, “Cloud computing
[231] J. Matias, J. Garay, N. Toledo, J. Unzilla, and E. Jacob, “Toward an applications for smart grid: A survey,” IEEE Trans. Parallel and
SDN-enabled NFV architecture,” IEEE Commun. Magazine, vol. 53, Distributed Systems, vol. 26, no. 5, pp. 1477–1494, May. 2015.
no. 4, pp. 187–193, April. 2015. [254] J. Pan, R. Jain, S. Paul, T. Vu, A. Saifullah, and M. Sha, “An internet
[232] R. Shi, J. Zhang, W. Chu, Q. Bao, X. Jin, C. Gong, Q. Zhu, C. Yu, and of things framework for smart energy in buildings: Designs, prototype,
S. Rosenberg, “MDP and machine learning-based cost-optimization of and experiments,” IEEE Internet of Things Journal, vol. 2, no. 6, pp.
dynamic resource allocation for network function virtualization,” in 527–537, Dec. 2015.
Proc. IEEE SCC’15, New York, NY, USA, June. 2015, pp. 65–73. [255] N. Bizanis and F. A. Kuipers, “SDN and virtualization solutions for
[233] S. I. Kim and H. S. Kim, “A research on dynamic service function the internet of things: A survey,” IEEE Access, vol. 4, pp. 5591–5606,
chaining based on reinforcement learning using resource usage,” in 2016.
Proc. IEEE ICUFN’17, Milan, Italy, July. 2017, pp. 582–586.

