{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T18:15:36Z","timestamp":1771611336751,"version":"3.50.1"},"reference-count":42,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T00:00:00Z","timestamp":1706745600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Nature Science Foundation of China","doi-asserted-by":"publisher","award":["61962016"],"award-info":[{"award-number":["61962016"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Nature Science Foundation of China","doi-asserted-by":"publisher","award":["G2022033002L"],"award-info":[{"award-number":["G2022033002L"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Nature Science Foundation of China","doi-asserted-by":"publisher","award":["2022JJA170057"],"award-info":[{"award-number":["2022JJA170057"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Nature Science Foundation of China","doi-asserted-by":"publisher","award":["2023ky0812"],"award-info":[{"award-number":["2023ky0812"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Ministry of Science and Technology of China","award":["61962016"],"award-info":[{"award-number":["61962016"]}]},{"name":"Ministry of Science and Technology of China","award":["G2022033002L"],"award-info":[{"award-number":["G2022033002L"]}]},{"name":"Ministry of Science and Technology of China","award":["2022JJA170057"],"award-info":[{"award-number":["2022JJA170057"]}]},{"name":"Ministry of Science and Technology of China","award":["2023ky0812"],"award-info":[{"award-number":["2023ky0812"]}]},{"name":"National Nature Science Foundation of Guangxi","award":["61962016"],"award-info":[{"award-number":["61962016"]}]},{"name":"National Nature Science Foundation of Guangxi","award":["G2022033002L"],"award-info":[{"award-number":["G2022033002L"]}]},{"name":"National Nature Science Foundation of Guangxi","award":["2022JJA170057"],"award-info":[{"award-number":["2022JJA170057"]}]},{"name":"National Nature Science Foundation of Guangxi","award":["2023ky0812"],"award-info":[{"award-number":["2023ky0812"]}]},{"name":"Guangxi Education Department","award":["61962016"],"award-info":[{"award-number":["61962016"]}]},{"name":"Guangxi Education Department","award":["G2022033002L"],"award-info":[{"award-number":["G2022033002L"]}]},{"name":"Guangxi Education Department","award":["2022JJA170057"],"award-info":[{"award-number":["2022JJA170057"]}]},{"name":"Guangxi Education Department","award":["2023ky0812"],"award-info":[{"award-number":["2023ky0812"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Accurately and efficiently predicting elephant flows (elephants) is crucial for optimizing network performance and resource utilization. Current prediction approaches for software-defined networks (SDNs) typically rely on complete traffic and statistics moving from switches to controllers. This leads to an extra control channel bandwidth occupation and network delay. To address this issue, this paper proposes a prediction strategy based on incomplete traffic that is sampled by the timeouts for the installation or reactivation of flow entries. The strategy involves assigning a very short hard timeout (Tinitial) to flow entries and then increasing it at a rate of r until flows are identified as elephants or out of their lifespans. Predicted elephants are switched to an idle timeout of 5 s. Logistic regression is used to model elephants based on a complete dataset. Bayesian optimization is then used to tune the trained model Tinitial and r over the incomplete dataset. The process of feature selection, model learning, and optimization is explained. An extensive evaluation shows that the proposed approach can achieve over 90% generalization accuracy over 7 different datasets, including campus, backbone, and the Internet of Things (IoT). Elephants can be correctly predicted for about half of their lifetime. The proposed approach can significantly reduce the controller\u2013switch interaction in campus and IoT networks, although packet completion approaches may need to be applied in networks with a short mean packet inter-arrival time.