Cited by 1,036Software-Defined Networks and 5GNetwork Security and Intrusion DetectionNetwork Traffic and Congestion Control

The DOI matches its Crossref record; 455 of the 455 references it cites were found in a registry or an index; 5 of the 623 sources its claims cite were checked for support.

A comprehensive survey on machine learning for networking: evolution, applications and research opportunities

Open access
Boutaba, Raouf, Salahuddin, Mohammad A., Limam, Noura, Ayoubi, Sara, Shahriar, Nashid, Estrada-Solano, Felipe, Caicedo, Oscar M.·2018·Journal of Internet Services and Applications

Abstract

Machine Learning (ML) has been enjoying an unprecedented surge in applications that solve problems and enable automation in diverse domains. Primarily, this is due to the explosion in the availability of data, significant improvements in ML techniques, and advancement in computing capabilities. Undoubtedly, ML has been applied to various mundane and complex problems arising in network operation and management. There are various surveys on ML for specific areas in networking or for specific network technologies. This survey is original, since it jointly presents the application of diverse ML techniques in various key areas of networking across different network technologies. In this way, readers will benefit from a comprehensive discussion on the different learning paradigms and ML techniques applied to fundamental problems in networking, including traffic prediction, routing and classification, congestion control, resource and fault management, QoS and QoE management, and network security. Furthermore, this survey delineates the limitations, give insights, research challenges and future opportunities to advance ML in networking. Therefore, this is a timely contribution of the implications of ML for networking, that is pushing the barriers of autonomic network operation and management.

Overview

AI snapshot

Written from a shortened version of the paper’s full text (it is longer than we read).

TL;DR

This survey synthesizes two decades of machine learning applications across networking, covering traffic prediction, classification, routing, congestion control, resource and fault management, QoS/QoE, and security. It argues that ML can advance autonomic network operation and management, while identifying limitations, research challenges, and future opportunities.

Key findings

  • The survey jointly covers ML techniques across multiple networking problems and network technologies, rather than focusing on one area or technology such as cellular, WSN, MANET, or CRN.
  • Reported representative results include payload-based AdaBoost traffic classification with overall precision of 99% and error rate within 0.5%; C4.5 DT for encrypted SSH traffic achieving 95.9% DR and 2.8% FPR on Dalhousie, 97.2% DR and 0.8% FPR on AMP, and 82.9% DR and 0.5% FPR on MAWI.
  • For encrypted HTTPS service classification, RF achieved precision 92.6%, recall 92.8%, and F-measure 92.6%, with service classification accuracy between 95–100% for most providers and overall system accuracy of 93.10% with less than 20% degradation over 23 weeks without retraining.
  • Reinforcement learning dominates traffic routing research; for example, Q-PR achieved over 98% successful delivery versus 75.66% for GPSR, reduced retransmission retries and acknowledgements by over 50% and 40% versus GPSR and EFE, and preserved WSN lifetime 3× and 4× more than GPSR and EFE, respectively.

Methods

  • This is a comprehensive literature survey, not a primary empirical study. It reviews peer-reviewed literature published over the past two decades, selected by a combination of publication year, citation count, and merit.
  • The paper organizes ML techniques by networking problem area: traffic prediction, traffic classification, traffic routing, congestion control, resource management, fault management, QoS/QoE management, and network security.
  • It summarizes surveyed works in tables covering ML technique, dataset, features, evaluation settings, and reported results, and discusses learning paradigms, data collection, feature engineering, ground truth, and performance metrics.

Limitations

  • The paper does not explicitly state its own limitations; it states limitations of surveyed works, including reliance on synthetic or simulated data, lack of common metrics/datasets for comparison, scarcity of fault data in production networks, and difficulty obtaining complete representations of normal behavior for anomaly detection.
  • Evident from the text: as a survey, it provides no new experiments or primary validation, and its selection criteria are not described as a systematic review protocol.
  • The paper also notes that some areas remain preliminary, such as SDN/NFV-based traffic classification, and that many ML-based congestion control and resource management solutions still need evaluation on real networks and real data.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1186/s13174-018-0087-2

Cites

455 of 455 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

442 Not checked yet · 122 Own interpretation · 105 No basis given · 11 Own result · 3 Own method · 2 Supported so far · 2 Partly supported · 1 Supported · accuracy not yet measured

Verify all 618 references — free account

Show all 288 claims

  • It may state two separate claims as one. 223
  • Probably not a substantial claim. 267
  • The quote only partly states this claim. 4
400 of 400
  • The paper relies on this without support.

    Machine learning has been extensively applied to problems in pattern recognition, speech synthesis, and outlier detection, but its successful deployment for network operations and management has been limited.