[256] J. Gubbi, R. Buyya, S. Marusic, and M. Palaniswami, “Internet of [268] N. Kumar, S. Misra, and M. S. Obaidat, “Collaborative learning
Things (IoT): A vision, architectural elements, and future directions,” automata-based routing for rescue operations in dense urban regions
Future Generation Computer Systems, vol. 29, no. 7, pp. 1645–1660, using vehicular sensor networks,” IEEE Systems Journal, vol. 9, no. 3,
2013. pp. 1081–1090, Sept. 2015.
[257] Y. Huang, X. Ma, X. Fan, J. Liu, and W. Gong, “When deep learning [269] W. K. Lai, M.-T. Lin, and Y.-H. Yang, “A machine learning system
meets edge computing,” in Proc. IEEE ICNP’17, Toronto, ON, Canada, for routing decision-making in urban vehicular ad hoc networks,”
Oct. 2017, pp. 1–2. International Journal of Distributed Sensor Networks, vol. 11, no. 3,
[258] S. B. Calo, M. Touna, D. C. Verma, and A. Cullen, “Edge computing pp. 374–391, 2015.
architecture for applying AI to IoT,” in Proc. IEEE BigData’17, Boston, [270] F. Teymoori, H. Nabizadeh, and F. Teymoori, “A new approach in
MA, USA, Dec. 2017, pp. 3012–3016. position-based routing protocol using learning automata for VANETs
[259] H. Li, K. Ota, and M. Dong, “Learning IoT in edge: Deep learning for in city scenario,” arXiv preprint arXiv:1308.0099, 2013.
the internet of things with edge computing,” IEEE Network, vol. 32, [271] R. Li, F. Li, X. Li, and Y. Wang, “QGrid: Q-learning based routing
no. 1, pp. 96–101, Jan. 2018. protocol for vehicular ad hoc networks,” in Proc. IEEE IPCCC’14,
[260] J. Schneible and A. Lu, “Anomaly detection on the edge,” in Proc. Austin, TX, USA, Dec. 2014, pp. 1–8.
IEEE MILCOM’17, Baltimore, MD, USA, Oct. 2017, pp. 678–682. [272] Z. He, J. Cao, and X. Liu, “SDVN: Enabling rapid network innovation
[261] D. Zissis, “Intelligent security on the edge of the cloud,” in Proc. IEEE for heterogeneous vehicular communication,” IEEE Network, vol. 30,
ICE/ITMC’17, Funchal, Portugal, June. 2017, pp. 1066–1070. no. 4, pp. 10–15, July. 2016.
[262] A. Abeshu and N. Chilamkurti, “Deep learning: The frontier for dis- [273] J. G. Andrews, S. Buzzi, W. Choi, S. V. Hanly, A. Lozano, A. C. K.
tributed attack detection in fog-to-things computing,” IEEE Commun. Soong, and J. C. Zhang, “What will 5G be?” IEEE Journal on Selected
Magazine, vol. 56, no. 2, pp. 169–175, Feb. 2018. Areas in Communications, vol. 32, no. 6, pp. 1065–1082, June. 2014.
[263] Z. He, D. Zhang, and J. Liang, “Cost-efficient heterogeneous data [274] R. Trivisonno, R. Guerzoni, I. Vaishnavi, and D. Soldani, “SDN-
transmission in software defined vehicular networks,” in Proc. IEEE based 5G mobile networks: Architecture, functions, procedures and
HPCC-CSS-ICESS’15, New York, NY, USA, Aug. 2015, pp. 666–671. backward compatibility,” Trans. Emerging Telecommunications Tech-
[264] I. Ku, Y. Lu, M. Gerla, R. L. Gomes, F. Ongaro, and E. Cerqueira, nologies, vol. 26, no. 1, pp. 82–92, 2015.
“Towards software-defined VANET: Architecture and services,” in [275] H. I. Kobo, A. M. Abu-Mahfouz, and G. P. Hancke, “A survey
Proc. IEEE MedHocNet’14, Piran, Slovenia, June. 2014, pp. 103–110. on software-defined wireless sensor networks: Challenges and design
[265] K. Liu, L. Feng, P. Dai, V. C. S. Lee, S. H. Son, and J. Cao, “Coding- requirements,” IEEE Access, vol. 5, pp. 1872–1899, 2017.
assisted broadcast scheduling via memetic computing in SDN-based [276] B. T. de Oliveira and C. B. Margi, “Distributed control plane archi-
vehicular networks,” IEEE Trans. Intelligent Transportation Systems, tecture for software-defined wireless sensor networks,” in Proc. IEEE
vol. PP, no. 99, pp. 1–12, 2017. ISCE’16, Sao Paulo, Brazil, Sept. 2016, pp. 85–86.
[266] C. Wu, S. Ohzahata, and T. Kato, “Flexible, portable, and practicable [277] H. Ahmadi and R. Bouallegue, “Exploiting machine learning strategies
solution for routing in VANETs: A fuzzy constraint Q-learning ap- and RSSI for localization in wireless sensor networks: A survey,” in
proach,” IEEE Trans. Vehicular Technology, vol. 62, no. 9, pp. 4251– Proc. IEEE IWCMC’17, Valencia, Spain, June. 2017, pp. 1150–1154.
4263, Nov. 2013. [278] Z. Yu and J. J. P. Tsai, “A framework of machine learning based intru-
[267] ——, “Routing in VANETs: A fuzzy constraint Q-learning approach,” sion detection for wireless sensor networks,” in Proc. IEEE SUTC’08,
in Proc. IEEE GLOBECOM’12, Anaheim, CA, USA, Dec. 2012, pp. Taichung, Taiwan, June. 2008, pp. 272–279.
195–200.

