ScienceDirect ScienceDirect Available online at www.sciencedirect.com ScienceDirect Procedia Computer Science 171 (2020) 2750–2759 Third International Conference on Computing and Network Communications (CoCoNet’19) Data Traffic Classification in Software Defined Networks (SDN) using supervised-learning Meenaxi M Raikara, Meena S Mb, Mohammed Moin Mullac, Nagashree S Shettid, Meghana Karanandie a,b,c,d,e . K L.E. Technological University, Vidyanagar, Hubballi, 580031, India Abstract Traffic classification with accuracy is of prime importance in network activities such as security monitoring, traffic engineering, fault detection, accounting of network usage, and for is providing differentiation in due Quality of Service fficbilling Classification significant in recent days to rapid growth (QoS) in the ffic classification havedue failed to provide parameters of the various network services. Network Traffic Classification is significant in recent days to rapid growthreliable in the number of internet consumers. The different primitive techniques of network traffic classification have failed to provide reliable accuracy because of 1000 fold scaling in the amount of devices as well as flows. To overcome this drawback, the integration of Software Defined Network (SDN) architecture and machine learning technology is proposed in this paper. Three different supervised learning models, namely Support Vector Machine (SVM), nearest centroid and Naïve Bayesffi(NB), are applied to classify the data traffic based on the applications a software-defined and flows sent tointhe classifier for prednetwork platform. The network traffic traces are captured and flows features are generated, which is sent to the classifier for prediction. The accuracy obtained for SVM is 92.3%, NB is 96.79% and the nearest centroid is 91.02%. The challenges faced are in the live network data traffic capture and classification of the applications in the SDN platform. © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/) Peer-review under responsibility of the scientific committee of the Third International Conference on Computing and Network Communications (CoCoNet’19). Keywords:supervised learning, protocol, packet length, flow statistics 1. Introduction The network traffic analysis data provides useful information to the network administrator for decision making and optimal resource allocation. With the convergence of networking technologies such as cloud computing, IoT data growth is enormous. The challenge is to manage the resources for the increasing demand. The expectations of 1877-0509 © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/) Peer-review under responsibility of the scientific committee of the Third International Conference on Computing and Network Communications (CoCoNet’19). 10.1016/j.procs.2020.04.299 Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759 – 2751 the users in the current scenario are rapid service delivery, scalability, Quality of Experience (QoE), and customized service level agreements (SLAs). The service provider’s objective is to maximize profit by deploying resources, different mechanisms to meet the QoE as well as SLAs and minimize the operational cost. In the traditional system for network traffic, classification complexity lies in the code, whereas in machine learning, complexity lies in the network traces collected and the learning algorithm applied. The most important component of the machine learning algorithms is learning ability incurred. This ability is gained through experience and refinement process. The statistical properties of the network trace for instance, duration, packet length and packet inter-arrival time, are unique for the different network traffic classes. The machine learns this uniqueness in the network pattern with the aid of the training data set provided. The machine learning algorithm is employed to determine the pattern in the network data captured. Identification of diverse applications such as video streaming, file transfer, email and browsing is a challenge. An influential network management tool to handle the exponential network traffic growth is required for optimal utilization of the network resources. Intelligence needs to be embedded in networking devices for ease in organization, optimization, maintenance and management. The distributed nature of the networking system makes it hard to include machine learning for control of devices. The SDN platform provides an opportunity to include intelligence into the networking devices. The heterogeneous nature of devices accessing the network poses the challenge of organization, optimization, maintenance and management of the network resources. Embedding intelligence into the network devices is one solution. The infrastructural development such as GPU and frameworks for data processing such as Spark, Hadoop along with machine learning libraries such as scikit-learn, TensorFlow have introduced an opportunity for adding intelligence into networking devices. In the traditional networking system, the network devices are managed using command-line interface (CLI) and scripts. Advancement to this is SDN with semi-automation for network management. The recent version is intelligence-driven (Defined) networks, which is fully automated management of networks. In machine learning, the traffic and application patterns are learnt and refined to control the network for minimization of cost and maximizing throughput. 