ScienceDirect
ScienceDirect
Available online at www.sciencedirect.com
ScienceDirect
Procedia Computer Science 171 (2020) 2750–2759
Third International Conference on Computing and Network Communications (CoCoNet’19)
Data Traffic Classification in Software Defined Networks (SDN)
using supervised-learning
Meenaxi M Raikara, Meena S Mb, Mohammed Moin Mullac, Nagashree S Shettid,
Meghana Karanandie
a,b,c,d,e
.
K L.E. Technological University, Vidyanagar, Hubballi, 580031, India
Abstract
Traffic classification with accuracy is of prime importance in network activities such as security monitoring, traffic
engineering, fault detection, accounting of network usage,
and for is
providing
differentiation
in due
Quality
of Service
fficbilling
Classification
significant
in recent days
to rapid
growth (QoS)
in the
ffic classification
havedue
failed
to provide
parameters of the various network services. Network Traffic Classification is significant
in recent days
to rapid
growthreliable
in the
number of internet consumers. The different primitive techniques of network traffic classification have failed to provide reliable
accuracy because of 1000 fold scaling in the amount of devices as well as flows. To overcome this drawback, the integration of
Software Defined Network (SDN) architecture and machine learning technology is proposed in this paper. Three different
supervised learning models, namely Support Vector Machine (SVM), nearest centroid and Naïve Bayesffi(NB), are applied to
classify
the data traffic based on the applications
a software-defined
and
flows
sent tointhe
classifier for prednetwork platform. The network traffic traces are captured
and flows features are generated, which is sent to the classifier for prediction. The accuracy obtained for SVM is 92.3%, NB is
96.79% and the nearest centroid is 91.02%. The challenges faced are in the live network data traffic capture and classification of
the applications in the SDN platform.
© 2020 The Authors. Published by Elsevier B.V.
This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/)
Peer-review under responsibility of the scientific committee of the Third International Conference on Computing and Network
Communications (CoCoNet’19).
Keywords:supervised learning, protocol, packet length, flow statistics
1. Introduction
The network traffic analysis data provides useful information to the network administrator for decision making
and optimal resource allocation. With the convergence of networking technologies such as cloud computing, IoT
data growth is enormous. The challenge is to manage the resources for the increasing demand. The expectations of
1877-0509 © 2020 The Authors. Published by Elsevier B.V.
This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/)
Peer-review under responsibility of the scientific committee of the Third International Conference on Computing and Network
Communications (CoCoNet’19).
10.1016/j.procs.2020.04.299
Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759
–
2751
the users in the current scenario are rapid service delivery, scalability, Quality of Experience (QoE), and customized
service level agreements (SLAs). The service provider’s objective is to maximize profit by deploying resources,
different mechanisms to meet the QoE as well as SLAs and minimize the operational cost. In the traditional system
for network traffic, classification complexity lies in the code, whereas in machine learning, complexity lies in the
network traces collected and the learning algorithm applied.
The most important component of the machine learning algorithms is learning ability incurred. This ability is
gained through experience and refinement process. The statistical properties of the network trace for instance,
duration, packet length and packet inter-arrival time, are unique for the different network traffic classes. The
machine learns this uniqueness in the network pattern with the aid of the training data set provided. The machine
learning algorithm is employed to determine the pattern in the network data captured. Identification of diverse
applications such as video streaming, file transfer, email and browsing is a challenge. An influential network
management tool to handle the exponential network traffic growth is required for optimal utilization of the network
resources.
Intelligence needs to be embedded in networking devices for ease in organization, optimization, maintenance and
management. The distributed nature of the networking system makes it hard to include machine learning for control
of devices. The SDN platform provides an opportunity to include intelligence into the networking devices. The
heterogeneous nature of devices accessing the network poses the challenge of organization, optimization,
maintenance and management of the network resources. Embedding intelligence into the network devices is one
solution. The infrastructural development such as GPU and frameworks for data processing such as Spark, Hadoop
along with machine learning libraries such as scikit-learn, TensorFlow have introduced an opportunity for adding
intelligence into networking devices.
In the traditional networking system, the network devices are managed using command-line interface (CLI) and
scripts. Advancement to this is SDN with semi-automation for network management. The recent version is
intelligence-driven (Defined) networks, which is fully automated management of networks. In machine learning, the
traffic and application patterns are learnt and refined to control the network for minimization of cost and maximizing
throughput.
