Pith. sign in

REVIEW 4 major objections 6 minor 49 references

ZT-SDN: An ML-powered Zero-Trust Architecture for Software-Defined Networks

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ZT-SDN claims that an SDN network can teach itself zero-trust policy by learning each application's benign traffic profile, generating least-privilege rules from it, and detecting abuse of permitted flows, with 100% accuracy in tests.

desk verdict A genuine end-to-end zero-trust SDN pipeline that is undermined by its own proactive rule association, which breaks the paper's per-request access control claim. read the letter →

arxiv 2411.15020 v1 pith:IPKMKDWT submitted 2024-11-22 cs.CR

Charalampos Katsis , Elisa Bertino This is my paper · ORCID
classification cs.CR
keywords zerotrustsoftware-definednetworkingnetworkaccesscontrolunsupervisedanomalydetectionautoencoderensembleassociationruleminingflowgenerationdynamictimewarping
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ZT-SDN is an attempt to make zero-trust networking deployable without a human writing the policy. The paper's claim is that an SDN controller can watch ordinary network traffic during a training phase, learn for each application which services it talks to and over which protocol stacks, and automatically generate access-control rules that allow exactly those communications. It further claims to learn the typical packet-header shapes and the typical data-transmission rates of each permitted flow, so that a request with unexpected headers or a flow that suddenly sends too much, too little, or in an unusual shape is recognized and terminated. To cover organizations that cannot guarantee a clean training network, the paper also proposes an offline gym in which applications are run under controlled conditions to generate benign datasets. On real transit-link traces and emulated SDN topologies, the evaluation reports 100% detection accuracy across the tested normal, abnormal-benign, and malicious cases, plus fewer controller roundtrips than reactive forwarding.

What carries the argument

The communication requirements (CR) graph: a directed graph whose nodes are applications and services on hosts and whose edges record the protocol stack used for each network transaction, e.g., ETHERNET_IP_TCP. Each edge is the unit of least privilege: it seeds the packet-header dataset for the autoencoder ensemble that authorizes individual access requests, the flow-statistics time series for the dynamic-time-warping model that monitors ongoing transmissions, and the binary tables from which association-rule mining derives flow rules and their pairwise associations. The graph is what converts raw, unlabeled traffic into per-entity policy and behavior baselines.

What would settle it

Train ZT-SDN on a trace that interleaves a known attack (for example, port scanning) with benign HTTP, then check whether the access-request model accepts new scanning packets as normal; separately, train on a benign application that uses two ports and test with the second port's legitimate request. If either test passes the attack or blocks the legitimate flow, the benign-and-complete training assumption fails.

Watch

Extended reading notes

Core claim

On its own terms, the paper's core discovery is that zero-trust enforcement can be bootstrapped from observed traffic alone. The communication requirements graph turns raw packets into directed edges representing legitimate transactions, and each edge carries three learned artifacts: an autoencoder ensemble that learns the benign distribution of packet-header fields, a dynamic-time-warping model on first-order-differenced packet and byte counts that learns how the permitted flow is used over time, and high-confidence association rules mined from binarized header-value pairs. These artifacts let the framework authorize each request against the learned header distribution, monitor active flows for behavioral deviation, and deploy complete rule sets proactively because related rules are known to co-occur. The stated experimental result is 100% accuracy in distinguishing normal benign packets from both abnormal benign and malicious packets, with the flow monitor flagging deviations within the first minutes of a flow and no throughput degradation compared with baseline reactive forwarding.

Load-bearing premise

The load-bearing premise, acknowledged in the threat model (Section 4.2) and in the rule-completeness discussion (Section 9), is that everything seen during training is benign and that the training window reveals every legitimate communication pattern; if a compromised host contributes traffic during training, or a benign application later uses a rarely seen port or protocol, the learned model will treat the attack as normal or deny the legitimate flow.