    “Though, ML has been extensively applied to problems in pattern recognition, speech synthesis, and outlier detection, its successful deployment for network operations and management has been limited.”
  • The paper relies on this without support.

    Each network is unique and there is a lack of enforcement of standards to attain uniformity across networks.

    “First, each network is unique and there is a lack of enforcement of standards to attain uniformity across networks.”
  • The paper relies on this without support.

    The main obstacles to successful deployment of machine learning for network operations and management include what data can be collected from and what control actions can be exercised on legacy network devices.

    “The main obstacles include what data can be collected from and what control actions can be exercised on legacy network devices.”
  • The paper relies on this without support.

    The ability to program the network by leveraging Software-Defined Networking alleviates the obstacles to deploying machine learning for network operations and management.

    “The ability to program the network by leveraging SDN alleviates these obstacles.”
  • The paper relies on this without support.

    The cognition from machine learning can be used to aid in the automation of network operation and management tasks.

    “The cognition from ML can be used to aid in the automation of network operation and management tasks.”
  • The authors state this as an assumption.

    Mice flows are routed through Equal-cost multi-path routing, while elephant flows are routed through the least congested path.

    “Presumably, mice flows are routed through Equal-cost multi-path routing, while elephant flows are routed through the least congested path.”
  • The authors state this as an assumption.

    For tractability, sessions are assumed to be finite and a protocol model is derived as a distribution on n byte flows rather than a pair of flows.

    “For tractability, the sessions are assumed to be finite and a protocol model is derived as a distribution on n byte flows, rather than pair of flows.”
  • The authors state this as an assumption.

    Applications with similar QoS requirements exhibit similar statistical properties.

    “They assume that applications with similar QoS requirements exhibit similar statistical properties.”
  • The paper relies on this without support.

    The performance of classifiers varies significantly based on the type of flow features used.

    “It is well-known that the performance of classifiers vary significantly based on the type of flow features used.”
  • The paper relies on this without support.

    Flows inherently exhibit specific characteristics of network applications and protocols.

    “Furthermore, flows inherently exhibit specific characteristics of network applications and protocols.”
  • The paper relies on this without support.

    Network operators rarely have complete information about all the applications in their network.

    “Rarely do network operators have complete information about all the applications in their network.”
  • The paper relies on this without support.

    An optimal CWND update reduces the number of packets lost and delay, and increases throughput and fairness.

    “It is important to note that an optimal CWND update reduces the number of packets lost and delay, and increases the throughput and fairness.”
  • The paper relies on this without support.

    WANETs require a much finer update of the CWND due to their constrained bandwidth.

    “In addition, WANETs require a much finer update of the CWND due to their constrained bandwidth.”
  • The paper relies on this without support.

    Synthetic data rely on simulations that may differ from real conditions.

    “However, synthetic data rely on simulations that may differ from real conditions.”
  • The paper relies on this without support.

    Accepting a new request generates revenue for the network service provider.

    “Evidently, accepting a new request generates revenue for the network service provider.”
  • The paper relies on this without support.

    Over and under estimation of demand can lead to both poor utilization and loss in revenue.

    “while over and under estimation can lead to both poor utilization and loss in revenue.”
  • The paper relies on this without support.

    It is non-trivial to predict demand.

    “However, it is non-trivial to predict demand”
  • The paper relies on this without support.

    Allocating a guard channel for a new or hand-off call can raise the blocking probability.

    “It is important to realize that allocating a guard channel for a new or hand-off call can raise the blocking probability.”
  • The paper relies on this without support.

    The primary advantage of RL is that it can be deployed without any initial policies, and it can learn to adapt to the dynamic demands for a reactive resource allocation.

    “The primary advantage of RL is that it can be deployed without any initial policies, and it can learn to adapt to the dynamic demands for a reactive resource allocation.”
  • The paper relies on this without support.

    It is unrealistic to inject faults in the production network just for the sake of generating training data.

    “Although injecting faults can help produce the required data [285], it is unrealistic to inject faults in the production network just for the sake of generating training data.”
  • The paper relies on this without support.

    The knowledge about the impact of network performance on user experience is crucial, as it determines the success, degradation or failure of a service.

    “The knowledge about the impact of network performance on user experience is crucial, as it determines the success, degradation or failure of a service.”
  • The paper relies on this without support.

    In practice, delay, jitter, and throughput impairments are correlated and happen together.

    “In practice, however impairments are correlated and happen together.”
  • The paper relies on this without support.

    The huge volume of generated network traces renders manual inspection practically impossible.

