# A Comprehensive Survey on Knowledge-Defined Networking
## 7 Application Plane
### Application Scenarios
#### 7.3.3 Security
RUA is formulated as an Integer Linear Programming (ILP) problem to satisfy rule protection and TCAM constraints with the objective of minimizing wasted bandwidth and the number of rule placements. A firewall called P4 Guard, which is a protocol-independent, platform-agnostic software-based firewall that is configurable using a high level domain-specific language to specify policies in order to specify packet processing logic using P4 [504]. Anomaly/Attack/Intrusion Detection and Mitigation  
Intrusion/anomaly/attack detection and prevention systems monitor network traffic for signs of malicious activity and take actions to prevent it. These systems look for signs of suspicious behavior or attempted attacks, which is different from the approach taken by firewalls, which filter traffic based on a predetermined set of rules. These systems will use one of signature-based detection, behavior-based detection, or anomaly-based detection to detect attacks. Signature-based detection involves comparing network traffic to a database of known attack signatures, while behavior-based detection looks for patterns of activity that deviate from normal behavior. Anomaly detection uses statistical analysis to identify traffic patterns that are unusual or unexpected [505]. Once attacks are detected, KDN can install packet forwarding rules on switching devices to block the threat. The application policy will determine which type of detection out of signature-, anomaly-, or behavior-based detection will be utilized in the IDS. A behavior-based Intrusion Detection and Prevention System (IDPS), with an application policy to specifically detect port scanning using the port bingo algorithm and denial of service attacks using flow statistics, has been investigated in [506]. This behavior-based IDPS uses two rate-based connection monitoring algorithms, which are Credit-Based Threshold Random Walk (CB-TRW) and Rate-Limiting (RL). In [507], the authors analyze the performance of different machine learning techniques for an application that uses anomaly-based intrusion detection to identify the classifier, which leads to a more secure network. An intrusion detection system with an application policy to use signature-based intrusion detection using a random forest classifier to detect and prevent denial of service attacks has been studied in [508]. An anomaly-based intrusion detection system has been used, which has an application policy to identify the attack type and the source of the attack in a resource-constrained wireless network environment using an online change point detector to monitor performance metrics that are impacted when the network is under attack [509]. In collaborative intrusion detection, several intrusion detection nodes detect intrusion at each node while mutually exchanging information such as attack signatures, attack alarms, etc. between each other. A relatively new approach called Challenge-Based Collaborative Intrusion Detection Networks (CBCIDN) is a detection framework with a policy for identifying malicious nodes by calculating the nodes' reputation by sending a special message called a challenge message to the nodes [510]. CBCIDN is capable of detecting newcomer attacks and betrayal attacks to quickly identify the malicious nodes. In a distributed KDN control architecture, an intrusion detection system having an application layer policy such that the controllers jointly train a deep learning and generative adversarial networks-based global intrusion detection model without exchanging sub-network flows for a vehicular ad hoc network has been investigated in [511]. Such a collaborative IDS has been shown to be effective in both Independent Identically Distributed (IID) and non-IID scenarios. Furthermore, for collaborative intrusion detection to have secure communication between each intrusion detection node, application policies have been defined to use blockchain for establishing trust-based communication among detection nodes to propose a Snort-Based Collaborative Intrusion Detection System (SBCIDS) [512].