# A Comprehensive Survey on Knowledge-Defined Networking
## 3 Knowledge Plane
### Knowledge Composition Plane
#### 3.4.3 Examples Using Composed Knowledge in the Existing Literature  
In [212], a network-wide packet classification algorithm that uses a multi-valued decision diagram is used to classify packets, and the classification knowledge is used to generate rules for automatic fault localization. Similarly, another packet classification algorithm known as split bit vector packet classification functions by splitting and then classifying in parallel, and then that classification knowledge is orchestrated with the objective of minimizing latency in order to produce OpenFlow flow rules [213]. Generating rules for QoS management using the knowledge generated as traffic classification can be considered as a knowledge composition step. In [214], the network encrypted traffic in a smart home network is classified using three deep learning schemes: multilayer perceptron, stacked autoencoder, and a CNN where the knowledge on traffic classification is compared with application layer requirements in order to generate rules related to network management. Another similar work classifies traffic using deep learning, which is used to generate rules for fine-grained network management and resource utilization [215]. Machine learning or model-based methods can be used for intrusion detection in KDNs, as discussed in Sections 3.3.1 and 3.3.2. However, after detection, prevention of further damage or threat-suppressing actions belongs to the knowledge composition step. An intrusion prevention system that detects DDoS, worm spreading, and scanning on a global level in the network using a parallel neural network, and then the knowledge on the detection class is used to generate rules for taking necessary actions to suppress the attacks [216]. An intrusion prevention system using fuzzy logic that can decide the length of the blocks based on knowledge of the frequency and type of the attack, that will generate rules to block the attacker host for a specific period of time has been studied in [217]. Another similar work detects DDoS attacks using genetic algorithms and uses the knowledge of the attack class, composing it with other knowledge on the frequency and nature of the attack, to generate rules to block the attacking host for the duration of the attack [218]. An Address Resolution Protocol (ARP) spoofing attack is where adversaries send fabricated ARP messages linking the attacker's Media Access Control (MAC) address to a genuine device's Internet Protocol (IP) address. An intrusion detection and prevention system that detects ARP spoofing attacks by detecting malicious network traffic, where rules are generated to drop packets when the attack is detected [219]. In terms of routing in computer networks, the forward path selection can be considered as a knowledge generation step, while the flow-rule placement is a knowledge composition step that uses the knowledge generated in the form of forwarding paths to generate flow rules. In [220], a framework called FlowStat uses per-flow statistics to produce knowledge on optimal paths using max-flow min-cost optimization and then uses integer linear programming as the rule generator to decide forwarding rules for the forwarding paths. A routing framework that classifies the data flow into two classes (mice and elephant) based on their size and then, based on the knowledge of the classified flow type, uses a machine learning technique called association rules to generate forwarding rules for each flow class [221]. Ternary Content Addressable Memory (TCAM) modules have a limited capacity and are used to store flow rules in KDNs. In [222], first, knowledge is generated in the form of routes without considering TCAM constraints; then, that knowledge is used in a mixed-integer linear programming model to compute flow rules considering the limited capacity of TCAM.