Editorial extensions

If this is right

  • Zero-trust policies can be derived automatically from traffic, removing the manual rule-authoring step that the paper identifies as the main obstacle to adoption.
  • Because rules are mined with high support and confidence and installed proactively along with correlated rules, deployments see fewer PACKET_IN events and half the flow rules per switch compared with reactive forwarding.
  • The same per-edge models that block unauthorized requests also catch behavior changes inside permitted flows, including other benign applications that use a permission differently.
  • Organizations with untrusted training environments can use the offline gym to generate benign datasets for the same applications, making the framework applicable when clean live traffic is unavailable.
  • The monitor tolerates substantial network changes before and after training: at least 64% bandwidth reduction without false alarms, and delay/jitter robustness for UDP flows.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the learned rules and models encode a snapshot of an application version; OS patches or application updates that change TTL, window sizes, or port usage would require retraining or a drift-handling mechanism.
  • An extension the authors do not develop is using the same communication requirements graph to generate human-readable policy summaries or to diff expected versus observed communication requirements after software upgrades.
  • Beyond the reported setup, a natural test is training the behavior model on one application's traffic across several network paths and measuring how much path-induced jitter is needed before false positives appear.
  • The per-edge architecture also suggests that the same recipe could run at endpoint granularity when per-application instrumentation is unavailable, trading policy precision for deployment ease.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes ZT-SDN, an end-to-end zero-trust architecture for software-defined networks. The system learns benign communication patterns from network traffic, models them as a communication-requirements graph, and uses two unsupervised ML modules (ARL, based on an autoencoder ensemble, and RTFSL, based on time-series comparison) to authorize access requests and detect behavioral deviations. It also introduces RGAM, which automatically mines access-control rules using association-rule mining and identifies strong associations between rules so that they can be proactively deployed in switches. A separate offline environment, ZT-Gym, is presented for generating benign training data when online learning is not safe. The evaluation uses MAWI traffic from different periods and Mininet experiments to claim 100% access-request accuracy, effective detection of anomalous benign and malicious flows, robustness to network changes, and scalability without throughput degradation.

Significance. If the claims were fully validated, ZT-SDN would address a real barrier to Zero Trust adoption by automating the otherwise manual and error-prone tasks of learning communication requirements, generating access-control rules, and profiling benign behavior. The paper describes a complete pipeline, evaluates on real traffic traces from different time periods, and is explicit about the threat model and the need for benign training data. However, the current evidence is not sufficient to support the strong empirical claims, and the enforcement design conflicts with the paper's central per-request, least-privilege guarantee. The work is therefore best seen as a promising architecture that requires substantial further validation and security analysis before publication in a peer-reviewed venue.

