# A Comprehensive Survey on Knowledge-Defined Networking
## 3 Knowledge Plane
### Knowledge Generation Plane
#### 3.3.2 Generating Knowledge Using Machine Learning Methods
Self-Training  
Self-training is a semi-supervised machine learning approach utilized in situations where there is a small amount of labeled data and a large amount of unlabeled data, such that the classifier is initially trained on the labeled data to predict labels for the unlabeled data, where the predicted labels are added to the labeled dataset, and the classifier retrained iteratively [164]. A self-learning-based traffic classification framework that uses dataset features such as flow meta-data information, size, and interval arrival times, where training using only 20% of the data as labeled data has produced satisfactory classification results [165]. Integration of Supervised with Supervised, Semi-Supervised, or Unsupervised Learning Approaches for Generating Knowledge  
By combining a K-nearest neighbor (supervised) machine learning model with a variational autoencoder (semi-supervised) using a hybrid approach, both known and unknown DDoS saturation attacks have been detected in KDNs with a better performance than each of the machine learning model's individual performances [166]. An autoencoder and a one-class SVM are used for intrusion detection in the knowledge plane, while the P4 programming language along with ML have been used to implement real-time intrusion detection in the data plane [167]. A conditional variational autoencoder is used for data generalization in combination with a random forest classifier to automatically learn similarity among input features, extract discriminative features, and classify various types of attacks [168]. An intrusion detection model using a combination of a conditional variational autoencoder and a deep neural network where the decoder generates new attack samples to balance the training data, improving the detection rate of imbalanced attacks, has been effective in detecting minority attacks and unknown attacks [169]. To deal with both problems of an unbalanced and unlabeled data set in training for DDoS detection in KDNs, a combination of an autoencoder and a one-class SVM has achieved high accuracy with a small set of flow features [170]. Adversarial attacks have been generated and detected using a combination of generative adversarial networks and reinforcement learning in a wireless sensor network [171]. A flooding DDoS attack detection framework by combination of generative adversarial networks and deep learning, where the deep learning model has been trained incorporating adversarial attacks to improve the accuracy of classification [172]. A triple combination of a deep sparse autoencoder for dimension reduction, a generative adversarial network to solve the data imbalance problem, and, finally, ensemble learning using a supervised machine learning model has been used for the classification of anomalies in network traffic for KDNs [173]. A group of features in traffic flows, namely inter-packet arrival time, packet size, packet count, and flow tuple, have been used for flow classification using a combination of C4.5 decision trees and K-means clustering [174]. A management framework called ATLANTIC uses information theory to calculate deviations in the entropy of flow tables, in which a K-means classifier has been used for clustering traffic flows, followed by a SVM for classifying the flow of each cluster to detect and categorize traffic anomalies [175]. A modular DDoS attack detection system using K-means++ and fast K-nearest neighbor unsupervised and supervised machine learning combinations has resulted in high precision and stability for detection [176]. Ensemble learning is usually a combination of a machine learning approach with another machine learning approach of the same category (e.g., supervised with supervised) for improving the accuracy and robustness of the predictions. An anomaly detection algorithm by combining X-means and isolation forest ML models using ensemble learning has shown better classification performance compared to the other unsupervised machine learning approaches' classification performance considered individually [177].