{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,30]],"date-time":"2026-01-30T06:01:39Z","timestamp":1769752899827,"version":"3.49.0"},"reference-count":47,"publisher":"MDPI AG","issue":"21","license":[{"start":{"date-parts":[[2022,11,2]],"date-time":"2022-11-02T00:00:00Z","timestamp":1667347200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"the National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT)","award":["2020R1A2B5B01001758"],"award-info":[{"award-number":["2020R1A2B5B01001758"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Software-defined networking (SDN) has gained tremendous growth and can be exploited in different network scenarios, from data centers to wide-area 5G networks. It shifts control logic from the devices to a centralized entity (programmable controller) for efficient traffic monitoring and flow management. A software-based controller enforces rules and policies on the requests sent by forwarding elements; however, it cannot detect anomalous patterns in the network traffic. Due to this, the controller may install the flow rules against the anomalies, reducing the overall network performance. These anomalies may indicate threats to the network and decrease its performance and security. Machine learning (ML) approaches can identify such traffic flow patterns and predict the systems\u2019 impending threats. We propose an ML-based service to predict traffic anomalies for software-defined networks in this work. We first create a large dataset for network traffic by modeling a programmable data center with a signature-based intrusion-detection system. The feature vectors are pre-processed and are constructed against each flow request by the forwarding element. Then, we input the feature vector of each request to a machine learning classifier for training to predict anomalies. Finally, we use the holdout cross-validation technique to evaluate the proposed approach. The evaluation results specify that the proposed approach is highly accurate. In contrast to baseline approaches (random prediction and zero rule), the performance improvement of the proposed approach in average accuracy, precision, recall, and f-measure is (54.14%, 65.30%, 81.63%, and 73.70%) and (4.61%, 11.13%, 9.45%, and 10.29%), respectively.<\/jats:p>","DOI":"10.3390\/s22218434","type":"journal-article","created":{"date-parts":[[2022,11,3]],"date-time":"2022-11-03T03:53:07Z","timestamp":1667447587000},"page":"8434","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["A Machine Learning-Based Anomaly Prediction Service for Software-Defined Networks"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5373-8063","authenticated-orcid":false,"given":"Zohaib","family":"Latif","sequence":"first","affiliation":[{"name":"Department of Computer Science, Hanyang University, Seoul 04763, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0237-3025","authenticated-orcid":false,"given":"Qasim","family":"Umer","sequence":"additional","affiliation":[{"name":"Department of Computer Science, COMSATS University Islamabad, Vehari Campus, Vehari 61100, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6564-2392","authenticated-orcid":false,"given":"Choonhwa","family":"Lee","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Hanyang University, Seoul 04763, Korea"}]},{"given":"Kashif","family":"Sharif","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Beijing Institute of Technology, Beijing 100081, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2348-4488","authenticated-orcid":false,"given":"Fan","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Beijing Institute of Technology, Beijing 100081, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6770-9845","authenticated-orcid":false,"given":"Sujit","family":"Biswas","sequence":"additional","affiliation":[{"name":"Computer Science and Digital Technologies Department, University of East London, London E16 2RD, UK"}]}],"member":"1968","published-online":{"date-parts":[[2022,11,2]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1109\/MCOM.2013.6461195","article-title":"Improving Network Management with Software Defined Networking","volume":"51","author":"Kim","year":"2013","journal-title":"IEEE Commun. Mag."