2. Related work The different traffic classification techniques are based on port numbers and deep packet inspection (DPI). The dynamic ports are used in the development of applications, where the port-based classification cannot be applied. In the case of DPI, identification of a pattern for the application is performed. The regular expressions are used for pattern recognition. With the abrupt growth in applications, pattern-based classification has a severe limitation of updating the pattern for a large number of applications. The encrypted traffic cannot be classified using the DPI mechanism. The traffic classification architecture for enterprise networks includes the four classifier modules, namely the static, identity, payload and statistical. Functional evaluation and performance analysis is measured through the response time of devices [4]. A survey is presented in [5], incorporating the supervised learning techniques (decision tree, Naive Bayes, SVM) and unsupervised learning models (K-means, DBSCAN, Auto class). In [6], the architecture is proposed for traffic classification in the SDN environment. The clustering mechanism is used to classify the traffic in [7]. The traffic classification is performed considering the enterprise network created using the SDN technology [8]. In [9] campus network scenario is setup in the SDN platform for traffic classification. The classification of different applications based on the machine learning technique is described in [10]. To collect the ground truth data, the crowdsourcing mechanism is employed. The policy management is controlled in the centralized SDN platform. The network management considering joint optimization for resource utilization is proposed in [11]. The AI-based techniques are presented for handling the spatio-temporal traffic variations in the network. The integration of Artificial Intelligence (AI) and SDN to predict controller performance is described in [12]. The parameters used are round trip time, throughput and the flow table content. The mean square error between the actual and predict SDN performance is depicted in the form of a graph. The machine learning and Software Defined Network architecture is used to classify the traffic of the enterprise network. The observations are 2752 Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759 – supervised learning gives higher accuracy [13]. The K-Nearest Neighbors (K-NN), decision tree classification and Random Forest Classification are the classification algorithms used in spam filtering to avoid cybersecurity attacks. The combination of SDN and artificial intelligence-based traffic classification for dynamic allocation of bandwidth, policy management, spatio-temporal traffic variations determination are the different techniques applied for network resource optimization. 3. Machine learning in networking domain Machine Learning (ML) algorithms are applied for intrusion detection, optimized spectrum utilization, obtaining power efficiency and network traffic management. Data is of prime importance in machine learning for making decisions instead of from pre-defined conditions presented in the algorithm. Three categories of ML algorithms are supervised, unsupervised and reinforcement learning. In supervised learning, labeled data is used for classification/regression. Classification of unlabeled data into different classes is the focus of unsupervised learning. The agent interacts with the environment and learns the action that maximizes the reward in reinforcement learning. The semi-supervised learning algorithm is applied for traffic classification based on the QoS parameter requirements of the users in [2]. 3.1. Machine learning for route optimization The controller routes the traffic in the SDN platform by modification of the flow tables. The controller can make decisions of forwarding, dropping or blocking by looking into the flow table rules. The machine learning algorithms are employed at the controller for obtaining an optimized routing path. 3.2. Security In [1], the survey regarding traffic profiling, device identification and security mechanism for IoT devices are described using machine learning algorithms. The challenges of providing security in the IoT networks are described in [3]. 