The Smart Cyber Ecosystem for Sustainable Development

The paper of [29] compares the performance of several supervised and unsupervised ML algorithms to classify traffic as normal or abnormal. In [30], the authors propose a traffic classification algorithm based on flow analysis. The algorithm is designed for SDN platforms.

The work in [31] uses traffic classification as part of a traffic scheduling solution for a data center network managed by SDN. ML techniques are used to classify elephant traffic flows, which require high bandwidth. Then, the SDN controller uses classification results and implements optimization of traffic scheduling. The authors of [32] use two phases for detection of elephant flows using ML techniques in SDN-based networks. In the first phase, packet headers are used to distinguish between elephant flows from mice flows, low bandwidth flows. A decision tree ML algorithm is then used to detect and classify traffic flows. Also, the authors of [33] developed an OpenFlow-based SDN system for enterprise networks. Several classification algorithms were compared.

An application of ML for improving the quality and latency of real time video streaming is proposed in [34]. The video quality is achieved through rate control, employing a DL-based adaptive rate control scheme. Two RL models are used. The first one is for prediction of video quality model, while the second is video quality RL. The predictor uses previous video frames to predict quality of future frames. The RL algorithm adopts and trains the neural network based on historic network status and video quality predictions to decide rate control actions.

In their research published in [35], the authors developed a method for traffic prediction based on the SDN architecture, where the controller gathers data and uses it to classify data flows into categories. Neural network algorithm is used to predict the expected traffic, leading to a system that can act to avoid traffic imbalance before it occurs.

QoS parameters are normally used by network administrators to assess the network performance. The parameters include throughput, loss rate, delay, and jitter. However, QoE is a parameter used to represent the user perception and satisfaction of the services. Developing prediction methods for QoS and QoE parameters helps network operators and service providers to offer high quality services [13]. SDN has been used to facilitate the implementation of different algorithms for QoS/QoE prediction [36–39].

The authors of [36] propose a linear regression ML algorithm for QoS prediction in SDN-based networks. A decision tree approach is used to detect relations between KPIs and QoS parameters. The authors show that the method can predict congestion and thus provide recommendations on QoS improvement. The researchers in [37] utilize two ML techniques for estimating QoS parameters for video on demand applications.

QoE prediction was addressed in [38–39]. The method of [38] was designed for video streaming in an SDN-based network, where QoS parameters are employed to estimate the mean opinion score. The SDN controller is used to adjust video parameters to improve QoE. In [39], the authors use neural network and KNN algorithms for predicting QoE parameters using video quality parameters.

Users only use secure networks. One major issue in networking is the attacks by intrusions. Detecting intrusion and responding to attacks is a real challenge, especially in wireless networks where data is communicated over a shared media. With the advent of ML technology, researchers have been trying to exploit ML techniques to overcome this problem. ML methods can process and classify traffic flows based on observable properties such as number of packets in a flow, flow duration, packet size, inter-packet arrival time, and flow size in bytes. Based on these properties, more advanced features can be computed.

The authors of [40] propose a system for ML-based flow classification integrated in SDN. It exploits methods of extracting knowledge that can be used by the controller in order to classify flows. A supervised ML algorithm has been used for identifying the underlying application flow, while unsupervised learning algorithm has been used for clustering flows in order to identify unknown applications. The system is also able to detect groups of related flows and proved to detect anomaly and botnet, as well as honeypot traffic rerouting.

The authors of [41, 42] show that employing user centric approaches combined with ML can improve the performance of anomaly detection in cellular networks. User centric approaches focus on the end user while developing designs and strategies for networks, thus the need of end users will tailor networking solutions. The study uses the SVM, KNN, and an optimized version of decision tree, wherein algorithms learn and predict QoE scores for users. A node is judged to be dysfunctional if the maximum number of users connected to this network node have poor QoE scores.

In [11], the authors developed an SDN-based system for real time intrusion detection using a deep learning-based approach. Data sets are used to train the ML algorithm, following the supervised learning approach. Then, a flow inspection module examines the flows and decides whether it is an intrusion flow or not. The SDN paradigm facilitates the implementation of the proposed method, as it provides means for designing flow-based monitoring and control mechanisms.

A detailed intelligent system for an automated control of large-scale networks is developed in [43]. The system architecture exploits SDN and deep RL methods for intelligent network control. Among other objectives, the system can serve applications that require traffic analysis and classification. RL involves processes that learn to make better decisions from experiences by interacting with all network elements. The SDN architecture is comprised of three planes: forwarding plane, the CP, and the AI plane. The function of the forwarding plane is forwarding, processing, and monitoring of data packets. The CP connects the AI plane and the forwarding plane. The SDN controller manages the network through standard southbound protocols and interacts with the AI plane through the northbound interface. The AI plane generates policies. It learns the policy through interaction with the network environment. An AI agent processes the network state data collected by the forwarding plane, then transfers the data to a policy through RL that is used to make decisions and optimization.

The researchers in [44] use KNN classification algorithm for detecting several types of attacks. The authors pointed out that with large training dataset, the computation of distances between the test point and training data is time-consuming as the algorithm needs also to sort and find the closest K neighbors. Author in [45] uses unsupervised ML for detecting anomalies in real networks. The proposed approach enables anticipation of anomalies before they become a real problem.

The paper of [46] provides a detailed review of recent studies that combines ML and SDN technology to solve the intrusion detection problem. The authors compare the performance of supervised, unsupervised, semi-supervised, and DL algorithms.

In recent years, we see tremendous widespread of WLANs, as they evolve to meet user’s requirements, especially the high speed Internet connection. Accurate prediction of WLANs performance is important for managing network resources. However, due to interference and the interactions between the physical and data link layers as well as the heterogeneity of WLAN devices, predicting and estimating the performance of WLANs is a difficult task. Many of the solutions use the Signal-to-Noise and Interference Ratio (SNIR) parameter. However, it has been proven that relying on this parameter to estimate the performance does not lead to satisfactory results. In fact, the performance of WLANs is more complex to be measured using SNIR, and it is a function of large number of interacting and related parameters that may change over time.