# A Comprehensive Survey on Knowledge-Defined Networking
## 3 Knowledge Plane
### Knowledge Generation Plane
#### 3.3.2 Generating Knowledge Using Machine Learning Methods
\begin{table}
\begin{tabular}{l l l l l} \hline
**Task** & **Learning Class** & **Learning Technique** & **Special Purpose** & **Performance** \\ \hline \multirow{8}{*}{Integrated ML} & KNN, Variational & Detect known, unknown DDoS & Precision—0.85, Recall—0.97, \\  & autoencoder & attacks [166] & F1-score—0.91 \\ \cline{2-5}  & Autoencoder, 1-class SVM & Intrusion detection [167] & Detection accuracy of 97\% \\ \cline{2-5}  & Conditional VAE, random forest & Attacks classification with generalized training [168] & Precision above 99\%, better \\ \cline{2-5}  & Conditional variational AE, DNN & IDS including minority and unknown attacks [169] & Accuracy of 89.08\%, DR of 95.68\% \\ \cline{2-5}  & AE, 1-class SVM & DDoS detection under imbalanced, unlabeled data [170] & Average accuracy of 99.35\% \\ \cline{2-5}  & GAN, Reinforcement learning & Detection of attacks including & Average accuracy of 85.40\% \\ \cline{2-5}  & GAN, DNN & Detecting DDoS attacks with adversarial training [172] & Adversarial training improves \\ \cline{2-5}  & AE, CGAN, ensemble learning & Intrusion detection [173] & Fast classification with high \\ \cline{2-5}  & K means, SVM & Detect and categorize traffic anomalies [175] & Accuracy of 88.7\%, precision of 82.3\% \\ \cline{2-5} Security & K means++, fast KNN & Modular DDoS attack & High efficiency, precision, and stability \\ \cline{2-5}  & Isolation forest, X-means & Anomaly detection [177] & Average AUC 81\%, ADR 19.5\% better \\ \cline{2-5}  & KNN, NB, SVM, SOM & Anomaly detection [178] & SVM-SOM: 98.1\% accuracy, 97.1\% DR, \\ \hline \multirow{8}{*}{Reinforcement learning} & RL with DAG & Routing optimization preventing & PDR—85\%, delay—1.5–2.9 s, prevent \\  & rank attacks [183] & ranking attacks satisfactorily \\ \cline{2-5}  & Deep reinforcement learning & QoS-aware secure routing [186] & QoS performance gains when network \\ \cline{2-5}  & DeDPG based DRL & Joint routing optimization and DDoS detection [193] & MA-better packet delay, jitter, packet \\ \cline{2-5}  & Neural fitted Q-learning & ATMoS: Autonomous threat & The model converges, can detect and \\ \cline{2-5}  & Reinforcement learning & Anomaly detection [192] & mitigate actors of APTs \\ \cline{2-5}  & Reinforcement learning & Anomaly detection [194] & Detect attacks, state representation has \\ \hline \multirow{8}{*}{Huristic model (CP)} & Evolutionary algorithm & Multi-objective controller placement [88] & Needs less memory, computation time, \\  & Heuristic optimization & Reliable fault-tolerant controller placement [89] & Computation time \textless{} 2 min, controller \\ \cline{2-5}  & Heuristic model & H\begin{tabular}{l} Heuristic model \\ algorithm \\ \end{tabular} & \begin{tabular}{l} Heuristic model \\ algorithm \\ \end{tabular} & \begin{tabular}{l} Heuristic model \\ algorithm \\ \end{tabular} \\ \cline{2-5}  & \begin{tabular}{l} Binary ILP, heuristic \\ algorithm \\ \end{tabular} & \begin{tabular}{l} Energy aware controller \\ placement [90] \\ \end{tabular} & \begin{tabular}{l} BILP is computationally complex, \\ heuristic algorithmic solution is near \\ optimal \\ \end{tabular} \\ \cline{2-5}  & \begin{tabular}{l} Particle swarm optimization, \\ firefly algorithm \\ \end{tabular} & \begin{tabular}{l} CP considering latency, multipath \\ connectivity [91] \\ \end{tabular} & \begin{tabular}{l} Minimizes average delay during single \\ link failure \\ \end{tabular} \\ \hline \multirow{8}{*}{Unsupervised ML} & Optimized K-means & Partition algorithm for controller placement [146] & Maximum latency 2.437\(\times\) less than \\ \cline{2-5}  & Optimized K-means & Controller placement minimizing & Latency less than standard K-means, \\ \cline{1-1} \cline{2-5}  & \begin{tabular}{l} \multirow{2}{*}{Optimized K-means} \\ \end{tabular} & \begin{tabular}{l} \multirow{2}{*}{\
\begin{tabular}{l} Controller placement minimizing \\ latency [147] \\ \end{tabular} } &
\begin{tabular}{l} Latency less than standard K-means, \\ high availability \\ \end{tabular} \\ \hline \end{tabular}
\end{table} 
Table 2: _Cont._