3.3. Supervised learning The supervised learning algorithm constructs a knowledge base for decision making in the classification of the new flow instances from the prior known classes. In supervised learning, the relation between the input and output is modelled. The two phases in supervised learning are the training and testing phase. Training: The construction of the classification model is performed by examining the training data set in the learning phase, i.e., the training process. The real-time data in the form of ‘pcap’ files are captured using the ‘tcpdump’ networking tool. The labels are added to the real-time network traces and used for training. Testing: The classification of the new instance is performed by using the model created during the training phase. The supervised learning algorithm is applied to determine the mapping for active network traffic into output network traffic class. The first challenge involved in network traffic classification is obtaining a labelled data set. One solution is to use some portion of the data as a training set (e.g., 80% for training) and the remaining as a testing set (e.g. 20% for testing). The second challenge is that of newly generated network traffic may not be part of the known traffic classes. The third challenge is to classify during the online mode, i.e., real-time traffic classification. The flow instance data used to train the ML algorithm are as follows: 1. Source and destination IP and port number 2. Protocol information and header length 3. The total number of packets in the forward and backward direction, packet size, inter-arrival time and duration. 4. Status for active and idle, PUSH and URG count. Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759 – 2753 3.4. Reinforcement learning The entities involved in reinforcement learning are agents, different states (S) and action (A). The agent learns the best action by interacting with the environment for maximizing the reward. In the SDN platform, the controller acts as an agent. The monitoring of the network status is performed by the controller for making decisions in forwarding the data. 4. Proposed model In the proposed system model, the integration of SDN and machine learning algorithm for network traffic classification is described. The model construction for classification is performed using a supervised learning algorithm. 4.1. Problem formulation The constraints on bandwidth, delay, user experience and security have increased with an increase in the number of devices connecting to the internet. To easy the network administration operations, classification of traffic using machine learning is proposed. The system framework is represented in fig 1 for traffic classification using machine learning models in software-defined networking technology. The three sections of the proposed model are real-time network, virtual network and machine intelligence section. The hybrid network is formed by connecting the real world network to the virtual network for email and file transfer applications. In the virtual network, different topologies for wired and wireless networks are created. The machine intelligence section of the proposed model is employed for traffic classification. The traffic classification problem is formulated as described. Let M = {M1, M2,…,Mn} be the flow collected. One instance Mi includes k attributes. Mij is used for referring the jth attribute in the ith instance of the flow. In the context of network traffic classification, the attributes are inter-arrival time, duration, transferred number of bytes and packets. Let C = {C1,C2,…,Cq}, be the different classes for the network traffic classification problem. The sample Ci classes are ‘streaming’, ‘browsing’ and ‘email’ applications. The objective is to develop an algorithm for mapping n-dimension value M to C using machine learning techniques defined by function f(M) → C. The training data set is captured offline in the network during data transmission. The mapping f(M) → C is learnt by applying the classification algorithm on the training data set containing L tuples in the form (Mi, Ci). In table 2, the classes C1,C2 Fig 1. Framework for network traffic classification in software defined networks 2754 Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759 – C3 are represented with labels ‘1’,’2’ and ‘3’. In table 2 and 3, each row represents the flow instances M1, M2 and M3. The three supervised learning algorithms, namely Naïve Bayes, Support Vector Machine and nearest centroid algorithm, are applied to the training and testing data set for network traffic classification and compared for the accuracy, prediction, recall and f-score. The POX controller is used for remote monitoring and topology management. The network topology is created using the ‘mininet’ tool. The real-time (ongoing) traffic is captured through ‘tcpdump’ in the form of ‘pcap’ files. The flow features are generated using the ‘netmate’ flow generator. The labels are attached to this captured data. The prediction is performed using different machine learning algorithms. 