# A Comprehensive Survey on Knowledge-Defined Networking
## 3 Knowledge Plane
### Knowledge Generation Plane
#### 3.3.2 Generating Knowledge Using Machine Learning Methods
Internet protocol traffic classification using the flow statistics collected by the controller and Transmission Control Protocol (TCP) flow in KDN has been achieved using a random forest classifier, which yielded a higher accuracy compared to gradient boosting classifiers [135]. Statistical learning, which involves estimating application end-to-end quality of service metrics such as frame rate and response time from device statistics, has been used in an OpenFlow network using a random forest machine learning classifier, which produced a better classification performance than the regression tree [136]. K-nearest neighbor is a supervised machine learning algorithm that groups data into coherent clusters, based on the assumption that similar points exist close to one another, and classifies the newly input data based on the similarity of previously trained data [137]. The K-nearest neighbor machine learning model has been utilized to detect DDoS attacks in KDNs; however, it has resulted in lower classification performance compared to the J48 classifier [138]. In heterogeneous vehicular networks that use a KDN paradigm, cell selection for 5G millimeter wave communication considering the motion of nodes and characteristics of base stations has been realized by classification using a K-nearest neighbor model [139]. In KDN-based internet service provider networks, Transmission Control Protocol-Synchronization (TCP-SYN) and Internet Control Message Protocol (ICMP) flood attacks have been detected using K-nearest neighbor [140]. Detection of known and unknown saturation attacks by properly selecting a time window for OpenFlow traffic detection has been realized with the aid of a K-nearest neighbor classifier, where unknown saturation attacks have been detected by appropriately selecting a time window [141]. This research suggests that the time window of the traffic has a relationship with the model's classification performance. Even though packet classification has been achieved using a K-nearest neighbor classifier, its performance has been inferior to that of DNNs, which proves that it is less efficient at handling large datasets and the classification rules that occur in network scenarios [104]. To cope with the problem of overloading of the controller, a prediction mechanism for predicting harmful long-term loads of the controller in order to offload the controller in a harmful long-term scenario using a K-nearest neighbor classifier has been proposed; however, the prediction performance has been slightly inferior to SVMs [142]. K-nearest neighbor has been utilized to predict the Quality of Experience (QoE) in video data in real-time in KDNs [143]. Traffic classification as a knowledge generation step by collecting flow features such as protocol percentage, packet count, packet size, IP diversity ratio, etc. using a K-nearest neighbor has been realized in [144], in order to classify different IoT devices and detect different DDoS attacks such as TCP-SYN, UDP, and ICMP. Unsupervised Learning Approaches for Generating Knowledge  
K-means is an unsupervised machine learning algorithm for grouping unlabeled data into a specified number (K) of clusters [145]. A multi-controller placement problem minimizing latency where an optimized K-means model is used for network partitioning in order to place the controllers has been studied in work [146]. Similar work uses an optimized version of the K-means algorithm for achieving multi-controller placement in KDN while minimizing the latency, which also guarantees high reliability and prevents the single point of failure problem [147]. K-means has been used for anomaly detection in smart grid KDN environments, which has resulted in high classification accuracy [148]. A DDoS attack detection mechanism under an unbalance in the traffic distribution using K-means clustering in a KDN has been studied in [149].