2. Related work
The different traffic classification techniques are based on port numbers and deep packet inspection (DPI).
The dynamic ports are used in the development of applications, where the port-based classification cannot be
applied. In the case of DPI, identification of a pattern for the application is performed. The regular expressions are
used for pattern recognition. With the abrupt growth in applications, pattern-based classification has a severe
limitation of updating the pattern for a large number of applications. The encrypted traffic cannot be classified using
the DPI mechanism.
The traffic classification architecture for enterprise networks includes the four classifier modules, namely
the static, identity, payload and statistical. Functional evaluation and performance analysis is measured through the
response time of devices [4]. A survey is presented in [5], incorporating the supervised learning techniques (decision
tree, Naive Bayes, SVM) and unsupervised learning models (K-means, DBSCAN, Auto class). In [6], the
architecture is proposed for traffic classification in the SDN environment. The clustering mechanism is used to
classify the traffic in [7]. The traffic classification is performed considering the enterprise network created using the
SDN technology [8]. In [9] campus network scenario is setup in the SDN platform for traffic classification.
The classification of different applications based on the machine learning technique is described in [10]. To
collect the ground truth data, the crowdsourcing mechanism is employed. The policy management is controlled in
the centralized SDN platform. The network management considering joint optimization for resource utilization is
proposed in [11]. The AI-based techniques are presented for handling the spatio-temporal traffic variations in the
network. The integration of Artificial Intelligence (AI) and SDN to predict controller performance is described in
[12]. The parameters used are round trip time, throughput and the flow table content. The mean square error
between the actual and predict SDN performance is depicted in the form of a graph. The machine learning and
Software Defined Network architecture is used to classify the traffic of the enterprise network. The observations are
2752
Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759
–
supervised learning gives higher accuracy [13]. The K-Nearest Neighbors (K-NN), decision tree classification and
Random Forest Classification are the classification algorithms used in spam filtering to avoid cybersecurity attacks.
The combination of SDN and artificial intelligence-based traffic classification for dynamic allocation of
bandwidth, policy management, spatio-temporal traffic variations determination are the different techniques applied
for network resource optimization.
3. Machine learning in networking domain
Machine Learning (ML) algorithms are applied for intrusion detection, optimized spectrum utilization, obtaining
power efficiency and network traffic management. Data is of prime importance in machine learning for making
decisions instead of from pre-defined conditions presented in the algorithm. Three categories of ML algorithms are
supervised, unsupervised and reinforcement learning. In supervised learning, labeled data is used for
classification/regression. Classification of unlabeled data into different classes is the focus of unsupervised learning.
The agent interacts with the environment and learns the action that maximizes the reward in reinforcement learning.
The semi-supervised learning algorithm is applied for traffic classification based on the QoS parameter requirements
of the users in [2].
3.1. Machine learning for route optimization
The controller routes the traffic in the SDN platform by modification of the flow tables. The controller can make
decisions of forwarding, dropping or blocking by looking into the flow table rules. The machine learning algorithms
are employed at the controller for obtaining an optimized routing path.
3.2. Security
In [1], the survey regarding traffic profiling, device identification and security mechanism for IoT devices are
described using machine learning algorithms. The challenges of providing security in the IoT networks are described
in [3].
3.3. Supervised learning
The supervised learning algorithm constructs a knowledge base for decision making in the classification of the
new flow instances from the prior known classes. In supervised learning, the relation between the input and output is
modelled. The two phases in supervised learning are the training and testing phase.
Training: The construction of the classification model is performed by examining the training data set in the
learning phase, i.e., the training process. The real-time data in the form of ‘pcap’ files are captured using the
‘tcpdump’ networking tool. The labels are added to the real-time network traces and used for training.
Testing: The classification of the new instance is performed by using the model created during the training phase.
The supervised learning algorithm is applied to determine the mapping for active network traffic into output network
traffic class. The first challenge involved in network traffic classification is obtaining a labelled data set. One
solution is to use some portion of the data as a training set (e.g., 80% for training) and the remaining as a testing set
(e.g. 20% for testing). The second challenge is that of newly generated network traffic may not be part of the known
traffic classes. The third challenge is to classify during the online mode, i.e., real-time traffic classification. The flow
instance data used to train the ML algorithm are as follows:
1. Source and destination IP and port number
2. Protocol information and header length
3. The total number of packets in the forward and backward direction, packet size, inter-arrival time and
duration.