    “However, the huge volume of generated network traces renders manual inspection practically impossible.”
  • The paper relies on this without support.

    Getting labeled data for attacks is a cumbersome task.

    “Since getting labeled data for attacks is a cumbersome task”
  • The paper relies on this without support.

    Network cyber-threats are constantly changing and evolving.

    “Network cyber-threats are constantly changing and evolving”
  • The paper relies on this without support.

    It is difficult to obtain a complete representation of normality.

    “since it is difficult to obtain a complete representation of normality”
  • The paper relies on this without support.

    Contextual information undoubtedly influences QoE and is necessary to develop relevant QoE optimization strategies.

    “Though, contextual information undoubtedly influences QoE and is necessary to develop relevant QoE optimization strategies”
  • The paper relies on this without support.

    One cannot force users to rate a service objectively.

    “because one cannot force users to rate a service and rate it objectively”
  • The paper relies on this without support.

    Benign network behavior is more common and will naturally group together, whereas anomalous behavior is more sparse and will appear as outliers in the dataset.

    “In anomaly detection, the notion is that benign network behavior is more common and will naturally group together, whereas, anomalous behavior is more sparse and will appear as outliers in the dataset.”
  • The paper relies on this without support.

    Guaranteeing the ground truth is difficult and requires manual labeling.

    “This is expected since guaranteeing the ground truth is difficult and requires manual labeling.”
  • The paper relies on this without support.

    Obtaining a complete representation of normal behavior is extremely challenging.

    “Furthermore, obtaining a complete representation of normal behavior is extremely challenging.”
31 of 31