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1109\/JPROC.2014.2371999","article-title":"Software-Defined Networking: A Comprehensive Survey","volume":"103","author":"Kreutz","year":"2015","journal-title":"Proc. IEEE"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"102563","DOI":"10.1016\/j.jnca.2020.102563","article-title":"A Comprehensive Survey of Interface Protocols for Software Defined Networks","volume":"156","author":"Latif","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_4","first-page":"133","article-title":"SDN Controllers: A Comprehensive Analysis and Performance Evaluation Study","volume":"53","author":"Zhu","year":"2020","journal-title":"ACM Comput. Surv."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1145\/1355734.1355746","article-title":"OpenFlow: Enabling Innovation in Campus Networks","volume":"38","author":"McKeown","year":"2008","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"331","DOI":"10.1109\/TNSM.2020.3045725","article-title":"DOLPHIN: Dynamically Optimized and Load Balanced Path for Inter-domain SDN Communication","volume":"18","author":"Latif","year":"2020","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"64","DOI":"10.1109\/MWC.001.1900083","article-title":"Software Defined IoT Systems: Properties, State of the Art, and Future Research","volume":"26","author":"Mishra","year":"2019","journal-title":"IEEE Wirel. Commun."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Inayat, U., Zia, M.F., Mahmood, S., Khalid, H.M., and Benbouzid, M. (2022). Learning-Based Methods for Cyber Attacks Detection in IoT Systems: A Survey on Methods, Analysis, and Future Prospects. Electronics, 11.","DOI":"10.3390\/electronics11091502"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Anjum, N., Latif, Z., Lee, C., Shoukat, I.A., and Iqbal, U. (2021). MIND: A Multi-Source Data Fusion Scheme for Intrusion Detection in Networks. Sensors, 21.","DOI":"10.3390\/s21144941"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Zhang, P., Xu, S., Yang, Z., Li, H., Li, Q., Wang, H., and Hu, C. (2018, January 2\u20136). FOCES: Detecting Forwarding Anomalies in Software Defined Networks. Proceedings of the 2018 IEEE 38th International Conference on Distributed Computing Systems (ICDCS), Vienna, Austria.","DOI":"10.1109\/ICDCS.2018.00085"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Wang, P., Chao, K., Lin, H., Lin, W., and Lo, C. (2016, January 4\u20136). An Efficient Flow Control Approach for SDN-Based Network Threat Detection and Migration Using Support Vector Machine. Proceedings of the 2016 IEEE 13th International Conference on e-Business Engineering (ICEBE), Macau, China.","DOI":"10.1109\/ICEBE.2016.020"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Ashraf, J., and Latif, S. (2014, January 11\u201312). Handling intrusion and DDoS Attacks in Software Defined Networks Using Machine Learning Techniques. Proceedings of the 2014 National Software Engineering Conference, Rawalpindi, Pakistan.","DOI":"10.1109\/NSEC.2014.6998241"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"2724","DOI":"10.48084\/etasr.1840","article-title":"A Review of Anomaly Detection Techniques and Distributed Denial of Service (DDoS) on Software Defined Network (SDN)","volume":"8","author":"Hamed","year":"2018","journal-title":"Eng. Technol. Appl. Sci. Res."},{"key":"ref_14","unstructured":"(2022, September 22). Mininet: An Instant Virtual Network on Your Laptop (or Other PC). Available online: http:\/\/www.mininet.org\/."},{"key":"ref_15","unstructured":"Roesch, M. (1999, January 7\u201312). Snort\u2014Lightweight Intrusion Detection for Networks. Proceedings of the 13th USENIX Conference on System Administration, Seattle, WA, USA."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Kausar, N., Latif, Z., Lee, C., and Iqbal, U. (2021, January 20\u201322). Towards Detection and Mitigation of Traffic Anomalies in SDN. Proceedings of the 2021 International Conference on Information and Communication Technology Convergence (ICTC), Jeju Island, Korea.","DOI":"10.1109\/ICTC52510.2021.9621029"},{"key":"ref_17","unstructured":"de la Puerta, J.G., Ferreira, I.G., Bringas, P.G., Klett, F., Abraham, A., de Carvalho, A.C., Herrero, \u00c1., Baruque, B., Quinti\u00e1n, H., and Corchado, E. Packet Header Anomaly Detection Using Statistical Analysis. Proceedings of the International Joint Conference SOCO\u201914-CISIS\u201914-ICEUTE\u201914."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Kim, M., Park, Y., and Kotalwar, R. (2017). Robust and Agile System against Fault and Anomaly Traffic in Software Defined Networks. Appl. Sci., 7.","DOI":"10.3390\/app7030266"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"121","DOI":"10.1016\/j.eswa.2018.03.027","article-title":"An Ecosystem for Anomaly Detection and Mitigation in Software-Defined Networking","volume":"104","author":"Carvalho","year":"2018","journal-title":"Expert Syst. Appl."