4. Status for active and idle, PUSH and URG count.
Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759
–
2753
3.4. Reinforcement learning
The entities involved in reinforcement learning are agents, different states (S) and action (A). The agent learns
the best action by interacting with the environment for maximizing the reward. In the SDN platform, the controller
acts as an agent. The monitoring of the network status is performed by the controller for making decisions in
forwarding the data.
4. Proposed model
In the proposed system model, the integration of SDN and machine learning algorithm for network traffic
classification is described. The model construction for classification is performed using a supervised learning
algorithm.
4.1. Problem formulation
The constraints on bandwidth, delay, user experience and security have increased with an increase in the number
of devices connecting to the internet. To easy the network administration operations, classification of traffic using
machine learning is proposed. The system framework is represented in fig 1 for traffic classification using machine
learning models in software-defined networking technology. The three sections of the proposed model are real-time
network, virtual network and machine intelligence section. The hybrid network is formed by connecting the real world network to the virtual network for email and file transfer applications. In the virtual network, different
topologies for wired and wireless networks are created. The machine intelligence section of the proposed model is
employed for traffic classification.
The traffic classification problem is formulated as described. Let M = {M1, M2,…,Mn} be the flow collected. One
instance Mi includes k attributes. Mij is used for referring the jth attribute in the ith instance of the flow. In the context
of network traffic classification, the attributes are inter-arrival time, duration, transferred number of bytes and
packets. Let C = {C1,C2,…,Cq}, be the different classes for the network traffic classification problem. The sample Ci
classes are ‘streaming’, ‘browsing’ and ‘email’ applications. The objective is to develop an algorithm for mapping
n-dimension value M to C using machine learning techniques defined by function f(M) → C. The training data set is
captured offline in the network during data transmission. The mapping f(M) → C is learnt by applying the
classification algorithm on the training data set containing L tuples in the form (Mi, Ci). In table 2, the classes C1,C2
Fig 1. Framework for network traffic classification in software defined networks
2754
Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759
–
C3 are represented with labels ‘1’,’2’ and ‘3’. In table 2 and 3, each row represents the flow instances M1, M2 and M3.
The three supervised learning algorithms, namely Naïve Bayes, Support Vector Machine and nearest
centroid algorithm, are applied to the training and testing data set for network traffic classification and compared for
the accuracy, prediction, recall and f-score.
The POX controller is used for remote monitoring and topology management. The network topology is created
using the ‘mininet’ tool. The real-time (ongoing) traffic is captured through ‘tcpdump’ in the form of ‘pcap’ files.
The flow features are generated using the ‘netmate’ flow generator. The labels are attached to this captured data.
The prediction is performed using different machine learning algorithms.
4.1.1. Naïve Bayes
The network traffic classification is obtained by applying Bayes theorem, assuming independence in predictors.
P ( m | c ) P (c )
P(m)
(1)
P(c | M) = P(m1|c)*P(m2|c)* …*P(mn|c)
(2)
P(c | m)
where c is the network traffic class, M is a flow instance, P(c|m), P(m|c), P(c) and P(m) is posterior probability for
network class c, likelihood probability, prior probability of class and predictor respectively.
Algorithm1: Network traffic classification using the Naïve Bayes algorithm
Inputs:
M – Real-time flow instances
Output: Network traffic class of the application.
Steps:
1. The frequency table is obtained for the network training data set.
2. The likelihood table is created by determining the probabilities.
3. Using (1), for each class, the posterior probability is calculated.
4. The network traffic class c is predicted by choosing the highest posterior probability.
4.1.2. Support Vector Machine (SVM)
In SVM, a hyperplane is used to separate the classes. The objective is to find optimal hyperplane, which separates
the network traffic classes.
Algorithm2: Network traffic classification using SVM
Assumptions: The network data set is linearly separable.
Inputs:
M – Real-time flow instances
Output: Network traffic class of the application.
Steps:
1. The input flow instances is represented as:
2.
