Skip to Content
MDPIMDPI

Advanced

ElectronicsElectronics
PDF
  • Systematic Review
  • Open Access

20 August 2026

53 Pages

A Systematic Review of Machine Learning-Driven Software-Defined Wireless Sensor Networks: Architectures, Security, and Routing Trends

and
Research Group Computer Networks, Faculty of Computer Science, University of Koblenz, 56070 Metternich, Germany
*
Author to whom correspondence should be addressed.
Electronics2026, 15(16), 3733;https://doi.org/10.3390/electronics15163733
This article belongs to the Special Issue Artificial Intelligence for Distributed Networks
Version Notes
Order Reprints

Abstract

Recent progress in intelligent, adaptive, and security-aware Software-Defined Wireless Sensor Networks (SDWSNs) is driven by the integration of Machine Learning (ML) with Software-Defined Networking (SDN) and Wireless Sensor Networks (WSNs). This systematic survey analyzes 46 peer-reviewed articles published between 2024 and 2025, providing a problem-oriented synthesis of ML-SDWSN research. Emphasizing security, routing, and performance optimization, with a particular focus on deployment architectures, the survey identifies three major trends: increased adoption of ensemble and Reinforcement Learning (RL) methods for security and adaptive control; broader implementation of edge-based ML to minimize inference latency; and greater emphasis on privacy-preserving techniques, especially Federated Learning (FL). The survey presents a structured taxonomy encompassing seven thematic areas: Distributed Denial-of-Service (DDoS) mitigation, Intrusion Detection Systems (IDSs), routing optimization, Quality of Service (QoS) management, privacy preservation, data integrity, and network-efficiency optimization. Findings are synthesized from over 120 experimental configurations reported in the literature. Due to substantial differences among the reviewed studies in terms of datasets, network topologies, hardware platforms, measurement definitions, and validation methodologies, the reported values are presented as descriptive cross-study aggregates rather than direct comparative benchmarks or formal effect-size estimates. Within these constraints, the survey identifies recurring trade-offs among accuracy, latency, scalability, and privacy. It provides evidence-based design considerations for researchers and practitioners. The survey also highlights eight critical research gaps, including limited multi-dataset validation, a lack of real-world deployments, insufficient scalability analysis, and the need for rigorous evaluation of RL-based SDWSN control.

1. Introduction

Rapid growth of interconnected devices and the increasing demand for intelligent, adaptable networks have accelerated the adoption of SDN and WSNs as foundational technologies. SDN separates the network control plane from the data plane, providing centralized programmability and dynamic network management. Meanwhile, WSNs enable ubiquitous sensing and data collection in diverse application domains, from environmental monitoring to smart cities and industrial automation.
However, these technologies face several intrinsic challenges, including efficient routing under dynamic conditions, ensuring robust security, maintaining stringent QoS requirements, optimizing resource usage, and safeguarding data privacy and integrity. Traditional solutions often fall short due to the complexity and scale of modern networks.
ML has emerged as a transformative tool, offering data-driven approaches to intelligently address these challenges by enabling predictive analytics, anomaly detection, adaptive control, and automated decision-making. Integrating ML with SDN and WSNs allows for enhanced routing protocols, proactive security mechanisms, adaptive QoS management, efficient resource allocation, and robust privacy and integrity preservation.

1.1. Motivation and Scope

Existing surveys provide comprehensive overviews of SDN, WSN, and ML applications in networking but often emphasize either architectural frameworks or specific domains such as intrusion detection, routing, or Internet of Things (IoT) integration. In contrast, this review adopts a problem-centric approach to recent ML-driven solutions for SDWSNs, with particular attention to how learning-based methods address operational challenges including security, adaptive routing, latency-sensitive service management, privacy preservation, and resource efficiency.
Rather than assuming equal maturity across all domains, this review places analytical emphasis on security, routing, and deployment architecture, which are supported by the most robust empirical evidence in recent literature. Additional domains are included to provide a comprehensive SDWSN landscape, but their findings are interpreted with caution when supporting evidence is limited. This approach balances breadth and depth, enabling a more critical synthesis of algorithmic trends, evaluation practices, and deployment constraints.