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"393","DOI":"10.1109\/COMST.2018.2866942","article-title":"A Survey of Machine Learning Techniques Applied to Software Defined Networking (SDN): Research Issues and Challenges","volume":"21","author":"Xie","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Nanda, S., Zafari, F., DeCusatis, C., Wedaa, E., and Yang, B. (2016, January 7\u201310). Predicting Network Attack Patterns in SDN Using Machine Learning Approach. Proceedings of the 2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), Palo Alto, CA, USA.","DOI":"10.1109\/NFV-SDN.2016.7919493"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Abubakar, A., and Pranggono, B. (2017, January 6\u20138). Machine Learning Based Intrusion Detection System for Software Defined Networks. Proceedings of the 2017 Seventh International Conference on Emerging Security Technologies (EST), Canterbury, UK.","DOI":"10.1109\/EST.2017.8090413"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Song, C., Park, Y., Golani, K., Kim, Y., Bhatt, K., and Goswami, K. (August, January 31). Machine-Learning Based Threat-Aware System in Software Defined Networks. Proceedings of the 2017 26th International Conference on Computer Communication and Networks (ICCCN), Vancouver, BC, Canada.","DOI":"10.1109\/ICCCN.2017.8038436"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Hurley, T., Perdomo, J.E., and Perez-Pons, A. (2016, January 18\u201320). HMM-Based Intrusion Detection System for Software Defined Networking. Proceedings of the 2016 15th IEEE International Conference on Machine Learning and Applications (ICMLA), Anaheim, CA, USA.","DOI":"10.1109\/ICMLA.2016.0108"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Ghahramani, Z. (2002). Hidden Markov Models, World Scientific Publishing Co., Inc.. Chapter\u2014An Introduction to Hidden Markov Models and Bayesian Networks.","DOI":"10.1142\/9789812797605_0002"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Santos da Silva, A., Wickboldt, J.A., Granville, L.Z., and Schaeffer-Filho, A. (2016, January 25\u201329). ATLANTIC: A Framework for Anomaly Traffic Detection, Classification, and Mitigation in SDN. Proceedings of the NOMS 2016\u20142016 IEEE\/IFIP Network Operations and Management Symposium, Istanbul, Turkey.","DOI":"10.1109\/NOMS.2016.7502793"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Aleroud, A., and Alsmadi, I. (2016, January 25\u201329). Identifying DoS Attacks on Software Defined Networks: A Relation Context Approach. Proceedings of the NOMS 2016\u20142016 IEEE\/IFIP Network Operations and Management Symposium, Istanbul, Turkey.","DOI":"10.1109\/NOMS.2016.7502914"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Barki, L., Shidling, A., Meti, N., Narayan, D.G., and Mulla, M.M. (2016, January 21\u201324). Detection of Distributed Denial of Service Attacks in Software Defined Networks. Proceedings of the 2016 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Jaipur, India.","DOI":"10.1109\/ICACCI.2016.7732445"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Aslam, M., Ye, D., Tariq, A., Asad, M., Hanif, M., Ndzi, D., Chelloug, S.A., Elaziz, M.A., Al-Qaness, M.A., and Jilani, S.F. (2022). Adaptive Machine Learning Based Distributed Denial-of-Services Attacks Detection and Mitigation System for SDN-Enabled IoT. Sensors, 22.","DOI":"10.3390\/s22072697"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Shinan, K., Alsubhi, K., Alzahrani, A., and Ashraf, M.U. (2021). Machine Learning-Based Botnet Detection in Software-Defined Network: A Systematic Review. Symmetry, 13.","DOI":"10.3390\/sym13050866"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2018, January 25\u201329). Deep Recurrent Neural Network for Intrusion Detection in SDN-Based Networks. Proceedings of the 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, Canada.","DOI":"10.1109\/NETSOFT.2018.8460090"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"El Sayed, M.S., Le-Khac, N.A., Azer, M.A., and Jurcut, A.D. (IEEE Trans. Cogn. Commun. Netw., 2022). A Flow Based Anomaly Detection Approach with Feature Selection Method Against DDoS Attacks in SDNs, IEEE Trans. Cogn. Commun. Netw., Early