3.
Two hyperplanes H1 and H2 are selected, such that no data points lie in between them.
Determine margin ‘m’ to maximizes the distance between hyperplane H1 and H2
m
2
w
Instead of maximizing margin m, the hyperplane with minimum
w is chosen, where w is weight vector. The
network traffic classification task is represented as an optimization problem as given in (3) where b is the offset. The
lowercase ‘m’ is used to describe margin and capital ‘M’ is used to represent one flow instance.
min w
subject to
T
C (w M
i
i
b) 1
for i 1,..., n
(3)
Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759
–
2755
4.1.3. Nearest centroid algorithm
The centroid is computed for each network traffic class. The measure of Euclidean distance between the data point
and the centroid for each network class is obtained. The estimated network traffic class is obtained by choosing the
class with minimum distance.
Algorithm3: Network traffic classification using Nearest centroid algorithm
Inputs:
M – Real-time flow instances
Output: Network traffic class of the application.
Steps:
1. The input flow instances is represented as:
{(M1,C1), (M2,C2),….(Mn,Cn)} with the labels Ci C
2. The centroid is computed for each class using the equation
3.
The predicted network traffic class is given by equation
5. Implementation
The Software Defined Network (SDN) architecture is used for classifying the network traffic generated by
the client devices. The separation of the data plane and control plane is present in SDN. The OpenFlow protocol is
used as the southbound interface for communication between the devices and the controller. The northbound
interface is used for communication between network applications and the controller. The network dynamics in the
topology are gathered and sent to the controller for decision making and management of the network devices. The
adaptive control mechanism, along with data analytics, is proposed for providing appropriate control commands and
handle network dynamics. The feedback mechanism provides the updates in the network topology like link failures
or topology changes in the form of the network state information. The derived information is used for decision
making and remote control of the devices in the network topology. Fig 1 depicts the different layers in the dynamic
control mechanism of the system. The data acquisition layer enables the collection of the network topology
information. The feature extraction layer consists of training models and AI algorithms for network traffic
classification. The extracted information about traffic classification is made available to the controller for decision
making. The decision and control layer receives the network state for decision making and control of the devices.
Topology: The single switch with ‘n’ host topology, linear topology with the same number of switches as the host
and the tree topology are the different topologies created for wired network scenarios. The custom topology can be
created based on the user requirements.
Controller: The controller is the central unit of the system. The SDN controller enables the dynamic management of
the network resources. The monitoring of the devices is possible because the controller obtains the globalized
network view. The POX controller is used for data forwarding within the devices. The OpenFlow protocol is used
for flow rules manipulation. The communication between the networking devices in the topology and the controller
is carried out using the southbound interface. The northbound interface enables communication with the application
plane. The East/Westbound interface is used in ease of communication between multiple controllers.
The workflow for the network traffic classification includes data collection, pre-processing, labelling,
model construction, validation and prediction. In [14], the load balancing is performed for optimized network
resource utilization in the SDN platform. In [15], the QoS parameters are considered for traffic classification in the
SDN environment. The application of machine learning concepts in SDN for route optimization, QoE prediction,
resource management, security, traffic classification are described in [16].
In table 1, the comparison of the three supervised learning models is represented in terms of the confusion
matrix. The three classes taken for classification are HTTP, mail and streaming. The confusion matrix is represented
for the number of flow instances as 150 and 999.
2756
Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759
–
Table 1 Comparison of the three supervised learning models.
Sl.
No
Supervised
learning
model
1
SVM
2
3
GaussianNB
Nearest
centroid
Confusion Matrix (N = 150)
Actual/Predicted
HTTP
HTTP
Mail
Confusion Matrix (N=999)
Mail
Streaming
Actual/Predicted
HTTP
Mail
Streaming
50
0
0
HTTP
0
47
3
Mail
511
0
0
0
47
3
Streaming
0
0
50
Streaming
0
0
438
Actual/Predicted
HTTP
Mail
Streaming
Actual/Predicted
HTTP
Mail
Streaming
HTTP
50
Mail
0
0
0
HTTP
510
1
0
37
2
Mail
0
37
13
Streaming
22
2
26
Streaming
0
0
435
Actual/Predicted
HTTP
HTTP
Mail
Streaming
Actual/Predicted
HTTP
Mail
Streaming
50
0
0
HTTP
510
0
1
Mail
34
10
6
Mail
19
10
21
Streaming
22
3
25
Streaming
172
3
263
In [17], the workflow for applying machine learning in the networking domain is described. A survey of using
Deep Learning for user localization, network control, routing, scheduling, resource allocation, network optimization,
radio control and security is presented in [18]. The Deep reinforcement learning for service and resource allocation,
network slicing, edge caching is described in [21]. In [20] deep learning is applied for grading of lady’s finger.
