# Traffic Classification in Software-Defined Networking Using Genetic Programming Tools
## 2 Material and Methods
### Theoretical Framework
#### 2.1.3 ML-Based Traffic Classification Methods in SDN and Related Works  
A widely accepted solution for SDN traffic classification is the use of machine learning (ML) techniques, which exploit extracted statistical data and distinguish data flows into several categories. For the categorization of flows, mainly their statistical data are utilized and, based on these data, the different flows are distinguished into several classes or groups. The development of ML algorithms for SDN network traffic classification is implemented (a) at the control layer using a classifier module and (b) at the data layer using P4 language [20]. In the first case, the SDN controller collects information and, in cooperation with the application layer, exploits it to implement forwarding or access policies. The process is completed in three steps [10]: (1) the data are sent to the controller by OpenFlow Protocol; (2) the controller extracts the desired features, which feed the classifier; (3) the classifier performs the task of classification. In the second case, the classification is conducted at the data level, and the P4 programming language is used to add ML mechanisms to the switches to categorize the flows, making it more effective and allowing it to identify flows as soon as possible. The majority of research approaches that deal with network traffic classification challenges in SDN leverage data collected by the OpenFlow protocol and extract the appropriate features to feed the input of classification process. These features include (a) observables such as packet size, interval arrival time, source and destination IP/MAC/Port, flow duration, and byte count; (b) defined and calculated features such as mean and variance of traffic characteristics; (c) scalars, such as minimum and maximum values. Then, on selected or on the set of features supervised, semi-supervised, or unsupervised, reinforcement learning [6] classification methods are applied to classify the data traffic flows in terms of (a) traffic protocols (e.g., http, smtp, ssh, p2p, dns); (b) application type (e.g., DDoS, FTP, and video streaming, Youtube, video, Facebook, Linkedin, Skype); (c) flow size (e.g., elephants or mice); (d) QoS classes (e.g., interactive apps and bulky data transfer). The accuracy and quality of classification results depend on the training datasets. However, obtaining standardized and high-quality data that capture the actual traffic of a network is very difficult [6]. Researchers exploit publicly available datasets, generate datasets of the desired traffic through simulations, or collect data from real networks themselves. The traffic classification in SDN has been extensively studied [10; 21]. Among the most important issues explored and solutions proposed, we distinguish the following main categories: application identification, security issues, QoS categories, and network management, including traffic management and resource management. For example, a plethora of researchers have tried to classify SDN network traffic according to the type of application aimed at improving network efficacy and efficiency. [PERSON] et al. [22] used a real-time dataset to assess how efficient ML models (Random Forest (RF), K-Nearest Neighbor (k-NN), Support Vector Machine (SVM), Logistic Regression (LR), Decision Tree (DT), and Naive Bayes (NB)) perform traffic classification in six common internet protocols and services. The DT algorithm is experimentally proven to be the most efficient model, outperforming the others with an accuracy of 99.8%. [PERSON] et al. [23] also applied deep learning methods to classify network traffic into five categories (file transfer, instant messaging, multimedia, VoIP, and attacks). Usingtwo publicly available datasets, namely InSDN and VPN-nonVPN, they applied four RNN algorithms to classify traffic, seeking to enhance QoS and security in SDN. Although the proposed model is distinguished for its efficiency, it suffers from training difficulties and high computational costs. A similar objective was also pursued by [PERSON] et al.