Access.","DOI":"10.1109\/TCCN.2022.3186331"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Dey, S.K., and Rahman, M.M. (2018, January 13\u201315). Flow Based Anomaly Detection in Software Defined Networking: A Deep Learning Approach with Feature Selection Method. Proceedings of the 2018 4th International Conference on Electrical Engineering and Information Communication Technology (iCEEiCT), Dhaka, Bangladesh.","DOI":"10.1109\/CEEICT.2018.8628069"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Dawoud, A., Shahristani, S., and Raun, C. (2018, January 16\u201318). A Deep Learning Framework to Enhance Software Defined Networks Security. Proceedings of the 2018 32nd International Conference on Advanced Information Networking and Applications Workshops (WAINA), Krakow, Poland.","DOI":"10.1109\/WAINA.2018.00172"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2016, January 26\u201329). Deep Learning Approach for Network Intrusion Detection in Software Defined Networking. Proceedings of the 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), Fez, Morocco.","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"40","DOI":"10.1016\/j.comcom.2021.12.015","article-title":"Graph-based Deep Learning for Communication Networks: A Survey","volume":"185","author":"Jiang","year":"2021","journal-title":"Comput. Commun."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"9310","DOI":"10.1109\/JIOT.2021.3130434","article-title":"Hierarchical Adversarial Attacks Against Graph Neural Network based IoT Network Intrusion Detection System","volume":"9","author":"Zhou","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Lo, W.W., Layeghy, S., Sarhan, M., Gallagher, M., and Portmann, M. (2022, January 25\u201329). E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT. Proceedings of the NOMS 2022\u20142022 IEEE\/IFIP Network Operations and Management Symposium, Budapest, Hungary.","DOI":"10.1109\/NOMS54207.2022.9789878"},{"key":"ref_39","unstructured":"(2022, September 22). Samples of Security Related Data. Available online: https:\/\/www.secrepo.com\/."},{"key":"ref_40","unstructured":"(2022, September 22). iPerf\u2014The Ultimate Speed Test Tool for TCP, UDP and SCTP. Available online: https:\/\/iperf.fr\/."},{"key":"ref_41","unstructured":"(2022, September 22). hping3 Documentation. Available online: http:\/\/hping.org\/documentation.php."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Rao, V., and Sachdev, J. (2017, January 7\u20138). A Machine Learning Approach to Classify News Articles Based on Location. Proceedings of the 2017 International Conference on Intelligent Sustainable Systems (ICISS), Palladam, India.","DOI":"10.1109\/ISS1.2017.8389300"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"35743","DOI":"10.1109\/ACCESS.2018.2850910","article-title":"Emotion Based Automated Priority Prediction for Bug Reports","volume":"6","author":"Umer","year":"2018","journal-title":"IEEE Access"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"46846","DOI":"10.1109\/ACCESS.2019.2909746","article-title":"Deep Neural Network-Based Severity Prediction of Bug Reports","volume":"7","author":"Ramay","year":"2019","journal-title":"IEEE Access"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"347","DOI":"10.1007\/s10515-017-0229-y","article-title":"Automatic Approval Prediction for Software Enhancement Requests","volume":"25","author":"Nizamani","year":"2017","journal-title":"Autom. Softw. Eng."},{"key":"ref_46","unstructured":"(2022, September 22). A Java Based OpenFlow Controller. Available online: www.projectfloodlight.org\/floodlight\/."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Sohrawardi, S.J., Azam, I., and Hosain, S. (October, January 29). A Comparative Study of Text Classification Algorithms on User Submitted Bug Reports. Proceedings of the Ninth International Conference on Digital Information Management (ICDIM 2014), Phitsanulok, Thailand.","DOI":"10.1109\/ICDIM.2014.6991434"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/21\/8434\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:09:22Z","timestamp":1760144962000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/21\/8434"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,2]]},"references-count":47,"journal-issue":{"issue":"21","published-online":{"date-parts":[[2022,11]]}},"alternative-id":["s22218434"],"URL":"https:\/\/doi.org\/10.3390\/s22218434","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,11,2]]}}}