5.1. Data collection
The network trace data is collected for varying applications. The traffic classification can either be
performed online or in offline mode. The collection of the network data online enables us to obtain feedback for
maximizing the network resource utilization. In the proposed model, offline traffic classification is performed. The
‘tcpdump’ a packet analyzer utility, is used for collecting the network data. The output traces are redirected and
stored in a ‘.pcap’ file format.
5.1.1. Browsing
The client-server architecture is set up to capture the flow statistics for browsing network traffic class. One of the
hosts in the topology is configured as a ‘SimpleHTTPServer‘. The client request’s the HTTPServer for file transfer.
5.1.2. E-mail
The network traces for Simple Mail Transfer Protocol are created using the ‘telnet’ command. The
connectivity is established between the virtual network platform and the real-time network for capturing the ‘SMTP’
network traces. In [19], the process of connecting virtual and real network in the SDN platform is described.
5.1.3. Streaming
The streaming network data between the server and the client are captured using the ‘vlc-wrapper’ class. The
audio and video files are live-streamed using the Real-Time Protocol (RTP).
Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759
–
2757
Performance of Network Traffic classification
for different machine learning models
Values in %
100
Accuracy
50
Training Error
0
SVM
Fig 2. Application classification in SDN platform.
Naïve Nearest
Bayes Centroid
Fig 3 Performance analysis of different learning models.
5.2. Data pre-processing
The data pre-processing is carried out by converting the captured file into ‘.csv’ file. The ‘netmate’ package is
used to obtain the flow statistics. The captured ‘.pcap’ file is converted into a comma-separated file containing the
flow details using ‘netmate’. The labelling of the training data set is performed to enable the system to learn the
relation between the input flow instance and the output network traffic class. The different traffic classes created are
for browsing, email and streaming.
5.3. Model construction and validation
The selection of the model, training and parameter tuning are performed in model construction. The three
models selected are Naive Bayes, SVM and nearest centroid algorithm. The scikit-learn tool is used for applying
different machine learning models.
6. Result Analysis
Fig 2 shows the classification of the various applications based on the number of flow instances collected for five
and ten minutes respectively. Fig 3 represents the accuracy and training error of the three different supervised
machine learning models for data traffic classification in the SDN platform. The accuracy obtained for SVM is
92.3%, Naïve Bayes is 96.79% and the nearest centroid is 91.02%. The challenges faced are in the live network data
traffic capture and classification of the applications in the SDN platform. The training error in SVM is least, 2%
error in Naïve Bayes and 7% error in the nearest centroid learning model. In fig 4, the comparison of the supervised
learning models is represented with the number of flow instances (n) equal to 150 and 999. The graph analysis
depicts that the precision and recall are lower when the number of flow instances is 150.
Fig 5 depicts the training and testing time for network traffic classification with SVM taking 32 msecs for
training, Naïve Bayes and Nearest Centroid training time obtained is 2 msecs.
Fig 4. Performance comparison of the supervised learning models with flow instances (n = 150,999).
2758
Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759
–
Time in milliseconds
In all the three cases, the testing time taken is 1msecs. In fig 6, the performance comparison of the different
40
Training and testing time for network
traffic classification
32
30
Performace Comparision of different supervised
learning models
1
0.8
20
SVM
0.6
10
1
2
1
2
1
Gaussian NB
0.4
Nearest Centroid
0
SVM
Naïve Bayes
Nearest
Centroid
0.2
0
Fig 5. Training and testing time for network traffic
classification.
Precision
Recall
F-score
Accuracy
Fig 6. Performance comparison of the supervised learning models.
supervised learning models is represented. The precision, recall, f-score and accuracy obtained for the SVM model,
is 99.7%.