Junfeng Xie received his B.S. degree in communi- Renchao Xie received his Ph.D. degree from the
cation engineering from University of Science and School of Information and Communication Engi-
Technology Beijing, Beijing, China, in 2013. He neering, BUPT, in 2012. From July 2012 to Septem-
is currently pursuing the Ph.D. degree at the State ber 2014, he worked as a postdoctoral researcher at
Key Laboratory of Networking and Switching Tech- China Unicom. From November 2010 to November
nology, Beijing University of Posts and Telecom- 2011, he visited Carleton University as a visiting
munications, Beijing, China. From September 2017 scholar. He is an associate professor at BUPT. His
to September 2018, he visited Carleton University, current research interests include content delivery
Ottawa, ON, Canada, as a visiting Ph.D. student. His network, machine learning, software defined net-
current research interests include machine learning, working, and 5G networks. He has published more
content delivery network, software defined network- than 30 journal and conference papers. He has served
ing, and blockchain. on the Technical Program Committees (TPCs) of Chinacom 2016 and the
2012 IEEE Vehicular Technology Conference (VTC)-Spring. He has also
served for several journals and conferences as a reviewer, including IEEE
Transactions on Communications, ACM/Springer Wireless Networks, the
EURASIP Journal on Wireless Communications and Networking, (Wiley)
Wireless Communications and Mobile Computing, IEEE Communications
F. Richard Yu (S’00-M’04-SM’08-F’18) received Letters, 2011 IEEE GLOBECOM, and so on.
the PhD degree in electrical engineering from the
University of British Columbia (UBC) in 2003.
From 2002 to 2006, he was with Ericsson (in Lund,
Sweden) and a start-up in California, USA. He
joined Carleton University in 2007, where he is cur- Jiang Liu received his B.S. degree in electronics
rently a Professor. He received the IEEE Outstanding engineering from Beijing Institute of Technology,
Service Award in 2016, IEEE Outstanding Leader- China, in 2005, his M.S. degree in communication
ship Award in 2013, Carleton Research Achievement and information systems from Zhengzhou Univer-
Award in 2012, the Ontario Early Researcher Award sity, China, in 2009, and his Ph.D. degree from
(formerly Premiers Research Excellence Award) in BUPT in 2012. He is currently an associate professor
2011, the Excellent Contribution Award at IEEE/IFIP TrustCom 2010, the at BUPT. His current research interests include net-
Leadership Opportunity Fund Award from Canada Foundation of Innovation work architecture, network virtualization, machine
in 2009 and the Best Paper Awards at IEEE ICNC 2018, VTC 2017 learning, software defined networking, and tools and
Spring, ICC 2014, Globecom 2012, IEEE/IFIP TrustCom 2009 and Int’l platforms for networking research and teaching.
Conference on Networking 2005. His research interests include wireless cyber-
physical systems, connected/autonomous vehicles, security, distributed ledger
technology, and deep learning.
He serves on the editorial boards of several journals, including Co-Editor-
in-Chief for Ad Hoc & Sensor Wireless Networks, Lead Series Editor for
IEEE Transactions on Vehicular Technology, IEEE Transactions on Green Chenmeng Wang received the M.S. degree in in-
Communications and Networking, and IEEE Communications Surveys & formation and telecommunication engineering from
Tutorials. He has served as the Technical Program Committee (TPC) Co-Chair the Chongqing University of Posts and Telecommu-
of numerous conferences. Dr. Yu is a registered Professional Engineer in the nications, Chongqing, China, in 2014, where he is
province of Ontario, Canada, a Fellow of the Institution of Engineering and currently pursuing the Ph.D. degree with the School
Technology (IET), and a Fellow of the IEEE. He is a Distinguished Lecturer, of Communication and Information Engineering.
the Vice President (Membership), and an elected member of the Board of From 2015 to 2017, he was a visiting student with
Governors (BoG) of the IEEE Vehicular Technology Society. Carleton University, Ottawa, ON, Canada. His cur-
rent research interests include small cell networks,
mobile edge computing systems, resource allocation,
and applications of convex optimization in mobile
networks.

Tao Huang received his B.S. degree in communi-

cation engineering from Nankai University, Tianjin,
China, in 2002, and his M.S. and Ph.D. degrees Yunjie Liu received his B.S. degree in technical
in communication and information systems from physics from Peking University, Beijing, China, in
Beijing University of Posts and Telecommunications 1968. He is currently the Academician of the China
in 2004 and 2007, respectively. He is currently a pro- Academy of Engineering, Chief of the Science and
fessor at Beijing University of Posts and Telecom- Technology Committee of China Unicom, and Dean
munications. His current research interests include of the School of Information and Communication
network architecture, machine learning and software Engineering, BUPT. His research interests include
defined networking. next generation networks, and network architecture
and management.

