# A Comprehensive Survey on Knowledge-Defined Networking
## 3 Knowledge Plane
### Knowledge Generation Plane
#### 3.3.2 Generating Knowledge Using Machine Learning Methods
A Rectified Linear Unit (ReLU) DNN that can handle large databases of classification rules is employed in [104] for packet classification in large networks. Some have used DNNs for traffic classification and prediction in KDNs in order to process the huge amount of data received by the centralized controller [105]. An energy efficiency optimization framework based on traffic prediction in knowledge-defined networking using a DNN having a Gated Recurrent Unit (GRU) layer capturing the temporal characteristics of the network traffic, aimed at reducing network energy consumption while ensuring communication quality, is presented in [106]. Flow-based anomaly detection has been used in intrusion detection for a KDN system using a GRU-Long Short-Term Memory (LSTM)-based DNN [107]. Deep learning has also been utilized to identify the presence of link failures in a complex multi-route optical network by analyzing a large amount of data received from the optical network [108]. A link failure at handover mitigation scheme by continuously observing and tracking signal conditions using an LSTM-based DNN, where the behavior of these signal conditions is taken as input to the neural network, which acts as a classifier, classifying the event in either handover failure or success in advance, is used in [109]. Thus, in the preceding scheme, by advancing the prediction of handover status, handover failures can be mitigated. DNNs have also been used to replace heuristic routing optimization models such as mixed integer linear programming problems, which are trained on optimal decisions using flows from known traffic demands [110]. Due to facing of frequent communication interruptions and poor stability inherent in 3D Flying Ad Hoc Networks (FANETs), a DNN-based routing consisting of a 3D two-space division and DNN-based forwarding that yields better performance in terms of packet delivery rate compared to conventional routing protocols is presented in research [111]. Wijesekara et al. generate knowledge regarding link lifetimes and one-hop channel delays related to wired and wireless communication channels in a heterogeneous knowledge-defined vehicular network using DNNs, in order to utilize the generated knowledge in a hybrid stable distance and stable delay based OpenFlow compatible adaptive routing algorithm which yields better routing performance in terms of packet delivery ratio, latency, and communication cost [112]. A DNN-based routing framework called \"NeuRoute\", which predicts a traffic matrix in real-time using a DNN and generates forwarding rules to optimize network throughput for KDN, is presented in [113]. A temporal-aware Quality of Service (QoS) prediction using a DNN with GRUs with the aid of feature integration has been employed in [114]. In [115], the authors present a DNN model for multiple attribute QoS prediction, where multi-task prediction is achieved by stacking task-specific perception layers on the shared neural layers. A decision tree consists of nodes that represent decisions or attributes of data, and the branches represent the possible outcomes or class labels that result from each decision. In a decision tree, any path beginning from the root is described by a data-separating sequence until a Boolean outcome at the leaf node is achieved. A creation of a decision tree involves the recursive splitting of data based on the most informative features until a stopping criteria is met [116]. Decision trees have been used for the detection of Distributed Denial of Service (DDoS) attacks in KDNs [117]. A DDoS attack is a threat that is used by cybercriminals to deny the service of a network resource, such as the controller in the KDN paradigm, by making it unavailable to its intended users.