# A Comprehensive Survey on Knowledge-Defined Networking
## 3 Knowledge Plane
### Knowledge Generation Plane
#### 3.3.2 Generating Knowledge Using Machine Learning Methods
An isolation forest is a tree-based technique specially designed for anomaly detection that uses the average of the predictions by several decision trees to obtain the final anomaly score for the input data point [150]. An isolation forest classifier has been used for classifying network traffic's anomalies in a KDN-Network Function Virtualization (NFV) environment, which detects flooding attacks such as HTTP Flood, UDP Flood, Smurf Flood, and DDoS Flood [151]. An isolation forest has been used as an outlier detection scheme in combination with a data flow collection module and an information gain feature selection module to filter out the most relevant features to detect network security threats with high accuracy and low computational complexity [152]. A malware detection isolation forest using flow data of packets in combination with an automatically generated whitelist to eliminate benign packets in order to reduce the false positive rate of the isolation forest ML model has been studied in [153]. Semi-supervised Learning Approaches for Generating Knowledge  
Variational autoencoders and generative adversarial networks stand out as generative models in semi-supervised learning. A variational autoencoder (VAE) is a type of generative model that has an autoencoder with an encoder and decoder architecture that uses a probabilistic approach to encode input data into a latent space and then generate new data by decoding samples from the latent space while using variational inference to optimize the model during training [154]. A variational autoencoder for abnormal traffic detection that divides the traffic into 4 major categories and 38 specific attacks to be used as input to the decoder and has a higher classification accuracy and a higher generalization to detect new attacks is presented in [155]. In research [156], two approaches are studied to detect DoS and DDoS attacks. In the first approach, a variational autoencoder is trained on traffic traces of various types in order to learn the general features of the traffic. In the other approach, a variational autoencoder is used to learn abstract features from legitimate traffic in order to learn a representation of harmless traffic. Generative Adversarial Networks (GANs)  
Two neural networks serve as the generator and discriminator in a generative adversarial network. In a GAN, the generator is taught to produce new data that are similar to training data, and the discriminator is trained to distinguish between synthetic data and real training data [157]. A framework known as ByteSGAN, which consists of a generative adversarial network for encrypted traffic classification embedded in a KDN edge gateway and has better classification accuracy compared to CNN, has been discussed in [158]. While considering the network congestion in a heterogeneous knowledge-defined vehicular network, a generative adversarial network based method is used for augmenting the data dynamically used in creating network slices [159]. Generative adversarial networks have been used to synthesize realistic attacks using known attacks, such that attack variations have been trained to be detected in KDNs [160]. Considering the fact that DNNs tend to misclassify attacks under adversarial attacks, a generative adversarial network is used for detecting DDoS under adversarial training to reduce errors in misclassifying adversarial attacks in a KDN [161]. A Laplacian SVM is a semi-supervised machine learning approach that is a variant of the SVM that uses the Laplacian matrix to improve the accuracy of classification on complex and noisy datasets where labeled data are used to train the SVM while unlabeled data are used to construct the Laplacian matrix [162]. Laplacian SVM has been used for traffic flow categorization into QoS classes with the aid of deep packet inspection, where Laplacian SVM is specifically utilized to deal with traffic with unknown applications [163].