major comments (4)
  1. [Sec. 9 and Sec. 6 (Enforcement mode)] The proactive deployment of strongly associated rules contradicts the paper's repeated claim of per-request access control and least privilege. Section 9 states that 'when a rule is scheduled for deployment based on an access request, it is efficient to deploy all strongly associated rules proactively,' and Section 6 confirms that after one successful verification the CSM 'proactively deploys them across all switches between the source and the destination.' Once these rules are installed, matching packets are forwarded by the switches without consulting the controller or the ARL module. Thus a single authorized request (e.g., the TCP authentication flow in the Figure 2 example) opens all associated rules (e.g., the UDP content flow) for the idle timeout (default 10 s), allowing a compromised host to use permitted channels without per-request authorization. The paper should either alter the design so that each rule is authorized before it can forward traffic, or provide a security analysis that quantifies the exposure created by proactive deployment. The current evaluation in Section 11.5 measures only the roundtrip savings from proactive deployment and does not assess this security cost.
  2. [Sec. 11.1, Tables 2-4] The ARL evaluation reports 100% accuracy with no error bars, repeated trials, or statistical tests. The anomaly thresholds and validation scores are fitted to training and validation data (e.g., the 'Max validation score' reported for each training dataset), so the perfect TN/TP results are partly a consequence of threshold selection rather than independent generalization. For example, in Table 2 every tested cell has exactly zero false positives and zero false negatives, and the reported minimum/maximum RMSE values for anomalous traffic are orders of magnitude larger than the validation threshold, which suggests the thresholds separate the classes so cleanly that the '100%' figures are not informative about robustness. The paper should report standard classification metrics (precision, recall, F1, and ideally ROC/AUC), provide confidence intervals or results over multiple threshold settings, and use a held-out period that was not used for threshold tuning.
  3. [Sec. 11.3, Figs. 8-13] The RTFSL evaluation is presented only as qualitative plots of DTW distance over time, and the claim that anomalies are detected 'before the sliding window begins' is based on visual inspection of those plots. No quantitative metrics such as detection rate, false-positive rate, or detection delay are reported, and the choice of window size (70 or 90 samples) and Euclidean-distance anomaly threshold (0.8) is not justified with a sensitivity analysis. Because the module is a central part of the zero-trust enforcement story, the evaluation needs to provide numbers: false-positive rate on unseen benign flows from the same edge, detection delay in samples/seconds for each attack type, and the effect of window size and threshold on the tradeoff between detection speed and false alarms.
  4. [Sec. 9, Rule Generator] The claim that the generated rules are 'correct' because they have high support (90%) and confidence (100%) is not fully supported. Association-rule metrics only capture co-occurrence in the training data; they do not establish that the resulting predicates are necessary or sufficient for the application's legitimate communication, and the section itself concedes that completeness is not guaranteed. Moreover, the fallback path that dynamically creates a proprietary rule for an authorized packet that matches no learned rule does so without applying the support/confidence criteria, so its security properties are unclear. The paper should either define correctness in a way that is testable and evaluate the generated rules against the intended policy, or weaken the 'correct rules' phrasing to 'consistent with observed benign traffic.'
minor comments (6)
  1. [Sec. 11.4] The text refers to 'Fugures 12 and 13'; this should be 'Figures 12 and 13.'
  2. [Sec. 9] The sentence 'This module, therefore, generates only possitive rules' contains a typo: 'possitive' should be 'positive.'
  3. [Algorithm 2, line 8] In the pseudocode, '𝑠𝑡𝑒𝑎𝑚.𝑛𝑜 _𝑝𝑎𝑐𝑘𝑒𝑡𝑠' should be '𝑠𝑡𝑟𝑒𝑎𝑚.𝑛𝑜 _𝑝𝑎𝑐𝑘𝑒𝑡𝑠.'
  4. [Sec. 11, RQ3] The research question says 'adheres to the leaned benign behavior'; 'leaned' should be 'learned.'
  5. [Table 3] Several cells have missing TN counts (e.g., the first data row, columns '2018 HTTP 3 (TCP)' and '2024 HTTP 1 (TCP)'), which makes it difficult to verify the reported 100% accuracy figures; the table should be completed consistently.
  6. [Sec. 11.5, Table 6] The processing-time comparison aggregates control-plane and ML inference time, but it does not break down how much time is spent in the CSM versus the ARL/RTFSL modules; reporting these separately would make the scalability claim easier to interpret.

Circularity Check

1 steps flagged · score 4.0 of 10

Partial circularity: RGAM defines rule 'correctness' by support/confidence over the same training data from which the rules are mined; ARL/RTFSL evaluations are otherwise on unseen data.

  1. self definitional [Section 9, 'Rule Generator and Association Miner Module', Eqs. (4)-(5) and Algorithm 2]
    "Subsequently, ZT-SDN identifies the most extensive set of feature-value pairs that can collectively constitute the rule with the highest association measure (e.g., 100%). As a result, the constructed rules are correct, as each header-value pair strongly associates with the rest of the pairs in the dataset (addressing C3). ... The generated rules are considered correct due to the use of high support and confidence scores."

