# A Comprehensive Survey on Knowledge-Defined Networking
## 3 Knowledge Plane
### Knowledge Generation Plane
#### 3.3.2 Generating Knowledge Using Machine Learning Methods  
The input data or information may be utilized to extract features using machine learning algorithms. Before putting raw data into machine learning models, high-level features are typically extracted to create information in order to increase the accuracy of the models [92]. However, for knowledge creation using ML techniques, high computational resources are required. For example, for autonomous driving applications, frames of images from multiple cameras or sensors are required to be input, which requires high computational power in knowledge generation. In such cases, distributed knowledge generation models can be used to divide the knowledge generation workload among multiple machine learning models, where the knowledge generated by each model can be later combined using the knowledge composition plane. Some research suggests that Artificial Intelligence (AI)-based approaches yield better results for knowledge generation than algorithmic approaches [27]. Five approaches to machine learning are available in order to generate knowledge from the data/information in communication networks:  
* Supervised learning--In supervised learning, a training data set contains labeled inputs with corresponding labeled outputs for the supervised machine learning algorithm for training (fitting). During training, the ML algorithm learns the underlying patterns in the input data to retrieve the outputs. Supervised learning involves either a classification or regression problem. A classification problem has discrete output variables producing qualitative outputs, whereas a regression problem has continuous output variables producing quantitative outputs [93];
* Unsupervised learning--Unsupervised learning develops knowledge by choosing a cluster of related items from the provided input data set (no supervision is required). It does not train using a labeled data set [94];
* Semi-supervised learning--In this method of learning, both labeled and unlabeled datasets are used to train the machine learning model [95];
* Integration of supervised with supervised, unsupervised, or semi-supervised learning approaches--In this integrated method, at least two machine learning models are used to complete a specific job [96];
* Reinforcement learning--With reinforcement learning, an agent in a given state acts to maximize potential rewards from the surrounding environment in the future [97]. Now, let us review each of the approaches to machine learning for knowledge generation in knowledge-defined networks. Supervised Learning Approaches for Generating Knowledge  
An Artificial Neural Network (ANN) is a collection of node layers, comprising an input layer, an output layer, and optional one or more hidden layers in which each node (neuron) is associated with a weight and a threshold value [98]. A Deep Neural Network (DNN) is an ANN that necessarily consists of one or more hidden layers between the input layer and the output layer of the ANN [99]. The weights and biases of the neurons are adjusted to minimize a user-defined loss function during DNN training in order to find a mathematical relationship between the inputs and the outputs [100]. Deep learning has been used for detecting network intrusions and for flow-based anomaly detection in the centralized controller, where deep learning has resulted in better performance (except for accuracy) compared to an approach using a Recurrent Neural Network (RNN) [101]. A self-organizing routing algorithm that reactively finds the most reliable route using a deep neural network in a self-organizing knowledge-defined network has been investigated in [45]. A Convolutional Neural Network (CNN) is an ANN that has at least one convolution layer that performs the mathematical operation convolution instead of matrix multiplication [102]. Work in [103] uses a CNN and Continuous Wavelet Transform (CWT) to detect DDoS attacks in KDNs by differentiating attack samples from normal traffic.