7. Conclusion
The data traffic classification using supervised learning model is proposed in the SDN environment. The three
different models used are SVM, nearest centroid and Naïve Bayes. The traditional approaches of traffic
classification have a limitation due to 1000 fold increase in the network data traffic. The accuracy of traffic
classification is greater than 90% in all the three supervised learning models. The traffic classification framework
proposed can be further extended by combining with network slicing mechanism for optimal utilization of the
network resources. The Deep learning models can be integrated with the proposed framework for resource/service
allocation in the next-generation networks.
Acknowledgements
The authors extend the acknowledgment to the students, Kavana Bhatkal and Madhura Shanbhag.
Appendix A. An example appendix
The network simulator ‘mininet’ is used to create the topology. The POX controller is run using the command
‘./pox.py forwarding.py’. The network topology is created using the command ‘sudo mn --topo=single,3 -controller=remote’. The network traffic is captured using the command ‘sudo tcpdump -i eth0 -c 10 -w 1.pcap’.
Here ‘1.pcap’ is the packet capture file name. The host h2 with source IP ‘10.0.0.2’ is configured as the web server
using the command ‘h2 python -m SimpleHTTPServer 80 >& /tmp/http.log &’ and the host ‘h1’ is the client. The
client makes a request to the webserver using the command ‘h1 wget -O – h2’. This generates the ‘HTTP’ traffic.
The email traffic is generated by the command ‘telnet 74.125.24.27 25’.The streaming traffic is generated using the
‘vlc-wrapper’ class. In [19] the ‘MQTT’ traffic is generated using SDN and Internet of Things (IoT) architecture.
A.1. Example of training and testing dataset
Table 2 and 3 represent the sample columns of the training and testing dataset captured. In the training dataset,
the ‘label’ column is added, with labels given as ‘1’ for ‘HTTP’ traffic, ‘2’ for ‘email’ traffic and ‘3’ for ‘streaming’
type of traffic. The training dataset contains 45 attributes, out of which the first eight attributes are shown in table 2.
Meenaxi M Raikar et al. / Procedia Computer Science 171 (2020) 2750–2759
–
Table 2. First eight columns of the training dataset with the label added in the last column.
Sl.No
srcip
srcport
dstip
dstport proto total_fpackets total_fvolume
1
10.0.0.1
55628
10.0.0.2
80
6
6
426
2
192.168.229.139
38992 74.125.24.27
25
6
13
605
10.0.0.1
49690
10.0.0.2
5004
17
81
109836
3
total_bpackets
6
12
0
2759
label
1
2
3
Table 3 First eight columns of the Testing dataset.
Sl.No
1
2
3
srcip
10.0.0.1
192.168.229.139
10.0.0.2
srcport
55628
38981
36473
dstip
10.0.0.2
74.125.24.27
10.0.0.3
dstport
80
25
5004
proto
6
6
17
total_fpackets
6
13
92
total_fvolume
426
571
124752
total_bpackets
6
12
0
References
[1]
[2]
[3]
[4]
[5]
[6]
[7]
[8]
[9]
[10]
[11]
[12]
[13]
[14]
[15]
[16]
[17]
[18]
[19]
[20]
[21]
Joseph Nathanael Witanto and Hyotaek Lim. 2019. Software-Defined Networking Application with Deep Deterministic Policy Gradient
(ICCMS 2019). ACM, New York, NY, USA, 176-179. DOI: https://doi.org/10.1145/3307363.3307404
P. Wang, S. Lin and M. Luo, "A Framework for QoS-aware Traffic Classification Using Semi-supervised Machine Learning in
SDNs," 2016 IEEE International Conference on Services Computing (SCC), San Francisco, CA, 2016, pp. 760-765.
F. Restuccia, S. D’Oro and T. Melodia, "Securing the Internet of Things in the Age of Machine Learning and Software-Defined
Networking," in IEEE Internet of Things Journal, vol. 5, no. 6, pp. 4829-4842, Dec. 2018.
Ng, B., M. Hayes, and W. K. G. Seah. "Developing a traffic classification platform for enterprise networks with SDN:Experiences &lessons
learned." IFIP NETWORKING Conference IEEE, 2015.
Jamuna, A., and Vinoth Ewards. "Survey of Traffic Classification using Machine Learning." International journal of advanced research in
computer science 4.4 (2013).