4.1.1. Naïve Bayes The network traffic classification is obtained by applying Bayes theorem, assuming independence in predictors. P ( m | c ) P (c ) P(m) (1) P(c | M) = P(m1|c)*P(m2|c)* …*P(mn|c) (2) P(c | m)  where c is the network traffic class, M is a flow instance, P(c|m), P(m|c), P(c) and P(m) is posterior probability for network class c, likelihood probability, prior probability of class and predictor respectively. Algorithm1: Network traffic classification using the Naïve Bayes algorithm Inputs: M – Real-time flow instances Output: Network traffic class of the application. Steps: 1. The frequency table is obtained for the network training data set. 2. The likelihood table is created by determining the probabilities. 3. Using (1), for each class, the posterior probability is calculated. 4. The network traffic class c is predicted by choosing the highest posterior probability. 4.1.2. Support Vector Machine (SVM) In SVM, a hyperplane is used to separate the classes. The objective is to find optimal hyperplane, which separates the network traffic classes. Algorithm2: Network traffic classification using SVM Assumptions: The network data set is linearly separable. Inputs: M – Real-time flow instances Output: Network traffic class of the application. Steps: 1. The input flow instances is represented as: 2. 3. Two hyperplanes H1 and H2 are selected, such that no data points lie in between them. Determine margin ‘m’ to maximizes the distance between hyperplane H1 and H2 m 2 w Instead of maximizing margin m, the hyperplane with minimum w is chosen, where w is weight vector. The network traffic classification task is represented as an optimization problem as given in (3) where b is the offset. The lowercase ‘m’ is used to describe margin and capital ‘M’ is used to represent one flow instance. min w subject to T C (w M i i  b)  1 for i  1,..., n (3) Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759 – 2755 4.1.3. Nearest centroid algorithm The centroid is computed for each network traffic class. The measure of Euclidean distance between the data point and the centroid for each network class is obtained. The estimated network traffic class is obtained by choosing the class with minimum distance. Algorithm3: Network traffic classification using Nearest centroid algorithm Inputs: M – Real-time flow instances Output: Network traffic class of the application. Steps: 1. The input flow instances is represented as: {(M1,C1), (M2,C2),….(Mn,Cn)} with the labels Ci C 2. The centroid is computed for each class using the equation 3. The predicted network traffic class is given by equation 5. Implementation The Software Defined Network (SDN) architecture is used for classifying the network traffic generated by the client devices. The separation of the data plane and control plane is present in SDN. The OpenFlow protocol is used as the southbound interface for communication between the devices and the controller. The northbound interface is used for communication between network applications and the controller. The network dynamics in the topology are gathered and sent to the controller for decision making and management of the network devices. The adaptive control mechanism, along with data analytics, is proposed for providing appropriate control commands and handle network dynamics. The feedback mechanism provides the updates in the network topology like link failures or topology changes in the form of the network state information. The derived information is used for decision making and remote control of the devices in the network topology. Fig 1 depicts the different layers in the dynamic control mechanism of the system. The data acquisition layer enables the collection of the network topology information. The feature extraction layer consists of training models and AI algorithms for network traffic classification. The extracted information about traffic classification is made available to the controller for decision making. The decision and control layer receives the network state for decision making and control of the devices. Topology: The single switch with ‘n’ host topology, linear topology with the same number of switches as the host and the tree topology are the different topologies created for wired network scenarios. The custom