## 5 Machine Learning Algorithms for SDN
### Traffic Classification  
Traffic classification plays an indispensable role in network management. Traffic classification enables network operators to control and allocate different services. Currently, the most used traffic classification approach includes dynamic port-based approaches and machine learning [139]. Port-based approaches such as deep packet inspection (DPI) have the advantage of high classification accuracy. DPI limitations include recognition of applications based on pattern availability and high computational cost to check traffic flow. DPI is unable to identify the encrypted flow of traffic. Therefore, compared to traditional DPI approaches, machine learning-based approaches are used to analyze encrypted traffic with a low computational cost. Traffic classification also includes collecting massive traffic flow data, extracting knowledge from the traffic data using machine learning approaches. Machine learning approaches are applied to the SDN controller for the analysis of collected traffic data. Machine learning-based traffic classification such as elephant flow-aware(EF), QoS-aware, and application-aware traffic classification. EF traffic classification is used to classify traffic flow to elephant flow and mice flow. Elephant flows are bandwidth-hungry persistent flows, whereas mice flow is weak flow and delay intolerant. There are 80 mice flows in data centers, and the rest of the traffic flow is elephant flow [140]. In such environments, elephant flow identification is essential for controlling the traffic flow efficiently. Hybrid data center-based traffic flow scheduling issues are discussed in paper [141]. Machine learning approaches are used to implement EF traffic classification at the edge level; SDN controller-based optimization algorithms further use these analysis results for efficient traffic flow management. [PERSON] et al. propose a two-stage algorithm with efficient learning cost in SDN for identification of elephant flow [142]. Firstly suspicious elephant flow is differentiated from mic flow using a head packet measuring technique. Secondly, a decision tree classification model is used to classify the suspicious traffic as elephant flow or not. In literature, application-aware traffic classification is proposed to identify applications based on the traffic flow. In study [139], an OpenFlow-based SDN system is proposed for the collection of data in enterprise networks. Several machine learning classifiers are trained to classify applications based on traffic flow. A hybrid approach of multi-classifier and DPI-based classifier is proposed in paper [143] to identify and classify applications. [PERSON] et al. proposed a behavioral engine for UDP protocol-based application-aware traffic classification [144]. SVM-based model is used to classify UDP traffic according to its Netflow records with more than 90 percent classification accuracy. TrafficVision, an SDN-enabled edge network, is proposed for mobile application-aware traffic classification [145]. The main component of Trafficvision is TrafficVision Engine(TV Engine). TV Engine performs tasks such as collecting data, storing data, extracting flow statistics, and data of ground truth training from access devices and end devices. A decision tree classifier model is used to classify different applications. In contrast, a KNN classifier-based model is used to classify flow types such as video content, an audio file, video chat, etc. QoS-aware traffic classification is used to classify the traffic flow into QoS classes. QoS classes are assigned to different applications based on QoS requirements such as jitter, delay, and loss rate. Traffic flow classification, according to QoS classes, is the most efficient approach towards traffic flow classification. A semi-supervised learning algorithm and DPI-based approach are proposed for QoS aware traffic classification [146]. DPI approach is used to label the well-known applications.