    The claimed property 'correct' is defined as 'each header-value pair strongly associates with the rest of the pairs in the dataset,' and the association measures used (support in Eq. 4, confidence in Eq. 5) are computed over exactly the training dataset from which Algorithm 2 mines rules via Apriori. Thus a rule is 'correct' by construction whenever it is frequent and confident in its own input; no independent ground truth of correct access, such as required application communications, is consulted. The paper itself admits that completeness is not guaranteed and that infrequent flows may yield no rule, confirming that the output is a descriptive summary of observed traffic rather than a derivation of correctness from something outside the input.

full rationale

The paper's end-to-end pipeline is not, as a whole, circular: the ARL and RTFSL modules are trained on MAWI and Mininet data and tested on unseen traffic from different periods, and the scalability comparison is against ONOS's reactive forwarding baseline. The self-citations (NEUTRON [24], and [23]) appear as related work and problem motivation only, and no load-bearing uniqueness theorem is imported from the authors' prior work. The one genuinely circular move is in RGAM: 'correct' access-control rules are defined as header-value sets with high support and confidence, where support and confidence (Eqs. 4-5) are computed over the same training dataset from which Apriori mines the rules. Correctness is therefore an internal, self-referential property of the input rather than an externally validated property; the paper itself notes that completeness is not guaranteed. This weakens the strength of the rule-generation contribution but does not invalidate the anomaly-detection evaluations, which retain independent content. The score of 4 reflects that the central rule-correctness claim reduces to its input by definition, while the rest of the framework is evaluated against external data and baselines.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The framework's performance depends on several hand-picked thresholds and assumptions about benign training data. There are no invented physical or conceptual entities; the CR graph is a modeling construct, not a postulated entity. The key free parameters are ML hyperparameters and anomaly thresholds, all fitted to validation data.

free parameters (6)
  • ARL reconstruction error thresholds (training and validation) = 0.009 and 0.05
    Used to stop training and to set the anomaly threshold; chosen per edge based on validation data (Section 7).
  • RTFSL Euclidean distance anomaly threshold = 0.8
    Hand-picked threshold for DTW distance; detection results depend on it (Section 8, Section 11.3).
  • RTFSL sliding window size = 70 for UDP, 90 for TCP
    Hand-picked window lengths for flow statistics; no sensitivity analysis provided (Section 11.3).
  • Apriori minimum support and confidence = 90% and 100%
    Chosen for rule generation and association mining; affects rule cardinality and completeness (Section 9).
  • Minimum training samples = 20K for ARL, 150 for RTFSL
    User-provided heuristics to stop training; influence model maturity (Sections 7, 8).
  • KitNet feature mapping samples = 200
    Hyperparameter taken from the original KitNet model (Section 7).
assumptions (4)
  • domain assumption All traffic observed during training is benign.
    Section 4.2: 'Throughout the ML training phase, it is crucial that the host applications running are not compromised.' If this fails, learned models and rules encode attack behavior.
  • domain assumption The control plane and data plane devices are never compromised.
    Section 4.2 states this explicitly. If a switch or controller is compromised, the framework's enforcement can be bypassed.
  • domain assumption Observed traffic covers all legitimate communication patterns for each entity.
    Section 9 admits that infrequent flows may be missed by rule generation, requiring dynamic rule creation at request time. The training window must be representative.
  • domain assumption Port-to-application mapping via SpeedGuide is accurate.
    Section 11.1 infers application types from MAWI traffic using the SpeedGuide database. Mismapping could mislabel training and test data.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ZT-SDN: An ML-powered Zero-Trust Architecture for Software-Defined Networks." pith.science (2026). https://pith.science/paper/IPKMKDWT

@misc{pith2026241115020,
  author       = {Pith},
  title        = {Pith review of: ZT-SDN: An ML-powered Zero-Trust Architecture for Software-Defined Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IPKMKDWT}},
  note         = {Machine review of arXiv:2411.15020}
}
read the original abstract

