# Intelligent Traffic Management in Next-Generation Networks
## 3 DL/ML Applications in Software-Defined Networking
### Network Security
#### 3.3.1 Existing Solutions  
Recently, ML/DL based models have been widely used for intrusion and attack detection. In this section, we present a literature review of these models for IDS (Table 10). ML-based models are widely applied for network IDS. For example, [PERSON] et al. [123] proposed a comparative analysis between different conventional ML-based models for the intrusion detection task using a benchmark dataset (NSL-KDD dataset). The features used by these classifiers were extracted and reduced after the application of the PCA method. The results demonstrate that using PCA enhances the detection rate of the classifiers, as well as the DT approach, showing the best performance in terms of all the evaluation metrics. Additionally, as SDN and ML-based models are considered the enablers of the realization of the 5G network, [PERSON] et al. [124] proposed an intelligent attack classification system in an SD-5G network using RF for feature selection and AdaBoost for attack classification with the selected features. The 10% of the KDD Cup 1999 dataset was used to evaluate the proposed system. The results demonstrate that, using the selected features, the classifier can better differentiate the attack traffic and produce a low overhead system. Similarly, [PERSON] et al. [125] proposed a two-stage intrusion detection and attack classification system in an SD-IoT network. In the first stage, they selected the relevant features, which were used in the second stage for attack anomaly detection. The experiments on the KDD Cup 1999 dataset show that random forest achieved a higher accuracy with an acceptable complexity time compared to the existing approaches. However, as conventional ML models have difficulties detecting attacks in large-scale network environments [126], DL models have been used. They can give better \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Ref.** & **ML/DL Model** & **Controller** & **Contribution** \\ \hline \([109]\) & LSTM & FOX & The authors proposed a traffic prediction framework and deployed it on SDN using a real-world dataset under different model configurations. \\ \hline \([110]\) & ANN & N/A & The authors used the prediction results to make online routing decisions. \\ \hline \([111]\) & ANN & Floodlight & The proposed system tries to benefit from the global view of SDN controller in order to collect the bandwidth utilization ratio, packet loss rate, transmission latency, and transmission hop of each path. Then, using the ANN model, it predicts the load condition of each path. \\ \hline \([112]\) & Deep CNN & N/A & The authors presented the performance of their systems with three different systems, which are a centralized SDN system, a semi-centralized SDN system, and a distributed conventional control system without centralized SDN. \\ \hline \([106]\) & GRU-RNN & N/A & The authors used (GRU-RNN) in order to predict the mobile network traffic matrix in the next hour. \\ \hline \([108]\) & SVR & N/A & The authors demonstrate that SVR outperforms the ARIMA method; the average performance improvement is 48\% and 26\%. \\ \hline \([113]\) & LSTM & N/A & The authors focused on network traffic prediction for short time scales using several variations of the LSTM model. \\ \hline \([75]\) & LSTM+FL & Floodlight & The authors used an LSTM model and federated learning in order to predict the future load to optimize routing decisions and at the same ensure data privacy as well decrease the exchange message between the SDN controller. \\ \hline \([115]\) & LSTM, BiLSTM, GRU & POX & The authors proposed a comparative analysis between three RNN-based models: LSTM, GRU, and BiLSTM. \\ \hline \([116]\) & Shallow ML models, DL models, ensemble learning & N/A & The authors take advantage of the forecasting results in order to manage the network slice resource. \\ \hline \end{tabular}
\end{table} 
Table 9: Summary of reviewed papers on ML applications for network traffic prediction in SDN.