Software-Defined Networks: A Systems Approach
From Everand
Software-Defined Networks: A Systems Approach
Larry Peterson
5/5 (1)
A Survey of Machine Learning Techniques Applied To Software Defined Networking SDN Research Issues and Challenges
No ratings yet
A Survey of Machine Learning Techniques Applied To Software Defined Networking SDN Research Issues and Challenges
38 pages
Machine Learning Techniques - SDN
No ratings yet
Machine Learning Techniques - SDN
38 pages
Deep Learning Based Traffic Classification in Software Defined Networking A Survey
No ratings yet
Deep Learning Based Traffic Classification in Software Defined Networking A Survey
8 pages
T-05 Distributed SDN Control - Survey 2018 PDF
No ratings yet
T-05 Distributed SDN Control - Survey 2018 PDF
22 pages
A Survey On Software-Defined Networking
No ratings yet
A Survey On Software-Defined Networking
27 pages
Abdullah 2018
No ratings yet
Abdullah 2018
45 pages
SDN in Wide-Area Networks A Survey
No ratings yet
SDN in Wide-Area Networks A Survey
6 pages
A Survey of Software-Defined Networking: Past, Present, and Future of Programmable Networks
No ratings yet
A Survey of Software-Defined Networking: Past, Present, and Future of Programmable Networks
18 pages
Software-Defined Networking - A Comprehensive Survey PDF
No ratings yet
Software-Defined Networking - A Comprehensive Survey PDF
49 pages
The Effects of Dos Attacks On Odl and Pox SDN Controllers: Huseyin Polat Onur Polat
No ratings yet
The Effects of Dos Attacks On Odl and Pox SDN Controllers: Huseyin Polat Onur Polat
5 pages
NFV SDN
No ratings yet
NFV SDN
6 pages
Network Monitoring in Software-Defined Networking A Review
No ratings yet
Network Monitoring in Software-Defined Networking A Review
12 pages
The Road To SDN: An Intellectual History of Programmable Networks
No ratings yet
The Road To SDN: An Intellectual History of Programmable Networks
13 pages
A Survey On Software-Defined Network and OpenFlow - From Concept To Implementation
No ratings yet
A Survey On Software-Defined Network and OpenFlow - From Concept To Implementation
26 pages
Surveys Dn
No ratings yet
Surveys Dn
25 pages
1804.05271
No ratings yet
1804.05271
20 pages
Machine Learning in Network Anomaly Detection a Survey
No ratings yet
Machine Learning in Network Anomaly Detection a Survey
18 pages
State-of-the-Art Deep Learning: Evolving Machine Intelligence Toward Tomorrow's Intelligent Network Traffic Control Systems
No ratings yet
State-of-the-Art Deep Learning: Evolving Machine Intelligence Toward Tomorrow's Intelligent Network Traffic Control Systems
24 pages
A Machine Learning Approach For Traffic Flow
No ratings yet
A Machine Learning Approach For Traffic Flow
6 pages
SoftwareDefinedNetworking - A Comprehensive Survey (01-31)
No ratings yet
SoftwareDefinedNetworking - A Comprehensive Survey (01-31)
31 pages
Machine Learning For Networking Workflow, Advances and Opportunities
No ratings yet
Machine Learning For Networking Workflow, Advances and Opportunities
8 pages
Machine Learning For Networking - Workflow, Advances and Opportunities PDF
No ratings yet
Machine Learning For Networking - Workflow, Advances and Opportunities PDF
8 pages
SDN
No ratings yet
SDN
17 pages
Software-Defined Networking: State of Art and Research Challenges
No ratings yet
Software-Defined Networking: State of Art and Research Challenges
24 pages
Software-Defined Networking: Challenges and Research Opportunities For Future Internet
No ratings yet
Software-Defined Networking: Challenges and Research Opportunities For Future Internet
26 pages
Federated Deep Reinforcement Learning For Task Offloading in Digital Twin Edge Networks
No ratings yet
Federated Deep Reinforcement Learning For Task Offloading in Digital Twin Edge Networks
12 pages
Knowledge Defined Networking
No ratings yet
Knowledge Defined Networking
9 pages