<\/jats:p>","DOI":"10.3390\/s24030963","type":"journal-article","created":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T09:43:22Z","timestamp":1706780602000},"page":"963","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Explainable Learning-Based Timeout Optimization for Accurate and Efficient Elephant Flow Prediction in SDNs"],"prefix":"10.3390","volume":"24","author":[{"given":"Ling Xia","family":"Liao","sequence":"first","affiliation":[{"name":"School of Electronic Information and Automation, Guilin University of Aerospace Technology, Guilin 541004, China"}]},{"given":"Changqing","family":"Zhao","sequence":"additional","affiliation":[{"name":"School of Electronic Information and Automation, Guilin University of Aerospace Technology, Guilin 541004, China"}]},{"given":"Roy Xiaorong","family":"Lai","sequence":"additional","affiliation":[{"name":"Confederal Networks Inc., Seattle, WA 98055, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3222-1708","authenticated-orcid":false,"given":"Han-Chieh","family":"Chao","sequence":"additional","affiliation":[{"name":"Department of Artificial Intelligence, Tamkang University, New Taipei City 251301, Taiwan"},{"name":"Department of Electrical Engineering, National Dong Hwa University, Hualien 974301, Taiwan"},{"name":"Institute of Computer Science and Innovation, UCSI University, Kuala Lumpur 56000, Malaysia"}]}],"member":"1968","published-online":{"date-parts":[[2024,2,1]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"2064","DOI":"10.1109\/COMST.2021.3102580","article-title":"Leveraging deep reinforcement learning for traffic engineering: A survey","volume":"23","author":"Xiao","year":"2021","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"64","DOI":"10.1016\/j.jpdc.2020.07.008","article-title":"Intelligently modeling, detecting, and scheduling elephant flows in software defined energy cloud: A survey","volume":"146","author":"Liao","year":"2020","journal-title":"J. Parallel Distrib. Comput."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"72585","DOI":"10.1109\/ACCESS.2020.2987977","article-title":"Flow-aware elephant flow detection for software-defined networks","volume":"8","author":"Hamdan","year":"2020","journal-title":"IEEE Access"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Xie, S., Hu, G., Xing, C., and Liu, Y. (2023). Online Elephant Flow Prediction for Load Balancing in Programmable Switch Based DCN. IEEE Trans. Netw. Serv. Manag.","DOI":"10.1109\/TNSM.2023.3318752"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"185","DOI":"10.1016\/j.comnet.2017.04.026","article-title":"Minnie: An SDN world with few compressed forwarding rules","volume":"121","author":"Rifai","year":"2017","journal-title":"Comput. Netw."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Isyaku, B., Mohd Zahid, M.S., Bte Kamat, M., Abu Bakar, K., and Ghaleb, F.A. (2020). Software defined networking flow table management of openflow switches performance and security challenges: A survey. Future Internet, 12.","DOI":"10.3390\/fi12090147"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Zhu, H., Fan, H., Luo, X., and Jin, Y. (2015, January 11\u201315). Intelligent timeout master: Dynamic timeout for SDN-based data centers. In Proceeding of the 2015 IFIP\/IEEE International Symposium on Integrated Network Management, Ottawa, ON, Canada.","DOI":"10.1109\/INM.2015.7140363"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Zhang, L., Wang, S., Xu, S., Lin, R., and Yu, H. (2015, January 6\u201310). TimeoutX: An adaptive flow table management method in software defined networks. In Proceeding of 2015 IEEE Global Communications Conference, San Diego, CA, USA.","DOI":"10.1109\/GLOCOM.2015.7417563"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Sooden, B., and Abbasi, M.R. (2018, January 15\u201317). A dynamic hybrid timeout method to secure flow tables against DDoS attacks in SDN. In Proceeding of THE 1st IEEE International Conference on Secure Cyber Computing and Communication, Jalandhar, India.","DOI":"10.1109\/ICSCCC.2018.8703307"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"153","DOI":"10.1109\/TNSM.2018.2890754","article-title":"HQTimer: A hybrid Q-Learning-Based timeout mechanism in software-defined networks","volume":"16","author":"Li","year":"2019","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Panda, A., Samal, S.S., Turuk, A.K., Panda, A., and Venkatesh, V.C. (2019, January 30\u201331). Dynamic hard timeout based flow table management in openflow enabled SDN. In Proceeding of the IEEE International Conference on Vision Towards Emerging Trends in Communication and Networking, Vellore, India.","DOI":"10.1109\/ViTECoN.2019.8899359"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Isyaku, B., Bakar, K.A., Zahid, M.S.M., and Nura Yusuf, M. (2020). Adaptive and hybrid idle\u2013hard timeout allocation and flow eviction mechanism considering traffic characteristics. Electronics, 9.","DOI":"10.3390\/electronics9111983"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Li, X., and Qian, C. (May, January 26). Low-complexity multi-resource packet scheduling for network function virtualization. In Proceeding of the 2015 IEEE Conference on Computer Communications, Hong Kong, China.","DOI":"10.1109\/INFOCOM.2015.7218517"},{"key":"ref_14","unstructured":"Pan, T., Guo, X., Zhang, C., Jiang, J., Wu, H., and Liuy, B. (2012, January 25\u201330). Tracking millions of flows in high speed networks for application identification. In Proceeding of the IEEE INFOCOM, Orlando, FL, USA."