1.2. Contribution and Organization

This survey makes several key contributions:
  • Problem-Centric Taxonomy: The survey introduces a hierarchical taxonomy that classifies 46 recent ML-SDWSN papers across dimensions of security, performance, and efficiency. It explicitly distinguishes areas of maturity from those where the literature remains underdeveloped.
  • Transparent Cross-Study Quantitative Synthesis: The review provides a quantitative synthesis of over 120 experimental configurations, reporting observed ranges and variability in accuracy, latency, throughput, and deployment choices. This synthesis explicitly acknowledges the heterogeneity of datasets, platforms, and evaluation procedures.
  • Critical Evaluation Framework: Comparative tables and analytical discussions move beyond descriptive cataloging to examine datasets, validation strategies, deployment realism, scalability, and reproducibility limitations across domains.
  • Evidence-Aware Design Guidance: The survey offers deployment recommendations for ML-SDWSN practitioners, framing them as evidence-informed guidance rather than universally comparable benchmarks. Explicit discussion addresses current empirical limitations.
  • Research-Gap Identification: The review identifies eight actionable research directions, emphasizing cross-dataset validation, real-world deployment, reinforcement learning evaluation, scalability, adversarial robustness, and reproducibility.
To enhance methodological rigor, the survey follows a clearly defined systematic-review workflow, specifying the search strategy, screening stages, inclusion and exclusion criteria, quality assessment dimensions, and data-extraction protocol. The resulting quantitative synthesis aims to reveal broad empirical patterns in recent SDWSN literature rather than asserting strict experimental comparability among all surveyed studies.
The remainder of this paper is organized as follows: Section 2 presents our systematic literature review methodology, which includes the search strategy, selection criteria, and quality assessment. Section 3 provides a comparative analysis that positions our work in relation to existing surveys. Section 4 presents a comprehensive taxonomy that organizes solutions for machine learning in software-defined wireless sensor networks (ML-SDWSN). Section 5, Section 6, Section 7, Section 8, Section 9, Section 10 and Section 11 analyze papers across seven thematic domains: security (which is subdivided into DDoS mitigation, intrusion detection systems, privacy, and data integrity), routing, QoS, and efficiency. Section 12 offers a descriptive quantitative synthesis that reveals cross-domain trends. Section 13 presents design guidelines and recommendations for practitioners. Section 14 identifies research gaps and proposes future directions. Section 15 concludes the paper.

2. Research Methodology

This systematic review adheres to the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 reporting guideline as well as established protocols for systematic literature reviews in computer science [1,2]. Supplementary Materials include the completed PRISMA 2020 checklist.

2.1. Search Strategy

Our literature search covered four major digital libraries:
  • IEEE Xplore Digital Library;
  • ACM Digital Library;
  • Springer Link;
  • ScienceDirect.
Between March and December 2025, we conducted the primary search campaign, targeting publications from January 2024 to December 2025. To address variations in the indexing of SDWSN-related research, we applied the following Boolean query to titles, abstracts, and author keywords:
  • (``Software-Defined Network’’ OR ``SDN’’) AND
  • (``Wireless Sensor Network’’ OR ``WSN’’) AND
  • (``Machine Learning’’ OR ``Deep Learning’’ OR
  • ``Reinforcement Learning’’ OR ``Neural Network’’) AND
  • (security OR routing OR QoS OR efficiency OR
  • ``intrusion detection’’ OR DDoS OR privacy)
The initial query retrieved 243 candidate papers before we removed duplicates and screened for relevance. In early 2026, we performed a supplementary search to ensure comprehensive coverage of major studies from 2024 to 2025 and to identify select post-2025 works that illustrate emerging research directions. Although we discuss these post-2025 studies qualitatively in Section 14 and Section 15, we do not include them in the quantitative dataset.

2.2. Inclusion and Exclusion Criteria

Inclusion Criteria:
  • Peer-reviewed conference or journal papers;
  • Published between January 2024 and December 2025;
  • We focused primarily on full-length contributions—specifically, journal papers with at least eight pages and conference papers with at least six pages. However, we also included a small number of shorter works (four to five pages) if they presented substantive experimental results and were widely cited within the SDWSN community.
  • Investigates ML-based techniques in SDN-enabled WSNs, SDWSNs, or closely related software-defined wireless sensing environments;
  • Includes experimental validation (simulation, emulation, or real testbed);
  • Addresses at least one target domain (security, routing, QoS, efficiency, privacy, or network integrity).
Exclusion Criteria:
  • Pure survey papers without novel contributions;
  • Papers focusing solely on traditional SDN/WSN without ML;
  • Short papers, posters, or extended abstracts;
  • Non-English publications;
  • Duplicate publications of the same work;
  • Papers lacking performance evaluation.