Intelligent Software-Defined Network For Cognitive Routing Optimization Using Deep Extreme Learning Machine Approach
No ratings yet
Intelligent Software-Defined Network For Cognitive Routing Optimization Using Deep Extreme Learning Machine Approach
17 pages
Improving Security Through Software Defined Networking (SDN) : AN SDN Based Model
No ratings yet
Improving Security Through Software Defined Networking (SDN) : AN SDN Based Model
6 pages
Habusadeh, Journal Manager, 854 - 859
No ratings yet
Habusadeh, Journal Manager, 854 - 859
6 pages
1901.08329v2
No ratings yet
1901.08329v2
8 pages
PROJECT LIST - Department of EE - Fall 2013: Supervisor Title Pre-Requisites Challenges
No ratings yet
PROJECT LIST - Department of EE - Fall 2013: Supervisor Title Pre-Requisites Challenges
7 pages
The IO Driven Server
No ratings yet
The IO Driven Server
9 pages
Software Defined Networking Challenges and Future
No ratings yet
Software Defined Networking Challenges and Future
9 pages
DVNE DRL: Dynamic Virtual Network Embedding Algorithm Based On Deep Reinforcement Learning
No ratings yet
DVNE DRL: Dynamic Virtual Network Embedding Algorithm Based On Deep Reinforcement Learning
22 pages
07752801
No ratings yet
07752801
7 pages
Cognitive Software-Defined Networking Using Fuzzy Cognitive Maps
No ratings yet
Cognitive Software-Defined Networking Using Fuzzy Cognitive Maps
24 pages
IOT Paper-1
No ratings yet
IOT Paper-1
27 pages
Software Defined Networking With Intrusion Detection System
No ratings yet
Software Defined Networking With Intrusion Detection System
3 pages
Software-Defined_Networking_Concepts_and_Applicati
No ratings yet
Software-Defined_Networking_Concepts_and_Applicati
6 pages
2023-采用了GNN+GRU的策略-拓扑是Rocketfuel，环境没提没有开源-Routing Optimization With Deep Reinforcement Learning in Knowledge Defined Networking
No ratings yet
2023-采用了GNN+GRU的策略-拓扑是Rocketfuel，环境没提没有开源-Routing Optimization With Deep Reinforcement Learning in Knowledge Defined Networking
12 pages
SuperNIC A Hardware MultiTenant SmartNIC
No ratings yet
SuperNIC A Hardware MultiTenant SmartNIC
16 pages
SDN Tutorial IEEE
No ratings yet
SDN Tutorial IEEE
49 pages
SDN Controller Mechanisms For Flexible A
No ratings yet
SDN Controller Mechanisms For Flexible A
9 pages
computernetworks
No ratings yet
computernetworks
27 pages
Integration of Networking, Caching, and Computing in Wireless Systems: A Survey, Some Research Issues, and Challenges
No ratings yet
Integration of Networking, Caching, and Computing in Wireless Systems: A Survey, Some Research Issues, and Challenges
32 pages
Optimal In-Network Distribution of Learning Functions For A Secure-by-Design Programmable Data Plane of Next-Generation Networks.18384v1
No ratings yet
Optimal In-Network Distribution of Learning Functions For A Secure-by-Design Programmable Data Plane of Next-Generation Networks.18384v1
13 pages
SOFTWARE-DEFINEDNETWORKINGCHALLENGESANDRESEARCHOPPORTUNITIESFORFUTUREINTEREST.A20151
No ratings yet
SOFTWARE-DEFINEDNETWORKINGCHALLENGESANDRESEARCHOPPORTUNITIESFORFUTUREINTEREST.A20151
14 pages
A Flow-Based Anomaly Detection Approach With Feature Selection Method Against DDoS Attacks in SDNs
No ratings yet
A Flow-Based Anomaly Detection Approach With Feature Selection Method Against DDoS Attacks in SDNs
19 pages
Software-Defined Allocation and Virtualization For Broadband Multi - Beam Satellite Communication Networks Based On High Throughput Satellites
No ratings yet
Software-Defined Allocation and Virtualization For Broadband Multi - Beam Satellite Communication Networks Based On High Throughput Satellites
8 pages
07 Performance Evaluation of Data Center Network With Network Micro-Segmentation
No ratings yet
07 Performance Evaluation of Data Center Network With Network Micro-Segmentation
6 pages
Big Data For 5G Intelligent Network Slicing
No ratings yet