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1145\/1129582.1129589","article-title":"Traffic classification on the fly","volume":"36","author":"Bernaille","year":"2006","journal-title":"ACM SIGCOMM Comput. Commun. Rev."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"252","DOI":"10.1016\/j.neucom.2014.12.053","article-title":"Effective packet number for early stage internet traffic identification","volume":"156","author":"Peng","year":"2015","journal-title":"Neurocomputing"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Curtis, A.R., Kim, W., and Yalagandula, P. (2011, January 10\u201315). Mahout: Low-overhead datacenter traffic management using end-host-based elephant detection. Proceedings of the IEEE INFOCOM, Shanghai, China.","DOI":"10.1109\/INFCOM.2011.5934956"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Zhao, M., Li, M., Mei, L., and Tian, Y. (2018, January 15\u201317). Flowwatcher: Adaptive flow counting for source routing over protocol independent sdn networks. In Proceeding of the 8th International Conference on Electronics Information and Emergency Communication, Beijing, China.","DOI":"10.1109\/ICEIEC.2018.8473501"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Wang, B., Su, J., Li, J., and Han, B. (2017, January 18\u201320). EffiView: Trigger-based monitoring approach with low cost in SDN. Proceedings of the IEEE 19th International Conference on High Performance Computing and Communications; IEEE 15th International Conference on Smart City; IEEE 3rd International Conference on Data Science and Systems, Bangkok, Thailand.","DOI":"10.1109\/HPCC-SmartCity-DSS.2017.41"},{"key":"ref_20","first-page":"89","article-title":"Hedera: Dynamic flow scheduling for data center networks","volume":"10","author":"Radhakrishnan","year":"2010","journal-title":"Nsdi"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"AlGhadhban, A., and Shihada, B. (2018, January 2\u20136). FLight: A fast and lightweight elephant-flow detection mechanism. In Proceeding of the IEEE 38th International Conference on Distributed Computing Systems, Vienna, Austria.","DOI":"10.1109\/ICDCS.2018.00161"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Curtis, A.R., Mogul, J.C., Tourrilhes, J., Yalagandula, P., Sharma, P., and Banerjee, S. (2011, January 15\u201319). DevoFlow: Scaling flow management for high-performance networks. Proceedings of the ACM SIGCOMM 2011 Conference, Toronto, ON, Canada.","DOI":"10.1145\/2018436.2018466"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Mori, T., Uchida, M., Kawahara, R., Pan, J., and Goto, S. (2004, January 25\u201327). Identifying elephant flows through periodically sampled packets. Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, Taormina, Italy.","DOI":"10.1145\/1028788.1028803"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"189","DOI":"10.9717\/kmms.2015.18.2.189","article-title":"Large Flows Detection, Marking, and Mitigation based on sFlow Standard in SDN","volume":"18","author":"Afaq","year":"2015","journal-title":"J. Korea Multimed. Soc."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.comnet.2018.02.018","article-title":"Detecting heavy flows in the SDN match and action model","volume":"136","author":"Afek","year":"2018","journal-title":"Comput. Netw."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Xiao, P., Qu, W., Qi, H., Xu, Y., and Li, Z. (2015, January 2\u20134). An efficient elephant flow detection with cost-sensitive in SDN. In Proceeding of the 1st International Conference on Industrial Networks and Intelligent Systems, Tokyo, Japan.","DOI":"10.4108\/icst.iniscom.2015.258274"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"64533","DOI":"10.1109\/ACCESS.2018.2877686","article-title":"DROM: Optimizing the Routing in Software-Defined Networks with Deep Reinforcement Learning","volume":"6","author":"Yu","year":"2018","journal-title":"IEEE Access"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3281032","article-title":"SDN flow entry management using reinforcement learning","volume":"13","author":"Mu","year":"2018","journal-title":"ACM Trans. Auton. Adapt. Syst."