Machine learning is evolved from a collection of powerful techniques in AI areas and has been extensively used in data mining, which allows the system to learn the useful structural patterns and models from training data Machine learning algorithms can be basically classified into four categories: supervised, unsupervised, semi-supervised and reinforcement learning In this chapter, widely-used machine learning algorithms are introduced Each algorithm is briefly explained with some examples

Introduction to Machine Learning

In recent years, with the rapid development of current Internet and mobile communication technologies, the infrastructure, devices and resources in networking systems are becoming more complex and heterogeneous. In order to efficiently organize, manage, maintain and optimize networking systems, more intelligence needs to be deployed. However, due to the inherently distributed feature of traditional networks, machine learning techniques are hard to be applied and deployed to control and operate networks. Software defined networking (SDN) brings us new chances to provide intelligence inside the networks. The capabilities of SDN (e.g., logically centralized control, global view of the network, software-based traffic analysis, and dynamic updating of forwarding rules) make it easier to apply machine learning techniques. In this paper, we provide a comprehensive survey on the literature involving machine learning algorithms applied to SDN. First, the related works and background knowledge are introduced. Then, we present an overview of machine learning algorithms. In addition, we review how machine learning algorithms are applied in the realm of SDN, from the perspective of traffic classification, routing optimization, quality of service/quality of experience prediction, resource management and security. Finally, challenges and broader perspectives are discussed.

A Survey of Machine Learning Techniques Applied to Software Defined Networking (SDN): Research Issues and Challenges

Millions of sensors continuously produce and transmit data to control real-world infrastructures using complex networks in the Internet of Things (IoT). However, IoT devices are limited in computational power, including storage, processing, and communication resources, to effectively perform compute-intensive tasks locally. Edge computing resolves the resource limitation problems by bringing computation closer to the edge of IoT devices. Providing distributed edge nodes across the network reduces the stress of centralized computation and overcomes latency challenges in the IoT. Therefore, edge computing presents low-cost solutions for compute-intensive tasks. Software-Defined Networking (SDN) enables effective network management by presenting a global perspective of the network. While SDN was not explicitly developed for IoT challenges, it can, however, provide impetus to solve the complexity issues and help in efficient IoT service orchestration. The current IoT paradigm of massive data generation, complex infrastructures, security vulnerabilities, and requirements from the newly developed technologies make IoT realization a challenging issue. In this research, we provide an extensive survey on SDN and the edge computing ecosystem to solve the challenge of complex IoT management. We present the latest research on Software-Defined Internet of Things orchestration using Edge (SDIoT-Edge) and highlight key requirements and standardization efforts in integrating these diverse architectures. An extensive discussion on different case studies using SDIoT-Edge computing is presented to envision the underlying concept. Furthermore, we classify state-of-the-art research in the SDIoT-Edge ecosystem based on multiple performance parameters. We comprehensively present security and privacy vulnerabilities in the SDIoT-Edge computing and provide detailed taxonomies of multiple attack possibilities in this paradigm. We highlight the lessons learned based on our findings at the end of each section. Finally, we discuss critical insights toward current research issues, challenges, and further research directions to efficiently provide IoT services in the SDIoT-Edge paradigm.

Complementing IoT Services Through Software Defined Networking and Edge Computing: A Comprehensive Survey

Software-Defined Network (SDN) has become a promising network architecture in current days that provide network operators more control over the network infrastructure. The controller, also called as the operating system of the SDN, is responsible for running various network applications and maintaining several network services and functionalities. Despite all its capabilities, the introduction of various architectural entities of SDN poses many security threats and potential targets. Distributed Denial of Services (DDoS) is a rapidly growing attack that poses a tremendous threat to the Internet. As the control layer is vulnerable to DDoS attacks, the goal of this paper is to detect the attack traffic, by taking the centralized control aspect of SDN. Nowadays, in the field of SDN, various machine learning (ML) techniques are being deployed for detecting malicious traffic. Despite these works, choosing the relevant features and accurate classifiers for attack detection is an open question. For better detection accuracy, in this work, Support Vector Machine (SVM) is assisted by kernel principal component analysis (KPCA) with genetic algorithm (GA). In the proposed SVM model, KPCA is used for reducing the dimension of feature vectors, and GA is used for optimizing different SVM parameters. In order to reduce the noise caused by feature differences, an improved kernel function (N-RBF) is proposed. The experimental results show that compared to single-SVM, the proposed model achieves more accurate classification with better generalization. Moreover, the proposed model can be embedded within the controller to define security rules to prevent possible attacks by the attackers.

/pdf/an-evolutionary-svm-model-for-ddos-attack-detection-in-331am3w47l.pdf

An Evolutionary SVM Model for DDOS Attack Detection in Software Defined Networks

As novel technologies continue to reshape the digital era, cyberattacks are also increasingly becoming more commonplace and sophisticated. Distributed denial of service (DDoS) attacks are, perhaps, the most prevalent and exponentially-growing attack, targeting the varied and emerging computational network infrastructures across the globe. This necessitates the design of an efficient and early detection of large-scale sophisticated DDoS attacks. Software defined networks (SDN) point to a promising solution, as a network paradigm which decouples the centralized control intelligence from the forwarding logic. In this work, a deep convolutional neural network (CNN) ensemble framework for efficient DDoS attack detection in SDNs is proposed. The proposed framework is evaluated on a current state-of-the-art Flow-based dataset under established benchmarks. Improved accuracy is demonstrated against existing related detection approaches.

/pdf/a-deep-cnn-ensemble-framework-for-efficient-ddos-attack-8gf5mcrpw4.pdf

A Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks

Detection and defense of DDoS attack–based on deep learning in OpenFlow-based SDN

The invention discloses a deep Q learning-based route planning method. According to the method, a reward value matrix is generated according to network topology; and a trained deep neural network model is adopted to replace the Q value table of ordinary Q learning so as to perform route planning. According to the method of the present invention, by using the features of abstract high-level data and automatic learning of deep learning, the method of the invention can plan a shortest path faster in large-scale application deployment compared with a traditional Dijkstra algorithm.

Deep Q learning-based route planning method

The invention discloses a DDoS attack defense device and method in software defined network; the device comprises a flow meter counting information collecting module, a counting information format converting module, a feature extracting module, an attack detecting module and an attack defense strategy generating module; the flow meter counting information collecting module is used for collecting the counting information of each flow meter table item; the feature extracting module extracts or constructs suitable flow meter features from the data information with format converted and performs dimension reconstruction; the attack detecting module uses the features acquired by the feature extracting module as input of a depth learning model and judges whether the corresponding information passing through model detection is the information of the flow meter table item corresponding to an attack packet or not; the attack defense strategy generating module extracts the feature information which is marked as an attack type from a database, and the format of the feature information is restored; a flow meter table item of a drop type is generated and issued to an OpenFlow exchanger, so thatcleaning of the attack flow is realized. According to the detection method in the invention, the detection precision is improved, and attack defense is realized.

Wu Yan

Papers

Detection and defense of DDoS attack–based on deep learning in OpenFlow-based SDN

Deep Q learning-based route planning method

DDoS attack defense device and method in software defined network