Big Data For 5G Intelligent Network Slicing
7 pages
IET Wireless Sensor Systems - 2021 - Nam Nguyen - A Survey of Blockchain Technologies Applied To Software Defined
No ratings yet
IET Wireless Sensor Systems - 2021 - Nam Nguyen - A Survey of Blockchain Technologies Applied To Software Defined
15 pages
S DN History
No ratings yet
S DN History
13 pages
Software-Defined Networking and Its Induction in Cloud Computing A Newer Approach To Networking and Modernizing The Cloud
No ratings yet
Software-Defined Networking and Its Induction in Cloud Computing A Newer Approach To Networking and Modernizing The Cloud
10 pages
An Approach To Data Analysis in 5G Networks
No ratings yet
An Approach To Data Analysis in 5G Networks
23 pages
(2020 - IEEE-Trsnsactions Omn NSAE) RL-Routing - An SDN Routing Alogorirjm Based On Deep Reinforcement Learning
No ratings yet
(2020 - IEEE-Trsnsactions Omn NSAE) RL-Routing - An SDN Routing Alogorirjm Based On Deep Reinforcement Learning
15 pages
2 Sensors-21-04884
No ratings yet
2 Sensors-21-04884
18 pages
IA Sendra, Lloret
No ratings yet
IA Sendra, Lloret
5 pages
Assessment Checklist
No ratings yet
Assessment Checklist
7 pages
Network Address Conservation Subnetting, VLSM, NAT & RFC1918
No ratings yet
Network Address Conservation Subnetting, VLSM, NAT & RFC1918
68 pages
KPIs GSM
No ratings yet
KPIs GSM
19 pages
Soal Cisco
No ratings yet
Soal Cisco
8 pages
Ch3 Part 2 Error Detection and Correction
No ratings yet
Ch3 Part 2 Error Detection and Correction
19 pages
NameCent Name Centrality-Based Data Broadcast Mitigation in Vehicular Named Data Networks
No ratings yet
NameCent Name Centrality-Based Data Broadcast Mitigation in Vehicular Named Data Networks
10 pages
38 - M2 Assignment 6
No ratings yet
38 - M2 Assignment 6
7 pages
SP891 Manual
No ratings yet
SP891 Manual
63 pages
LTE Feature Study - SWITCH
No ratings yet
LTE Feature Study - SWITCH
14 pages
Free Proxy List
No ratings yet
Free Proxy List
5 pages
ZIGBEE TECHNOLOGY Final
100% (2)
ZIGBEE TECHNOLOGY Final
23 pages
Cisco IOS-XR - Deploy An IOS-XRv Appliance in GNS3 - Just Lab IT !!!!!
No ratings yet
Cisco IOS-XR - Deploy An IOS-XRv Appliance in GNS3 - Just Lab IT !!!!!
7 pages
Teldat Dm704-I Configuration Monitoring
No ratings yet
Teldat Dm704-I Configuration Monitoring
238 pages
Mod Bus
No ratings yet
Mod Bus
2 pages
Santosh - Resume IP
No ratings yet
Santosh - Resume IP
3 pages
Introduction To Networking Concepts
No ratings yet
Introduction To Networking Concepts
32 pages
Isdn Protocol Architecture
No ratings yet
Isdn Protocol Architecture
11 pages
Wcdma Architecture
No ratings yet
Wcdma Architecture
59 pages
Zenitel ECPIR 3P 1023200033
No ratings yet
Zenitel ECPIR 3P 1023200033
3 pages
Ebsu Ict Network Diagram
No ratings yet
Ebsu Ict Network Diagram
1 page
Chapter 7 v8.0
No ratings yet
Chapter 7 v8.0
73 pages
Ahmed Ashraf Ali IT Operation /network Engineer Personal Summary
No ratings yet
Ahmed Ashraf Ali IT Operation /network Engineer Personal Summary
2 pages
A20 TATA Communication RevC
No ratings yet
A20 TATA Communication RevC
4 pages
Error Probability For L-Branch Coherent BPSK Equal
No ratings yet
Error Probability For L-Branch Coherent BPSK Equal
6 pages
Adaptive and Intelligent Digital Signal Processing For Improved Optical Interconnection
No ratings yet
Adaptive and Intelligent Digital Signal Processing For Improved Optical Interconnection
17 pages
MPMC - UnitIV - Serial Communication and Bus interface-Part-I
No ratings yet
MPMC - UnitIV - Serial Communication and Bus interface-Part-I
35 pages
Soldier Tracking and Health Monitoring System
No ratings yet
Soldier Tracking and Health Monitoring System
18 pages
431 Client Server Model Indiashastra
No ratings yet
431 Client Server Model Indiashastra
3 pages
HC110111000 VRP Basics and Operation
No ratings yet
HC110111000 VRP Basics and Operation
33 pages