},{"key":"ref_29","unstructured":"Yang, H., and Riley, G.F. (August, January 30). Machine learning based flow entry eviction for OpenFlow switches. In Proceeding of the 27th International Conference on Computer Communication and Networks, Hangzhou, China."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Cheng, T., Wang, K., Wang, L.C., and Lee, C.W. (2018, January 20\u201324). An in-switch rule caching and replacement algorithm in software defined networks. In Proceeding of the IEEE International Conference on Communications, Kansas City, MO, USA.","DOI":"10.1109\/ICC.2018.8422992"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Glick, M., and Rastegarfar, H. (2017, January 10\u201312). Scheduling and control in hybrid data centers. In Proceeding of the IEEE Photonics Society Summer Topical Meeting Series, San Juan, PR, USA.","DOI":"10.1109\/PHOSST.2017.8012677"},{"key":"ref_32","unstructured":"Rossi, D., and Valenti, S. (July, January 28). Fine-grained traffic classification with netflow data. Proceedings of the 6th International Wireless Communications and Mobile Computing Conference, Caen, France."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Kannan, K., and Banerjee, S. (2014, January 4\u20137). Flowmaster: Early eviction of dead flow on sdn switches. In Proceeding of the 15th International Conference on Distributed Computing and Networking, Coimbatore, India.","DOI":"10.1007\/978-3-642-45249-9_32"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"377","DOI":"10.1109\/JSAC.2019.2959184","article-title":"Stereos: Smart table entry eviction for openflow switches","volume":"38","author":"Yang","year":"2019","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"98","DOI":"10.1109\/MNET.011.2000353","article-title":"B5G and explainable deep learning assisted healthcare vertical at the edge: COVID-I9 perspective","volume":"34","author":"Rahman","year":"2020","journal-title":"IEEE Netw."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"4738","DOI":"10.1109\/ACCESS.2020.3048348","article-title":"Explaining deep learning-based traffic classification using a genetic algorithm","volume":"9","author":"Ahn","year":"2020","journal-title":"IEEE Access"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Sarica, A.K., and Angin, P. (2020). Explainable security in SDN-based IoT networks. Sensors, 20.","DOI":"10.3390\/s20247326"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"6634811","DOI":"10.1155\/2021\/6634811","article-title":"Explainable artificial intelligence (XAI) to enhance trust management in intrusion detection systems using decision tree model","volume":"2021","author":"Mahbooba","year":"2021","journal-title":"Complexity"},{"key":"ref_39","unstructured":"Barbosa, R.R.R., Sadre, R., Pras, A., and van de Meent, R. (2010). Centre for Telematics and Information Technology, University of Twente."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1145\/1568613.1568616","article-title":"On the stability of the information carried by traffic flow features at the packet level","volume":"39","author":"Este","year":"2009","journal-title":"ACM SIGCOMM Comput. Commun. Rev."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Benson, T., Akella, A., and Maltz, D.A. (2010, January 1\u20133). Network Traffic Characteristics of Data Centers in the Wild. Proceedings of the 10th Conference on Internet Measurement, ACM, Melbourne, Australia.","DOI":"10.1145\/1879141.1879175"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"1745","DOI":"10.1109\/TMC.2018.2866249","article-title":"Classifying IoT devices in smart environments using network traffic characteristics","volume":"18","author":"Sivanathan","year":"2018","journal-title":"IEEE Trans. Mob. Comput."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/24\/3\/963\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T13:53:19Z","timestamp":1760104399000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/24\/3\/963"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,2,1]]},"references-count":42,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2024,2]]}},"alternative-id":["s24030963"],"URL":"https:\/\/doi.org\/10.3390\/s24030963","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,2,1]]}}}