Streaming architecture for real-time traffic classification in software-defined networks

The development of modern network infrastructures is characterized by increasing complexity and diversity of network traffic, presenting new challenges for effective network management and security. Software-defined networks (SDN) offer a paradigm that decouples the control plane from the data plane and enabling centralization of network intelligence, which creates unique opportunities for integrating machine learning-based traffic classification systems. Traditional approaches to network traffic classification face fundamental limitations: restricted traffic visibility due to limited statistics from conventional devices; static rule-based analysis methods ineffective against new application types and attack vectors; inability to perform real-time processing; and lack of standardized interfaces for collecting and analyzing network data, which impedes integration of intelligent systems. The purpose of this study is to develop an architectural approach for collecting and analyzing network data in real time for traffic classification tasks in SDN environments, leveraging the ONOS controller integrated with the Apache Kafka streaming platform. The study examines the integration of the ONOS (Open Network Operating System) controller with the Apache Kafka distributed streaming platform. The OpenFlow Switch Specification version 1.3.5 is analyzed to identify available statistical message types, metrics and asynchronous events suitable as features for machine learning algorithms. An experimental testbed comprising three virtual machines was deployed: an ONOS 2.7 controller, a Mininet 2.3 emulator running a 3-tier hierarchical fat-tree-like topology with 14 OpenFlow switches and 16 hosts, and an Apache Kafka 3.6.1 streaming platform with Apache Spark 3.5. Experimental validation demonstrated an average end-to-end latency of 71 ms (29% below the 100 ms target), with 92% of events processed within 100 ms and the 95th percentile at 128 ms. The system stably processed 174 events per second on average, with peaks reaching 218 events per second. Over 1,252,800 events were collected and transmitted during the 2-hour continuous test with zero data loss. ONOS controller overhead was only 3.7% CPU and 145 MB RAM, confirming a low overhead profile. The proposed integration of ONOS and Apache Kafka provides an effective, scalable, and non-invasive architecture for real-time network traffic data collection in software-defined networks. Basic flow metrics (packet count, byte count, duration) are available with 100% coverage, while higher-layer protocol metrics (IP addresses, ports) achieve 76–87% coverage, which is sufficient for machine learning-based traffic classification tasks.