A Survey of Machine Learning Techniques Applied To Software Defined Networking (SDN) : Research Issues and Challenges

Uploaded by

A Survey of Machine Learning Techniques Applied To Software Defined Networking (SDN) : Research Issues and Challenges

Uploaded by

This article has been accepted for publication in a future issue of this journal, but has not been

A Survey of Machine Learning Techniques Applied

Beijing University of Posts and Telecommunications, Beijing 100876, P.R. China

Chongqing University of Posts and Telecommunications, Chongqing 400065, P.R. China

Workflow of SDN Reinforcement Learning

Ⅴ. Machine Learning in Ⅶ. Broader Perspectives

Fig. 1. Road map of ML-based SDN.

Ref. Published in Year Areas focused ML techniques

Supervised, unsupervised and reinforcement

Network Virtualization Mobility Management Security Application

OpenDayLight Floodlight OpenDayLight Floodlight

Control Plane Beacon Ryu Beacon Ryu

Flow Table for SW2

OpenFlow Controller Flow Table for SW2 after the

Rule Action Stats Entry1 src_ip=192.168.100.3 drop …

Rule Action Stats

and its neighbors, such as Chebyshev, City-block, Euclidean

Machine learning techniques

Decision tree X2 a2(2) Y2

X Xt-1 Xt Xt+1 support vectors

an excitatory spiking signal and drops when it receives an

figure, there are many possible separating hyperplanes between

RL to SDN, the controller generally works as an agent and

ML algorithm Problem type Advantages Shortcomings

• Simple to understand decisions • Instability: even a small change in the training

• Work well on large training dataset

• Computationally expensive due to the require-

• Hard to train large dataset because the training

• Simple to understand and implement • Rely on independence assumption, which is

• Hard to train large dataset because the training

• Sensitive to initial points and outliers

• Easy to understand the data mapping

Classification, • Rely on assumptions such as manifold, cluster,

• Can handle problems with high-dimensional

applications. Then the labeled training dataset is used by semi-

hierarchical feature extraction [147]. However, the deeper

B. Routing Optimization Heuristic Algorithm Layer

of network links and increase the end-to-end transmission

Ref. Objective Learning model Dataset input Dataset output

Application- Flow features such as the sizes of Top 40 applications in

Four QoS classes:

prediction aims to predict the trend of traffic volume by

Ref. Objective Learning model Complexity Brief summary

Ref. Objective Learning model Dataset input Dataset output

Application- Operating system-granularity

There are two scenarios in SDN: single-tenancy and multi-

a) Resource Allocation in Single-tenancy SDN Network: datacenters

Many works have studied the data plane resource allocation

Network (C-RAN) to optimize users’ QoE and UAVs’ transmit

b) Resource Allocation in Multi-tenancy SDN Network: Configuration

significant impact on the processing of each tenant’s control

Ref. Objective Learning model Complexity Brief summary

Using DRL to jointly allocate networking, caching and computing

Using RL to select the optimal configuration strategy to minimize

Using RL-based Stackelberg game theory to optimize the network

E. Security anomaly-based IDS [195]–[198]. In signature-based IDS, hu-

In contrast, anomaly-based IDS is a statistical method,

as an anomaly. An advantage of anomaly-based IDS is that Feature Extractor

Queue Manager and Naive Bayes) is compared and evaluated in [204].

5 classes: normal and

Six features such as av-

Ref. Advantages Shortcomings

Continued from previous page

network resources by using ML techniques, especially RL C. Software Defined Optical Networks

Tao Huang received his B.S. degree in communi-

You might also like