Yan, Jinghua, and Jing Yuan. "A Survey of Traffic Classification in Software Defined Networks." 2018 1st IEEE International Conference
on Hot Information-Centric Networking (HotICN). IEEE, 2018.
Peng Xiao, Na Liu, Yuanyuan Li, Ying Lu, Xiao-jun Tang, Hai-wen Wang, Ming-xia Li. “A Traffic Classification Method with Spectral
Clustering in SDN”, International Conference on Parallel and Distributed Computing, Applications and Technologies(PDCAT).2016. pp.
391~394.
Pedro Amaral, Joao Dinis,Paulo Pinto, et al.,”Machine Learning in Software Defined Networks: Data Collection and Traffic Classification
” , IEEE 24th International Conference on Network Protocols (ICNP) Workshop on Machine Learning in Computer Networks
(NetworkML 2016).pp.1-5.
Y. Li and J. Li, “MultiClassifier: A combination of DPI and ML for application-layer classification in SDN”, in 2nd Int. Conf. On
Systems and Informatics (ICSAI), 2014, pp. 682-686.
Zafar Ayyub Qazi, Jeongkeun Lee, Tao Jin, Gowtham Bellala, Manfred Arndt, and Guevara Noubir. 2013. Application-awareness in SDN.
SIGCOMM Comput. Commun. Rev. 43, 4 (August 2013), 487-488. DOI: https://doi.org/10.1145/2534169.2491700.
Luigi Vigneri, Model-Driven Artificial Intelligence for Online Network Optimization, arXiv: 1805.12090v1 [cs.AI] 30 May 2018.
A. Sabbeh, Y. Al-Dunainawi, H. S. Al-Raweshidy and M. F. Abbod, "Performance prediction of software defined network using an
artificial neural network," 2016 SAI Computing Conference (SAI), London, 2016, pp. 80-84. doi: 10.1109/SAI.2016.7555965.
P. Amaral, J. Dinis, P. Pinto, L. Bernardo, J. Tavares and H. S. Mamede, "Machine Learning in Software Defined Networks: Data
collection and traffic classification," 2016 IEEE 24th International Conference on Network Protocols (ICNP), Singapore, 2016, pp. 1-5,
Mulla, M. M., Raikar, M. M., Meghana, M. K., Shetti, N. S., & Madhu, R. K. (2019). “Load Balancing for Software-Defined Networks”. In
Emerging Research in Electronics, Computer Science and Technology (pp. 235-244). Springer, Singapore.
Yu, Changhe, et al. "QoS-aware Traffic Classification Architecture Using Machine Learning and Deep Packet Inspection in SDNs."
Procedia computer science 131 (2018): 1209-1216.
J. Xie et al., "A Survey of Machine Learning Techniques Applied to Software Defined Networking (SDN): Research Issues and
Challenges," in IEEE Communications Surveys & Tutorials, vol. 21, no. 1, pp. 393-430, Firstquarter 2019.
M. Wang, Y. Cui, X. Wang, S. Xiao and J. Jiang, "Machine Learning for Networking: Workflow, Advances and Opportunities," in IEEE
Network, vol. 32, no. 2, pp. 92-99, March-April 2018.
C. Zhang, P. Patras and H. Haddadi, "Deep Learning in Mobile and Wireless Networking: A Survey," in IEEE Communications Surveys &
Tutorials, vol. 21, no. 3, pp. 2224-2287, thirdquarter 2019.
Raikar, Meenaxi M and Meena S. M. "Software defined Internet of Things using light weight protocol", 2019 3rd International Conference
on Computing and Network Communications (CoCoNet'19).
Raikar, Meenaxi M,Chaitra Kuchanur, Shantala Girraddi, “Classification and Grading of Okra (ladies finger) using Deep Learning”, 2019
3rd International Conference on Computing and Network Communications (CoCoNet'19).\
Z. Xiong, Y. Zhang, D. Niyato, R. Deng, P. Wang and L. Wang, "Deep Reinforcement Learning for Mobile 5G and Beyond: Fundamentals,
Applications, and Challenges," in IEEE Vehicular Technology Magazine, vol. 14, no. 2, pp. 44-52, June 2019.