topology can be created based on the user requirements. Controller: The controller is the central unit of the system. The SDN controller enables the dynamic management of the network resources. The monitoring of the devices is possible because the controller obtains the globalized network view. The POX controller is used for data forwarding within the devices. The OpenFlow protocol is used for flow rules manipulation. The communication between the networking devices in the topology and the controller is carried out using the southbound interface. The northbound interface enables communication with the application plane. The East/Westbound interface is used in ease of communication between multiple controllers. The workflow for the network traffic classification includes data collection, pre-processing, labelling, model construction, validation and prediction. In [14], the load balancing is performed for optimized network resource utilization in the SDN platform. In [15], the QoS parameters are considered for traffic classification in the SDN environment. The application of machine learning concepts in SDN for route optimization, QoE prediction, resource management, security, traffic classification are described in [16]. In table 1, the comparison of the three supervised learning models is represented in terms of the confusion matrix. The three classes taken for classification are HTTP, mail and streaming. The confusion matrix is represented for the number of flow instances as 150 and 999. 2756 Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759 – Table 1 Comparison of the three supervised learning models. Sl. No Supervised learning model 1 SVM 2 3 GaussianNB Nearest centroid Confusion Matrix (N = 150) Actual/Predicted HTTP HTTP Mail Confusion Matrix (N=999) Mail Streaming Actual/Predicted HTTP Mail Streaming 50 0 0 HTTP 0 47 3 Mail 511 0 0 0 47 3 Streaming 0 0 50 Streaming 0 0 438 Actual/Predicted HTTP Mail Streaming Actual/Predicted HTTP Mail Streaming HTTP 50 Mail 0 0 0 HTTP 510 1 0 37 2 Mail 0 37 13 Streaming 22 2 26 Streaming 0 0 435 Actual/Predicted HTTP HTTP Mail Streaming Actual/Predicted HTTP Mail Streaming 50 0 0 HTTP 510 0 1 Mail 34 10 6 Mail 19 10 21 Streaming 22 3 25 Streaming 172 3 263 In [17], the workflow for applying machine learning in the networking domain is described. A survey of using Deep Learning for user localization, network control, routing, scheduling, resource allocation, network optimization, radio control and security is presented in [18]. The Deep reinforcement learning for service and resource allocation, network slicing, edge caching is described in [21]. In [20] deep learning is applied for grading of lady’s finger. 5.1. Data collection The network trace data is collected for varying applications. The traffic classification can either be performed online or in offline mode. The collection of the network data online enables us to obtain feedback for maximizing the network resource utilization. In the proposed model, offline traffic classification is performed. The ‘tcpdump’ a packet analyzer utility, is used for collecting the network data. The output traces are redirected and stored in a ‘.pcap’ file format. 5.1.1. Browsing The client-server architecture is set up to capture the flow statistics for browsing network traffic class. One of the hosts in the topology is configured as a ‘SimpleHTTPServer‘. The client request’s the HTTPServer for file transfer. 5.1.2. E-mail The network traces for Simple Mail Transfer Protocol are created using the ‘telnet’ command. The connectivity is established between the virtual network platform and the real-time network for capturing the ‘SMTP’ network traces. In [19], the process of connecting virtual and real network in the SDN platform is described. 5.1.3. Streaming The streaming network data between the server and the client are captured using the ‘vlc-wrapper’ class. The audio and video files are live-streamed using the Real-Time Protocol (RTP). Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759 – 2757 Performance of Network Traffic classification for different machine learning models Values in % 100 Accuracy 50 Training Error 0 SVM Fig 2. Application classification in SDN platform. Naïve Nearest Bayes Centroid Fig 3 Performance analysis of different learning models. 5.2. Data pre-processing The data pre-processing is carried out by converting the captured file into ‘.csv’ file. The ‘netmate’ package is used to obtain the flow statistics. The captured ‘.pcap’ file is converted into a comma-separated file containing the flow details using ‘netmate’. The labelling of the training data set is performed to enable the system to learn the relation between the input flow instance and the output network traffic class. The different traffic classes created are for browsing, email and streaming. 