Zero Trust (ZT) is a security paradigm aiming to curtail an attacker's lateral movements within a network by implementing least-privilege and per-request access control policies. However, its widespread adoption is hindered by the difficulty of generating proper rules due to the lack of detailed knowledge of communication requirements and the characteristic behaviors of communicating entities under benign conditions. Consequently, manual rule generation becomes cumbersome and error-prone. To address these problems, we propose ZT-SDN, an automated framework for learning and enforcing network access control in Software-Defined Networks. ZT-SDN collects data from the underlying network and models the network "transactions" performed by communicating entities as graphs. The nodes represent entities, while the directed edges represent transactions identified by different protocol stacks observed. It uses novel unsupervised learning approaches to extract transaction patterns directly from the network data, such as the allowed protocol stacks and port numbers and data transmission behavior. Finally, ZT-SDN uses an innovative approach to generate correct access control rules and infer strong associations between them, allowing proactive rule deployment in forwarding devices. We show the framework's efficacy in detecting abnormal network accesses and abuses of permitted flows in changing network conditions with real network datasets. Additionally, we showcase ZT-SDN's scalability and the network's performance when applied in an SDN environment.

Figures

Figures reproduced from arXiv: 2411.15020 by the authors.

Figure 1
Figure 1. The ZT-SDN architecture. 4.1 Architecture Overview ZT-SDN has three modules (see [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. An example of a simple communication requirements graph. [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Rule deployment for traffic collection and forwarding. The notation is [matching packet headers]:[List of forwarding interfaces]. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: The model training procedure for each CR graph edge. [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Transformation of the packet time series, (a), to the first order difference representation, (b). [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: RTFSL rolling window [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: The ZT-Gym environment [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: RTFSL module evaluation results for the UDP-based flows. [PITH_FULL_IMAGE:figures/full_fig_p024_8.png]
Figure 9
Figure 9. Figure 9: RTFSL module evaluation results for the UDP-based flows (continued). [PITH_FULL_IMAGE:figures/full_fig_p025_9.png]
Figure 10
Figure 10. Figure 10: RTFSL module evaluation results for the TCP-based flows. [PITH_FULL_IMAGE:figures/full_fig_p026_10.png]
Figure 11
Figure 11. Figure 11: RTFSL module evaluation results for the TCP-based flows (continued). [PITH_FULL_IMAGE:figures/full_fig_p027_11.png]
Figure 12
Figure 12. Figure 12: RTFSL module evaluation results on different training and enforcement network conditions for the TCP-based flows. [PITH_FULL_IMAGE:figures/full_fig_p027_12.png]
Figure 13
Figure 13. Figure 13: RTFSL module evaluation results on different training and enforcement network conditions for the UDP-based flows. [PITH_FULL_IMAGE:figures/full_fig_p028_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 47 canonical work pages

  1. [1]

    [n. d.]. tc(8) — Linux manual page . https://man7.org/linux/man-pages/man8/tc.8.html

    work page

  2. [2]

    OpenFlow Switch Specification (version 1.5.1)

    2015. OpenFlow Switch Specification (version 1.5.1) . Technical Report. Open Networking Foundation

    work page 2015

  3. [3]

    Zakaria Abou El Houda, Abdelhakim Senhaji Hafid, and Lyes Khoukhi. 2021. A novel machine learning framework for advanced attack detection using sdn. In 2021 IEEE Global Communications Conference (GLOBECOM) . IEEE, 1–6

    work page 2021

  4. [4]

    Rakesh Agarwal, Ramakrishnan Srikant, et al. 1994. Fast algorithms for mining association rules. In Proc. of the 20th VLDB Conference , Vol. 487. 499

    work page 1994

  5. [5]

    Michael Prokop Alexey Kuznetsov. [n. d.]. ss(8) — Linux manual page. Linux Documentation ([n. d.])

    work page

  6. [6]

