# Advancements in Machine Learning-Based Intrusion Detection in IoT: Research Trends and Challenges
## 4 Deployment of the IDS
### Software-Defined Networks (SDNs)  
Software-Defined Networking (SDN) is a modern network infrastructure that separates the network controller into three distinct layers. At the application layer, business logic interacts with the SDN controller to request network services and set configuration rules. The Control Layer manages traffic and makes routing decisions. Finally, the Data Layer consists of physical or virtual network devices, which forward data packets based on the rules set by the SDN controller. With centralization, SDN eliminates the need for each device to make independent routing decisions. This architecture allows for the dynamic configuration and optimization of network resources. Administrators can manage the entire network from a single console or through automated software, enabling dynamic scaling and responding to demand. In SDN-based systems, for instance, in [31; 32; 33], the control plane, which handles traffic routing and management, operates as a centralized software module. As per [31], this separation means adaptive traffic control with added flexibility and scalability. It also helps with implementing machine learning models, as SDN controllers can monitor traffic patterns easily. In general, it reduces operational complexity while allowing for automatic load-balancing and dynamic resource allocation. Refs. [34; 32] use a special component in the controller, called the SDNWISE Flow Table, which specializes in WIreless SENsors (WISEs) and uses matches to filter traffic. Ref. [35] created an SDN-integrated pyramidal, multi-level, conceptually decentralized multi-controller structured IDS system. The paper combines this structure with SDN data plane configurations and ML techniques to achieve a robust, real-data-trained IDS. The MULTI-BLOCK is a multi-layered defence strategy. By leveraging SDN, the framework implements granular traffic control measures, isolating infected devices and disrupting botnets. The goal is to contain attacks at the LAN level, minimizing the burden on central controllers and servers, ensuring critical network availability. It prioritizes the protection of controllers and distant nodes. The first module is a controller-to-controller (C2C) communication framework within SD-IoT networks. It reduces communication overhead and the enhancement of intrusion attack detection. A secure decentralized communication scheme is introduced, with the goal of synchronized communication and minimized data exchange between controllers. Within the realm of C2C communication, one interface encompasses general communications, whereas the other is for alerts. By adopting this approach, the system effectively reduces both data control overhead and communication overhead among controllers. The second module, the proposed P4-Enabled Decentralized Traffic Monitoring System (P4-DTMS), provides an efficient approach to managing IoT network traffic. The P4-DTMS module introduces a pipeline, consisting of 24 P4-enabled state tables that capture specific aspects of traffic. These state tables collectively contribute to creating a comprehensive network overview and insights into the network's traffic patterns. Their algorithm then delves into the state table configuration. The third module uses the extracted features to implement an ML-based state-driven identifier of attacks at the data plane stage. Deployed as a firewall, the inbound packets are first parsed, where statistics are recorded and updated. Occasionally, when the designated time window closes, results are sent to the higher-level switch. The rules of forwarding or stopping packets are updated; on the other hand, if the window period is still open, the process follows existing protocols. In [10; 36; 37], the control plane detection is appended by application layer modules, which are used to describe the requirements or desired behavior of the network. In both cases, this layer and the IDS module receive network data and perform ML tasks. [PERSON] et al.