5.3. Model construction and validation The selection of the model, training and parameter tuning are performed in model construction. The three models selected are Naive Bayes, SVM and nearest centroid algorithm. The scikit-learn tool is used for applying different machine learning models. 6. Result Analysis Fig 2 shows the classification of the various applications based on the number of flow instances collected for five and ten minutes respectively. Fig 3 represents the accuracy and training error of the three different supervised machine learning models for data traffic classification in the SDN platform. The accuracy obtained for SVM is 92.3%, Naïve Bayes is 96.79% and the nearest centroid is 91.02%. The challenges faced are in the live network data traffic capture and classification of the applications in the SDN platform. The training error in SVM is least, 2% error in Naïve Bayes and 7% error in the nearest centroid learning model. In fig 4, the comparison of the supervised learning models is represented with the number of flow instances (n) equal to 150 and 999. The graph analysis depicts that the precision and recall are lower when the number of flow instances is 150. Fig 5 depicts the training and testing time for network traffic classification with SVM taking 32 msecs for training, Naïve Bayes and Nearest Centroid training time obtained is 2 msecs. Fig 4. Performance comparison of the supervised learning models with flow instances (n = 150,999). 2758 Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759 – Time in milliseconds In all the three cases, the testing time taken is 1msecs. In fig 6, the performance comparison of the different 40 Training and testing time for network traffic classification 32 30 Performace Comparision of different supervised learning models 1 0.8 20 SVM 0.6 10 1 2 1 2 1 Gaussian NB 0.4 Nearest Centroid 0 SVM Naïve Bayes Nearest Centroid 0.2 0 Fig 5. Training and testing time for network traffic classification. Precision Recall F-score Accuracy Fig 6. Performance comparison of the supervised learning models. supervised learning models is represented. The precision, recall, f-score and accuracy obtained for the SVM model, is 99.7%. 7. Conclusion The data traffic classification using supervised learning model is proposed in the SDN environment. The three different models used are SVM, nearest centroid and Naïve Bayes. The traditional approaches of traffic classification have a limitation due to 1000 fold increase in the network data traffic. The accuracy of traffic classification is greater than 90% in all the three supervised learning models. The traffic classification framework proposed can be further extended by combining with network slicing mechanism for optimal utilization of the network resources. The Deep learning models can be integrated with the proposed framework for resource/service allocation in the next-generation networks. Acknowledgements The authors extend the acknowledgment to the students, Kavana Bhatkal and Madhura Shanbhag. Appendix A. An example appendix The network simulator ‘mininet’ is used to create the topology. The POX controller is run using the command ‘./pox.py forwarding.py’. The network topology is created using the command ‘sudo mn --topo=single,3 -controller=remote’. The network traffic is captured using the command ‘sudo tcpdump -i eth0 -c 10 -w 1.pcap’. Here ‘1.pcap’ is the packet capture file name. The host h2 with source IP ‘10.0.0.2’ is configured as the web server using the command ‘h2 python -m SimpleHTTPServer 80 >& /tmp/http.log &’ and the host ‘h1’ is the client. The client makes a request to the webserver using the command ‘h1 wget -O – h2’. This generates the ‘HTTP’ traffic. The email traffic is generated by the command ‘telnet 74.125.24.27 25’.The streaming traffic is generated using the ‘vlc-wrapper’ class. In [19] the ‘MQTT’ traffic is generated using SDN and Internet of Things (IoT) architecture. A.1. Example of training and testing dataset Table 2 and 3 represent the sample columns of the training and testing dataset captured. In the training dataset, the ‘label’ column is added, with labels given as ‘1’ for ‘HTTP’ traffic, ‘2’ for ‘email’ traffic and ‘3’ for ‘streaming’ type of traffic. The training dataset contains 45 attributes, out of which the first eight attributes are shown in table 2. Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759 – Table 2. First eight columns of the training dataset with the label added in the last column. Sl.No srcip srcport dstip dstport proto total_fpackets total_fvolume 1 10.0.0.1 55628 10.0.0.2 80 6 6 426 2 192.168.229.139 38992 74.125.24.27 25 6 13 605 10.0.0.1 49690 10.0.0.2 5004 17 81 109836 3 total_bpackets 6 12 0 2759 label 1 2 3 Table 3 First eight columns of the Testing dataset. Sl.No 1 2 3 srcip 10.0.0.1 192.168.229.139 10.0.0.2 srcport 55628 38981 36473 dstip 10.0.0.2 74.125.24.27 10.0.0.3 dstport 80 25 5004 proto 6 6 17 total_fpackets 6 13 92 total_fvolume 426 571 124752 total_bpackets 6 12 0 References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] Joseph Nathanael Witanto and Hyotaek Lim. 2019. Software-Defined Networking Application with Deep Deterministic Policy Gradient (ICCMS 2019). ACM, New York, NY, USA, 176-179. DOI: https://doi.org/10.1145/3307363.3307404 P. Wang, S. Lin and M. Luo, "A Framework for QoS-aware Traffic Classification Using Semi-supervised Machine Learning in SDNs," 2016 IEEE International Conference on Services Computing (SCC), San Francisco, CA, 2016, pp. 760-765. F. Restuccia, S. D’Oro and T. Melodia, "Securing the Internet of Things in the Age of Machine Learning and Software-Defined Networking," in IEEE Internet of Things Journal, vol. 5, no. 6, pp. 4829-4842, Dec. 2018. Ng, B., M. Hayes, and W. K. G. Seah. "Developing a traffic classification platform for enterprise networks with SDN:Experiences &lessons learned." IFIP NETWORKING Conference IEEE, 2015. Jamuna, A., and Vinoth Ewards. "Survey of Traffic Classification using Machine Learning." International journal of advanced research in computer science 4.4 (2013). Yan, Jinghua, and Jing Yuan. "A Survey of Traffic Classification in Software Defined Networks." 2018 1st IEEE International Conference on Hot Information-Centric Networking (HotICN). IEEE, 2018. Peng Xiao, Na Liu, Yuanyuan Li, Ying Lu, Xiao-jun Tang, Hai-wen Wang, Ming-xia Li. “A Traffic Classification Method with Spectral Clustering in SDN”, International Conference on Parallel and Distributed Computing, Applications and Technologies(PDCAT).2016. pp. 391~394. Pedro Amaral, Joao Dinis,Paulo Pinto, et al.,”Machine Learning in Software Defined Networks: Data Collection and Traffic Classification ” , IEEE 24th International Conference on Network Protocols (ICNP) Workshop on Machine Learning in Computer Networks (NetworkML 2016).pp.1-5. Y. Li and J. Li, “MultiClassifier: A combination of DPI and ML for application-layer classification in SDN”, in 2nd Int. Conf. On Systems and Informatics (ICSAI), 2014, pp. 682-686. Zafar Ayyub Qazi, Jeongkeun Lee, Tao Jin, Gowtham Bellala, Manfred Arndt, and Guevara Noubir. 2013. Application-awareness in SDN. SIGCOMM Comput. Commun. Rev. 43, 4 (August 2013), 487-488. DOI: https://doi.org/10.1145/2534169.2491700. Luigi Vigneri, Model-Driven Artificial Intelligence for Online Network Optimization, arXiv: 1805.12090v1 [cs.AI] 30 May 2018. A. Sabbeh, Y. Al-Dunainawi, H. S. Al-Raweshidy and M. F. Abbod, "Performance prediction of software defined network using an artificial neural network," 2016 SAI Computing Conference (SAI), London, 2016, pp. 80-84. doi: 10.1109/SAI.2016.7555965. P. Amaral, J. Dinis, P. Pinto, L. Bernardo, J. Tavares and H. S. Mamede, "Machine Learning in Software Defined Networks: Data collection and traffic classification," 2016 IEEE 24th International Conference on Network Protocols (ICNP), Singapore, 2016, pp. 1-5, Mulla, M. M., Raikar, M. M., Meghana, M. K., Shetti, N. S., & Madhu, R. K. (2019). “Load Balancing for Software-Defined Networks”. In Emerging Research in Electronics, Computer Science and Technology (pp. 235-244). Springer, Singapore. Yu, Changhe, et al. "QoS-aware Traffic Classification Architecture Using Machine Learning and Deep Packet Inspection in SDNs." Procedia computer science 131 (2018): 1209-1216. J. Xie et al., "A Survey of Machine Learning Techniques Applied to Software Defined Networking (SDN): Research Issues and Challenges," in IEEE Communications Surveys & Tutorials, vol. 21, no. 1, pp. 393-430, Firstquarter 2019. M. Wang, Y. Cui, X. Wang, S. Xiao and J. Jiang, "Machine Learning for Networking: Workflow, Advances and Opportunities," in IEEE Network, vol. 32, no. 2, pp. 92-99, March-April 2018. C. Zhang, P. Patras and H. Haddadi, "Deep Learning in Mobile and Wireless Networking: A Survey," in IEEE Communications Surveys & Tutorials, vol. 21, no. 3, pp. 2224-2287, thirdquarter 2019. Raikar, Meenaxi M and Meena S. M. "Software defined Internet of Things using light weight protocol", 2019 3rd International Conference on Computing and Network Communications (CoCoNet'19). Raikar, Meenaxi M,Chaitra Kuchanur, Shantala Girraddi, “Classification and Grading of Okra (ladies finger) using Deep Learning”, 2019 3rd International Conference on Computing and Network Communications (CoCoNet'19).\ Z. Xiong, Y. Zhang, D. Niyato, R. Deng, P. Wang and L. Wang, "Deep Reinforcement Learning for Mobile 5G and Beyond: Fundamentals, Applications, and Challenges," in IEEE Vehicular Technology Magazine, vol. 14, no. 2, pp. 44-52, June 2019.