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

3 of 3

Citations

Cites

Items 201–400 of 455

Research works printed but not linked: 31

  1. ACM Special Interest Group on KDD. KDD cup archives. 2016. http://www.kdd.org/kdd-cup . Accessed 22 Nov 2017.
  2. Barman D, Matta I. Model-based loss inference by tcp over heterogeneous networks. In: Proceedings of WiOpt 2004 Modeling and Optimization in Mobile, Ad Hoc and Wireless Networks. Cambridge: 2004. p. 364–73.
  3. Brakmo LS, O’Malley SW, Peterson LL. Tcp vegas: New techniques for congestion detection and avoidance. In: Proceedings of the Conference on Communications Architectures, Protocols and Applications, ACM, New York, NY, USA, SIGCOMM ’94. New York: ACM: 1994. p. 24–35.
  4. Brauckhoff D, Wagner A, May M. FLAME: A flow-level anomaly modeling engine. In: Proceedings of the conference on Cyber security experimentation and test (CSET). Berkley: USENIX Association: 2008. p. 1.
  5. Breiman L, Friedman J, Stone C, Olshen R. Classification and Regression Trees. The Wadsworth and Brooks-Cole statistics-probability series. New York: Taylor & Francis; 1984.
  6. Bryson A, Ho Y. Applied optimal control: optimization, estimation and control. Blaisdell book in the pure and applied sciences. Waltham: Blaisdell Pub. Co; 1969.
  7. Bryson AE. A gradient method for optimizing multi-stage allocation processes. In: Harvard University Symposium on Digital Computers and their Applications. Boston: 1961. p. 72.
  8. Cannady J. Artificial neural networks for misuse detection. In: Proceedings of the 21st National information systems security conference, vol. 26. Virginia: 1998. p. 368–81.
  9. Dagum P, Galper A, Horvitz EJ. Temporal Probabilistic Reasoning: Dynamic Network Models for Forecasting. Stanford: Knowledge Systems Laboratory, Medical Computer Science, Stanford University; 1991.
  10. Demirbilek E, Grégoire JC. INRS audiovisual quality dataset.ACM; 2016, pp. 167–71. · DOI
  11. Goodfellow I, Bengio Y, Courville A. Deep Learning.MIT Press; 2016. http://www.deeplearningbook.org .
  12. Haining W. An economical broadband network with high added value. In: Evolving the Access Network, International Engineering Consortium. Chicago: International Engineering Consortium: 2006. p. 67–70.
  13. He Q, Shayman MA. Using reinforcement learning for proactive network fault management. In: Proceedings of the International Conference on Communication Technologies.1999.
  14. Hinton GE, McClelland JL, Rumelhart DE. Parallel distributed processing: Explorations in the microstructure of cognition, vol. 1 In: Rumelhart DE, McClelland JL, PDP Research Group C, editors. Parallel Distributed Processing: Explorations in the Microstructure of Cognition. Cambridge, MA, USA, chap Distributed Representations: MIT Press: 1986. p. 77–109.
  15. Juniper Research. Cybercrime will cost businesses over $2 trillion by 2019. 2015. https://www.juniperresearch.com/press/press-releases/cybercrime-cost-businesses-over-2trillion . Accessed 10 Nov 2017.
  16. Kim H, Claffy KC, Fomenkov M, Barman D, Faloutsos M, Lee K. Internet traffic classification demystified: myths, caveats, and the best practices.ACM; 2008, p. 11. · DOI · Paper page
  17. Laplace PS. Théorie analytique des probabilités. Paris: Courcier; 1812.
  18. Markov AA. An example of statistical investigation in the text of eugene onegin illustrating coupling of tests in chains. In: Proceedings of the Royal Academy of Sciences of St. Petersburg, St. Petersburg, Rusia, vol 1.1913. p. 153.
  19. Mitchell TM. Machine Learning, 1st ed. New York: McGraw-Hill, Inc.; 1997.
  20. Moradi M, Zulkernine M. A neural network based system for intrusion detection and classification of attacks. In: Proceedings of the IEEE International Conference on Advances in Intelligent Systems-Theory and Applications.2004. p. 15–8.
  21. Nguyen T, Armitage G. Synthetic sub-flow pairs for timely and stable ip traffic identification. In: Proc. Australian Telecommunication Networks and Application Conference.2006a.
  22. Papernot N, Goodfellow I, Sheatsley R, Feinman R, McDaniel P. cleverhans v1. 0.0: an adversarial machine learning library. 2016. arXiv preprint arXiv:161000768.
  23. Quinlan J. Discovering rules form large collections of examples: A case study. Edingburgh: Expert Systems in the Micro Electronic Age Edinburgh Press; 1979.
  24. Quinlan JR. Learning with continuous classes. In: Proceedings of Australian Joint Conference on Artificial Intelligence, World Scientific.1992. p. 343–8.
  25. Quinlan JR, et al, Vol. 1. Bagging, boosting, and c4. 5; 1996. 725–30.
  26. Ruiz M, Fresi F, Vela AP, Meloni G, Sambo N, Cugini F, Poti L, Velasco L, Castoldi P. Service-triggered failure identification/localization through monitoring of multiple parameters. In: ECOC 2016; 42nd European Conference on Optical Communication: Proceedings of. VDE: 2016. p. 1–3.
  27. Smolensky P. Parallel distributed processing: Explorations in the microstructure of cognition, vol. 1 In: Rumelhart DE, McClelland JL, PDP Research Group C, editors. Parallel Distributed Processing: Explorations in the Microstructure of Cognition, Vol. 1„ MIT Press, Cambridge, MA, USA, chap Information Processing in Dynamical Systems: Foundations of Harmony Theory.1986. p. 194–281.
  28. Steinhaus H. Sur la division des corp materiels en parties. Bull Acad Polon Sci. 1956; 1:801–4.
  29. Sun J, Chan S, Ko Kt, Chen G, Zukerman M. Neuron pid: A robust aqm scheme. In: Proceedings of the Australian Telecommunication Networks and Applications Conference (ATNAC) 2006.2006. p. 259–62.
  30. UCI KDD Archive. 2005. https://kdd.ics.uci.edu/ . Accessed 01 Aug 2017.
  31. Watkins CJ. Models of delayed reinforcement learning. PhD thesis: Psychology Department, Cambridge University; 1989.

Cited by

Sorted by citations

See all 1,036

Metadata

Authors
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M.
Affiliations
University of Waterloo (CA)
Corresponding author
Boutaba, Raouf
Venue
Journal of Internet Services and Applications
Published
2018-06-21
Volume
9
Issue
1
ISSN
  • 1867-4828 (ISSN-L)
  • 1869-0238
OpenAlex
W2809684781
Cited by
1,036
References
455
Citations by year
2026: 73 · 2025: 94 · 2024: 120 · 2023: 123 · 2022: 153 · 2021: 197 · 2020: 160 · 2019: 106 · 2018: 10
FWCI
73.03
Type
journal article
Language
en
Open access
Locations
  • Journal of Internet Services and Applications (publishedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
  • Departamento Administrativo de Ciencia, Tecnología e Innovación (COLCIENCIAS) (647‐2014)
  • Royal Bank of Canada
  • Natural Sciences and Engineering Research Council of Canada
  • Fonds de recherche du Québec – Nature et technologies
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Traffic and Congestion Control
Keywords
network management, traffic prediction, routing, network traffic classification, congestion control, resource management, fault management, quality of service, quality of experience, network security, autonomic networks, learning paradigms

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-10-10, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-10-10 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Cited sources are checked with a language model’s help (gpt-6-sol).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review