# A Comprehensive Survey on Knowledge-Defined Networking
## 3 Knowledge Plane
### Knowledge Generation Plane
#### 3.3.2 Generating Knowledge Using Machine Learning Methods
Furthermore, decision trees have been extensively used for packet classification in computer networks using different cutting approaches such as Cutsplit, which exploits the benefits of cutting and splitting techniques adaptively while having a low memory consumption [118]; Bitcuts, which has fast tree traversal speed using bit-level cutting [119]; and Hypercuts, which is a decision tree in which each node in the tree represents a k-dimensional hypercube, which uses an extra degree of freedom and a new set of heuristics to find optimal hypercubes for a given amount of storage [120]. Another frequently used classification task in decision trees is network traffic classification. In [121], traffic classification using a decision tree is used for vulnerability detection in the supervisory control and data acquisition network of a smart factory. Some have used the C4.5 decision tree algorithm along with an entropy minimum description length discretization algorithm for traffic classification, whose performance has been enhanced by implementing it in a Field Programmable Gate Array (FPGA) and multi-core platforms [122]. An improved decision tree-based algorithm for traffic classification that uses C4.5 decision trees in the Hadoop platform called HAC4.5, which parallelizes the decision tree algorithm using the Hadoop platform to classify big data traffic with higher accuracy and low computational time, is presented in work [123]. Support Vector Machines (SVMs)  
A support vector machine is a supervised machine learning approach used for classification and regression problems where an optimal decision boundary (hyperplane) is used to differentiate the classes or for regression [124]. A multiclass classification support vector machine has been used to detect two types of flooding-based DDoS attacks with the minimum disturbance to legitimate users in a KDN [125]. Another research project uses hierarchical flow- and packet-based anomaly detection using support vector machines as an intrusion detection system in KDN. In this approach, the first level is a flow-based IDS, which passes the flow to a packet-based IDS for further actions if the flow-based IDS detects an attack [126]. Data traffic based on the application has been classified in a KDN using an SVM, where the classification accuracy has been poor compared to the Naive Bayes machine learning model [127]. Support vector machine-based application traffic identification and classification such as Youtube, Facebook, etc. has been achieved in a KDN scenario with high classification accuracy [128]. Some have classified packets based on the action/flow of each packet in KDNs using support vector machines, where five features of the IP header have been extracted before classification [129]. In a study that investigated the performance of the SVM supervised machine learning model and the K-means clustering unsupervised machine learning model for traffic classification, SVM yielded a higher classification accuracy than K-means [130]. A random forest consists of many decision trees, where each decision tree provides its prediction such that the class with the highest count becomes the classification of the model [131]. Random forest models have been used for classification, feature selection, and proximity metrics for behavior-based intrusion detection in KDNs [132]. The purpose of an intrusion detection system is to capture any malignant activities in the network before they cause severe damage to the network. The DDoS attack on the controller of KDN, which leads to resource exhaustion and the non-reachability of the services given by the controller, has been detected using random forests. However, the random forest classifier has yielded inferior performance to the SVM in detecting a DDoS attack [133]. A random forest has yielded a higher classification accuracy and a lower false positive rate for detecting the presence of an attack in a network intrusion detection system compared to neural networks and Naive Bayes machine learning classifiers [134].