AI-Enhanced Anomaly Detection in Software-Defined Networks

The advent of Software-Defined Networks (SDN) introduces centralized management, enabling scalability to support a significantly larger number of devices than traditional networks. However, this scalability generates extensive monitoring data, necessitating advanced analysis techniques. This research focuses on utilizing Artificial Intelligence (AI) in the SDN paradigm to enhance anomaly detection. A systematic literature review identified current challenges and opportunities in this domain. Based on these insights, a reference architecture was developed, integrating advanced features such as dynamic sliding windows for training optimization, a standardized ubiquitous data model, and separation of concerns (SoC) leveraging industry-standard frameworks like eTOM and SID. The architecture emphasizes interpretability through explainable AI (XAI), scalability via microservices, and resilience with a distributed SDN controller. Adversarial sample generation was incorporated to strengthen anomaly detection models. A proof of concept validated the architecture's feasibility, demonstrating successful anomaly detection and remediation across varying business scenarios. This study highlights the adaptability of AI models for specific anomaly types and underscores the potential of this architecture in automating large-scale network management, enhancing security, and increasing resilience.