    Iffat Anjum, Daniel Kostecki, Ethan Leba, Jessica Sokal, Rajit Bharambe, William Enck, Cristina Nita-Rotaru, and Bradley Reaves. 2022. Removing the reliance on perimeters for security using network views. InProceedings of the 27th ACM on Symposium on Access Control Models and Technologies . 151–162

    work page 2022

  7. [7]

    Iffat Anjum, Jessica Sokal, Hafiza Ramzah Rehman, Ben Weintraub, Ethan Leba, William Enck, Cristina Nita-Rotaru, and Bradley Reaves. 2023. MSNetViews: Geographically Distributed Management of Enterprise Network Security Policy. In Proceedings of the 28th ACM Symposium on Access Control Models and Technologies. 121–132. ZT-SDN: An ML-powered Zero-Trust Arc...

    work page 2023

  8. [8]

    Daniele Apiletti, Elena Baralis, Tania Cerquitelli, and Vincenzo D’Elia. 2009. Characterizing network traffic by means of the NetMine framework. Computer Networks 53, 6 (2009), 774–789

    work page 2009

Show all 49 references
  1. [9]

    Luiz Fernando Carvalho, Taufik Abrão, Leonardo de Souza Mendes, and Mario Lemes Proença Jr. 2018. An ecosystem for anomaly detection and mitigation in software-defined networking. Expert Systems with Applications 104 (2018), 121–133

    2018

  2. [10]

    Martin Casado, Michael J Freedman, Justin Pettit, Jianying Luo, Nick McKeown, and Scott Shenker. 2007. Ethane: Taking control of the enterprise. ACM SIGCOMM computer communication review 37, 4 (2007), 1–12

    2007

  3. [11]

    Cisco. [n. d.]. Configuring Traffic Mirroring. https://www.cisco.com/c/en/us/td/docs/iosxr/ncs5000/interfaces/711x/configuration/guide/b-interfaces- hardware-component-cg-ncs5000-711x/configuring-traffic-mirroring.pdf

  4. [12]

    Cisco. 2020. What is Jitter? https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/What_is_Jitter%3F

    2020

  5. [13]

    Levente Csikor, Sriram Ramachandran, and Anantharaman Lakshminarayanan. 2022. ZeroDNS: Towards Better Zero Trust Security using DNS. In Proceedings of the 38th Annual Computer Security Applications Conference . 699–713

    2022

  6. [14]

    Anderson Santos da Silva, Juliano Araujo Wickboldt, Lisandro Zambenedetti Granville, and Alberto Schaeffer-Filho. 2016. ATLANTIC: A framework for anomaly traffic detection, classification, and mitigation in SDN. In NOMS 2016-2016 IEEE/IFIP Network Operations and Management Sym...

    2016

  7. [15]

    Mahmoud Said El Sayed, Nhien-An Le-Khac, Marianne A Azer, and Anca D Jurcut. 2022. A flow-based anomaly detection approach with feature selection method against ddos attacks in sdns. IEEE Transactions on Cognitive Communications and Networking 8, 4 (2022), 1862–1880

    2022

  8. [16]

    Paul Emmerich, Maximilian Pudelko, Sebastian Gallenmüller, and Georg Carle. 2017. FlowScope: Efficient packet capture and storage in 100 Gbit/s networks. In 2017 IFIP Networking Conference (IFIP Networking) and Workshops . IEEE, 1–9

    2017

  9. [17]

    Sahil Garg, Kuljeet Kaur, Neeraj Kumar, and Joel JPC Rodrigues. 2019. Hybrid deep-learning-based anomaly detection scheme for suspicious flow detection in SDN: A social multimedia perspective. IEEE Transactions on Multimedia 21, 3 (2019), 566–578

    2019

  10. [18]

    Kostas Giotis, Christos Argyropoulos, Georgios Androulidakis, Dimitrios Kalogeras, and Vasilis Maglaris. 2014. Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments. Computer Networks 62 (2014), 122–136

    2014

  11. [19]

