# A Comprehensive Survey on Knowledge-Defined Networking
## 3 Knowledge Plane
### Knowledge Generation Plane
#### 3.3.2 Generating Knowledge Using Machine Learning Methods
\begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Task** & **Learning Class** & **Learning Technique** & **Special Purpose** & **Performance** \\ \hline \multirow{8}{*}{Packet classification (PC)} & ABV algorithm & Parallelize ABV algorithm on GPU for PC [68] & 99.9 times speedup, 65 times enhancement in throughput \\ \cline{2-4}  & Lookup and BCAM & Packet classification using BCAM [69] & 5 times fewer CAM bits than TCAM-based scheme \\ \cline{2-4}  & Data structure RQ-RMI & Multi-field packet classification [70] & High compression factor, improvement in throughput \\ \cline{2-4}  & \multirow{2}{*}{Heuristic model classification (PC)} & \multirow{2}{*}{DDBS algorithm} & \multirow{2}{*}{Multi-tuple packet classification [71]} & Throughput: Over 10 Gbps on Cavium, 135 Gbps Xilinx \\ \cline{2-4}  & & & \\ \cline{2-4}  & Cross product, linear search & Packet classification [72] & Feasible, scalable, take less time and space \\ \cline{2-4}  & \multirow{2}{*}{TSS assisted algorithm} & Packet classification [73] & Comparable update, high classifi. performance wrt. TSS \\ \cline{2-4}  & & Interval valued fuzzy logic & Classify video streams [74] & Reasonable accuracy, flexible, low computational cost \\ \hline \multirow{4}{*}{Supervised ML} & Deep neural network & Packet classification [104] & More than 90\% classification accuracy \\ \cline{2-4}  & Decision tree & CutSplit: DT combining cutting, splitting for PC [118] & 10\(\times\) memory reduction, 3\(\times\) improro. of memory accesses \\ \cline{1-1} \cline{2-4}  & & & \\ \end{tabular}
\end{table} 
Table 2: Analysis of task-wise classification of knowledge generation in KDNs. \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline  
\begin{table}
\begin{tabular}{p{108.4 pt} p{108.4 pt} p{108.4 pt} p{108.4 pt}} \hline
**Task** & **Learning Class** & **Learning Technique** & **Special Purpose** & **Performance** \\ \hline \multirow{8}{*}{Heuristic model} & Optimization algorithm & Traffic sampling to inspect malicious network traffic [82] & Significantly outperforms equal rate all switch sampling \\ \cline{2-4}  & Fuzzy logic-based algorithm & Security management, IDS [83] & More accurate results than algorithms used alone \\ \cline{2-4}  & Attack detection algorithm & Kangaroo—Flow and packet based IDS [84] & Good attack detection rate, scalable \\ \cline{2-4}  & Lion optimization & Detect DDoS attacks [85] & 96\% accuracy \\ \cline{2-4}  & Fuzzy logic with InfoGain FS & Anomaly-based intrusion detection [86] & 91.1\%—true-positive rate, 0.006\%—false-positive rate \\ \cline{2-4}  & Evolving fuzzy system & Network anomaly detection [87] & 81\%—binary classification, 80\% multiclass classification accuracy \\ \hline \multirow{8}{*}{GCRU-LSTM-based DNN} & Deep neural network & Network intrusion and anomaly detection [101] & Better throughput, latency, resource utilization \\ \cline{2-4}  & Convolutional neural network & To detect DDoS attack [103] & High detection rate—DNS amplification, NTP, TCP-SYN \\ \cline{2-4}  & GRU-LSTM-based DNN & Flow-based anomaly detection [107] & Accuracy—87.9\%, precision—99.8\%, recall—99.4\%, F1-score—99.2\% \\ \cline{2-4}  & Decision tree & To detect DDoS attack [117] & Better performance compared to SVM and Naive Bayes \\ \cline{2-4}  & Decision tree & Vulnerability detection using traffic classification [121] & Good accuracy, training time, prediction speed \\ \cline{2-4}  & Support Vector Machine & Flooding-based multiclass DDoS detection [125] & 97\% accuracy with fastest training, testing time \\ \cline{2-4}  & Support Vector Machine & Hierarchical flow, packet-based anomaly detect [126] & Good detection rates, minimal extra overhead \\ \cline{2-4}  & Random forest & Detect DDoS attack [133] & High false positive rate, low accuracy wrt. SVM \\ \cline{2-4}  & Random forest & Intrusion detection system [134] & Superior performance to NN and Naive Bayes \\ \cline{2-4}  & K-nearest neighbor & Detect DDoS attacks [138] & Lower classification performance wrt.