Machine Learning in Software Defined Networks: Data collection and traffic classification
Open accessAbstract
Software Defined Networks (SDNs) provides a separation between the control plane and the forwarding plane of networks. The software implementation of the control plane and the built in data collection mechanisms of the OpenFlow protocol promise to be excellent tools to implement Machine Learning (ML) network control applications. A first step in that direction is to understand the type of data that can be collected in SDNs and how information can be learned from that data. In this work we describe a simple architecture deployed in an enterprise network that gathers traffic data using the OpenFlow protocol. We present the data-sets that can be obtained and show how several ML techniques can be applied to it for traffic classification. The results indicate that high accuracy classification can be obtained with the data-sets using supervised learning.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Amaral et al.'s evaluation of RF, SGBoost and XGBoost exhibits high accuracy for some application classes such as Web Browsing, while poor performance for others such as LinkedIn.
“The results exhibit high accuracy for some application classes (e.g.Web Browsing), while poor performance for others (e.g.LinkedIn).”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [19]
Amaral et al. [19] harness SDN and OpenFlow to monitor and classify TCP enterprise network traffic.
“Amaral et al. [19] harness SDN and OF to monitor and classify TCP enterprise network traffic.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [19]
The poor performance of classifiers in Amaral et al.'s evaluation can be attributed to the fairly small training dataset used.
“However, this can be attributed to the fairly small training dataset used in their evaluation.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [19]
Cites
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538 · see citing works
Friedman, J. H. (2002) · Computational Statistics & Data Analysis · doi:10.1016/s0167-9473(01)00065-2 · Cited by 7,067 · see citing works
Supervised Machine Learning: A Review of Classification Techniques
Kotsiantis, S. B. (2007) · Informatica · Cited by 4,192 · see citing works
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Traffic classification using clustering algorithms
Erman, J., Arlitt, M. F., & Mahanti, A. (2006) · doi:10.1145/1162678.1162679 · Cited by 712 · see citing works
Williams, N., Zander, S., & Armitage, G. J. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1163593.1163596 · Cited by 698 · see citing works
Rahbar, A. G., & Yang, O. W. W. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080408 · Cited by 668 · see citing works
Algorithms to accelerate multiple regular expressions matching for deep packet inspection
Kumar, S., Dharmapurikar, S., Fang, Y., Crowley, P., & Turner, J. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159952 · Cited by 509 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
Offline/realtime traffic classification using semi-supervised learning
Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C. (2007) · Performance Evaluation · doi:10.1016/j.peva.2007.06.014 · Cited by 287 · see citing works
Smith, R., Estan, C., Jha, S., et al. (2008) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1402946.1402983 · Cited by 216 · see citing works
An improved algorithm to accelerate regular expression evaluation
Becchi, M., & Crowley, P. (2007) · doi:10.1145/1323548.1323573 · Cited by 211 · see citing works
Network Traffic Classification Using K-means Clustering
Liu, Y., Li, W., & Li, Y. (2007) · International Multi-Symposiums on Computer and Computational Sciences · doi:10.1109/imsccs.2007.52 · Cited by 159 · see citing works
A weighted k-nearest neighbor method for gene ontology based protein function prediction
Kharsikar, S., Mugler, D. H., Sheffer, D. B., et al. (2007) · International Multi-Symposiums on Computer and Computational Sciences · doi:10.1109/imsccs.2007.61 · Cited by 67 · see citing works
Intrusion Detection System using Self Organizing Maps
Pachghare, V., Kulkarni, P. A., & Nikam, D. M. (2009) · International Conference on Intelligent Agent & Multi-Agent Systems (IAMA) · doi:10.1109/iama.2009.5228074 · Cited by 50 · see citing works
Differential Encoding of DFAs for Fast Regular Expression Matching
Ficara, D., Pietro, A. D., Giordano, S., et al. (2010) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2010.2089639 · Cited by 38 · see citing works
Research on Intrusion Detection Based on an Improved SOM Neural Network
Dianbo, J., Yang, Y., & Xia, M. (2009) · International Conference on Information Assurance and Security (IAS) · doi:10.1109/ias.2009.247 · Cited by 22 · see citing works
Bakhshi, T., & Ghita, B. (2015) · Internet Technologies and Applications (ITA) · doi:10.1109/itecha.2015.7317376 · Cited by 21 · see citing works
Self Learning Network Traffic Classification
Vandana, M., & Manmadhan, S. (2015) · International Conference on Innovations in Information, Embedded and Communication Systems · doi:10.1109/iciiecs.2015.7193038 · Cited by 5 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Xie, J., Yu, F. R., Huang, T., Xie, R., Liu, J., Wang, C., & Liu, Y. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2866942 · Cited by 700 · see citing works
Intent-based networking for the enterprise: a modern network architecture
Falkner, M., & Apostolopoulos, J. (2022) · Communications of the ACM · doi:10.1145/3538513 · Cited by 14 · see citing works
- Authors
- Amaral, P., Dinis, J., Pinto, P., Bernardo, L., Tavares, J., & Mamede, H. S.
- Affiliations
- Universidade Nova de Lisboa (PT)
- Universidade Aberta (PT)
- Venue
- 2016 IEEE 24th International Conference on Network Protocols (ICNP)
- Publisher
- IEEE
- Published
- 2016-11
- Pages
- 1-5
- ISSN
- 1092-1648 (ISSN-L)
- OpenAlex
- W2564630785
- Cited by
- 172
- References
- 19
- Citations by year
- 2026: 4 · 2025: 7 · 2024: 15 · 2023: 19 · 2022: 36 · 2021: 24 · 2020: 33 · 2019: 18 · 2018: 11 · 2017: 5
- FWCI
- 9.69
- Type
- conference paper
- Language
- en
- Open access
- green
- hdl.handle.net
- Licence
- cc-by-sa
- Locations
- IEEE International Conference on Network Protocols (ICNP) (publishedVersion)
- Portuguese National Funding Agency for Science, Research and Technology (RCAAP Project by FCT) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- software-defined networking, OpenFlow, network traffic classification, network data collection, enterprise networks, network traffic datasets, supervised learning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