    Korosh Golnabi, Richard K Min, Latifur Khan, and Ehab Al-Shaer. 2006. Analysis of firewall policy rules using data mining techniques. In 2006 IEEE/IFIP Network Operations and Management Symposium NOMS 2006 . IEEE, 305–315

    2006

  12. [20]

    Jordan Holland, Paul Schmitt, Nick Feamster, and Prateek Mittal. 2021. New directions in automated traffic analysis. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 3366–3383

    2021

  13. [21]

    Babangida Isyaku, Mohd Soperi Mohd Zahid, Maznah Bte Kamat, Kamalrulnizam Abu Bakar, and Fuad A Ghaleb. 2020. Software defined networking flow table management of openflow switches performance and security challenges: A survey. Future Internet 12, 9 (2020), 147

    2020

  14. [22]

    Liu Jian-Ping, Liu Juan-Juan, and Wang Dong-Long. 2012. Application Analysis of Automated Testing Framework Based on Robot. (2012), 194–197. https://doi.org/10.1109/ICNDC.2012.53

    2012 doi

  15. [23]

    Charalampos Katsis, Fabrizio Cicala, Dan Thomsen, Nathan Ringo, and Elisa Bertino. 2021. Can i reach you? do i need to? new semantics in security policy specification and testing. In Proceedings of the 26th ACM Symposium on Access Control Models and Technologies . 165–174

    2021

  16. [24]

    Charalampos Katsis, Fabrizio Cicala, Dan Thomsen, Nathan Ringo, and Elisa Bertino. 2022. Neutron: A graph-based pipeline for zero-trust network architectures. In Proceedings of the Twelfth ACM Conference on Data and Application Security and Privacy . 167–178

    2022

  17. [25]

    Diego Kreutz, Fernando MV Ramos, Paulo Esteves Verissimo, Christian Esteve Rothenberg, Siamak Azodolmolky, and Steve Uhlig. 2014. Software- defined networking: A comprehensive survey. Proc. IEEE 103, 1 (2014), 14–76

    2014

  18. [26]

    Trupti A Kumbhare and Santosh V Chobe. 2014. An overview of association rule mining algorithms. International Journal of Computer Science and Information Technologies 5, 1 (2014), 927–930

    2014

  19. [27]

    Willian Tessaro Lunardi, Martin Andreoni Lopez, and Jean-Pierre Giacalone. 2022. Arcade: Adversarially regularized convolutional autoencoder for network anomaly detection. IEEE Transactions on Network and Service Management 20, 2 (2022), 1305–1318

    2022

  20. [28]

    T H Sreenivas Mandara Nagendra, C N Chinnaswamy

    Dr. T H Sreenivas Mandara Nagendra, C N Chinnaswamy. November 2018. Robot Framework: A boon for Automation. IJSDR | Volume 3, Issue 11 (November 2018)

    2018

  21. [29]

    Nick McKeown, Tom Anderson, Hari Balakrishnan, Guru Parulkar, Larry Peterson, Jennifer Rexford, Scott Shenker, and Jonathan Turner. 2008. OpenFlow: enabling innovation in campus networks. ACM SIGCOMM computer communication review 38, 2 (2008), 69–74

    2008

  22. [30]

    Medium. 2016. What is Acceptable Jitter? https://medium.com/@datapath_io/what-is-acceptable-jitter-7e93c1e68f9b

    2016

  23. [31]

    Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. 2018. Kitsune: an ensemble of autoencoders for online network intrusion detection. arXiv preprint arXiv:1802.09089 (2018)

    2018 arXiv

  24. [32]

    Saurav Nanda, Faheem Zafari, Casimer DeCusatis, Eric Wedaa, and Baijian Yang. 2016. Predicting network attack patterns in SDN using machine learning approach. In 2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN) . IEEE, 167–172

    2016

  25. [33]

    Ankur Kumar Nayak, Alex Reimers, Nick Feamster, and Russ Clark. 2009. Resonance: Dynamic access control for enterprise networks. InProceedings of the 1st ACM workshop on Research on enterprise networking . 11–18

    2009

  26. [34]

    Timothy Nelson, Christopher Barratt, Daniel J Dougherty, Kathi Fisler, and Shriram Krishnamurthi. 2010. The margrave tool for firewall analysis. In Proceedings of the 24th Large Installation System Administration Conference (LISA 10)

    2010

  27. [35]

    Huy Anh Nguyen, Tam Van Nguyen, Dong Il Kim, and Deokjai Choi. 2008. Network traffic anomalies detection and identification with flow monitoring. In 2008 5th IFIP International Conference on Wireless and Optical Communications Networks (WOCN’08) . IEEE, 1–5

    2008

  28. [36]

    ONF. [n. d.]. Interface TopologyService. https://api.onosproject.org/2.7.0/apidocs/org/onosproject/net/topology/TopologyService.html 32 Katsis et al

  29. [37]

    Huijun Peng, Zhe Sun, Xuejian Zhao, Shuhua Tan, and Zhixin Sun. 2018. A detection method for anomaly flow in software defined network. IEEE Access 6 (2018), 27809–27817

    2018

  30. [38]

    Ben Pfaff, Justin Pettit, Teemu Koponen, Ethan Jackson, Andy Zhou, Jarno Rajahalme, Jesse Gross, Alex Wang, Joe Stringer, Pravin Shelar, et al. 2015. The design and implementation of open{vSwitch}. In 12th USENIX symposium on networked systems design and implementation (NSDI 1...

    2015

  31. [39]

    Stan Salvador and Philip Chan. 2007. Toward accurate dynamic time warping in linear time and space. Intelligent Data Analysis 11, 5 (2007), 561–580

    2007

  32. [40]

    Gustavo Frigo Scaranti, Luiz Fernando Carvalho, Sylvio Barbon Junior, Jaime Lloret, and Mario Lemes Proença Jr. 2022. Unsupervised online anomaly detection in Software Defined Network environments. Expert Systems with Applications 191 (2022), 116225

    2022

  33. [41]

    Jaishree Singh, Hari Ram, and Dr JS Sodhi. 2013. Improving efficiency of apriori algorithm using transaction reduction. International Journal of Scientific and Research Publications 3, 1 (2013), 1–4

    2013

  34. [42]

    SpeedGuide.net. 2024. TCP/IP Ports and Protocols Database. https://www.speedguide.net/ports.php Accessed: 2024-11-15

    2024

  35. [43]

    VA Stafford. 2020. Zero trust architecture. NIST special publication 800 (2020), 207

    2020

  36. [44]

    Alok Tongaonkar, Niranjan Inamdar, and R Sekar. 2007. Inferring Higher Level Policies from Firewall Rules.. In LISA, Vol. 7. 1–10

    2007

  37. [45]

    Michael Tschannen, Olivier Bachem, and Mario Lucic. 2018. Recent advances in autoencoder-based representation learning. arXiv preprint arXiv:1812.05069 (2018)

    2018 arXiv

  38. [46]

    Romans Vanickis, Paul Jacob, Sohelia Dehghanzadeh, and Brian Lee. 2018. Access control policy enforcement for zero-trust-networking. In 2018 29th Irish Signals and Systems Conference (ISSC) . IEEE, 1–6

    2018

  39. [47]

    WIDE Project. 2023. MAWI Working Group Traffic Archive. https://mawi.wide.ad.jp/mawi/ Accessed: 2024-10-24

    2023

  40. [48]

    Lily Yang, Ram Dantu, Terry Anderson, and Ram Gopal. 2004. Forwarding and control element separation (ForCES) framework . Technical Report

    2004

  41. [49]

    Sultan Zavrak and Murat İskefiyeli. 2020. Anomaly-based intrusion detection from network flow features using variational autoencoder. IEEE Access 8 (2020), 108346–108358

    2020

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.