2.3. Protocol and Registration

This systematic review was neither registered in a review registry nor preceded by a published protocol. The methodology, eligibility criteria, search strategy, screening process, quality assessment, and data extraction procedures are detailed within this manuscript.

2.4. Selection Process

The selection process unfolded in three distinct phases:
  • Initial Screening (243 → 89 papers): Title and abstract review to eliminate clearly irrelevant works based on exclusion criteria;
  • Full-Text Assessment (89 → 62 papers): Complete paper reading to verify novelty, experimental rigor, and relevance to target domains.
  • Quality Evaluation (62 → 46 papers): Assessment using quality criteria including experimental design validity, baseline comparisons, reproducibility, and contribution significance.
This three-stage procedure offers a transparent account of how the initial pool of 243 records was narrowed to the final set of 46 SDWSN-focused ML studies included in the survey (see Figure 1).
Figure 1. PRISMA 2020 flow diagram of the study-identification, screening, eligibility-assessment, and inclusion process.
A single reviewer conducted both the title and abstract screening, as well as the full-text eligibility assessment. When uncertainties regarding eligibility arose, the reviewer consulted with the supervising author. The absence of independent duplicate screening introduces the potential for reviewer-related selection bias, which is acknowledged as a limitation.

2.5. Data Extraction

For every included paper, we systematically extracted the following information:
  • ML algorithm family (supervised, unsupervised, reinforcement learning, ensemble, or deep learning);
  • Problem domain(s) addressed;
  • Datasets used for evaluation;
  • Performance metrics (accuracy, precision, recall, F1, latency, and throughput);
  • Experimental setup (simulation tools and testbed specifications);
  • Network scale (number of nodes and topology);
  • Baseline comparisons;
  • Key limitations and identified future work.
All quantitative values were documented as reported in the original papers. Given the diversity in datasets, hardware platforms, and traffic assumptions across studies, we used these extracted values to highlight cross-study trends and variability, rather than to construct directly comparable effect-size estimates.

2.6. Quality Assessment

We evaluated the quality of each paper using seven criteria, with each criterion scored from 0 to 2:
  • Problem Significance: Addresses important SDWSN challenges;
  • Methodological Rigor: Clear experimental design and controlled variables;
  • Novelty: Significant advancement over prior work;
  • Baseline Comparison: Compares against established methods;
  • Reproducibility: Sufficient implementation details provided;
  • Scalability Analysis: Evaluates performance under varying scales;
  • Real-World Applicability: Considers practical deployment constraints.
All papers were independently evaluated by a single author using a seven-criterion scheme. Before assessing the complete set of studies, a pilot calibration exercise was conducted in which a subset of ten papers was re-evaluated twice using the same scoring rubric. This iterative process refined the internal decision rules for each criterion, clarifying the standards for experimental design, baseline comparison, and implementation detail necessary for reproducibility.
Because the quality assessment was conducted by a single reviewer, the process may reflect a degree of subjectivity. Although the pilot calibration improved consistency in applying the rubric, it did not provide evidence of inter-rater agreement. Therefore, the quality scores function as a structured guide for study selection and critical appraisal rather than as definitive or independently validated measures of study quality. This limitation is further discussed in Section 14.
Studies with total scores below 8 out of 14 were excluded from the final synthesis. This minimum threshold ensured inclusion of only studies demonstrating at least moderate methodological rigor, baseline comparison, and reproducibility, thereby eliminating superficially evaluated or incomplete works. The final set comprised 46 papers, with scores ranging from 9 to 13 and a mean of 10.7. These quality scores informed the critical interpretation of the literature and highlighted the relative strength of the evidence; however, they were not used as formal quantitative weights in the descriptive synthesis presented in Section 12.

4. Taxonomy of ML-SDWSN Solutions

We present a hierarchical taxonomy that systematically organizes ML-SDWSN research across three core dimensions: problem domain, machine learning technique family, and deployment architecture. Within this three-dimensional framework, we position each surveyed study according to the type of challenge it addresses—such as DDoS mitigation, routing, or QoS—the family of machine learning methods employed (e.g., supervised, ensemble, reinforcement learning, or deep learning), and the deployment architecture (centralized controller, edge-based, distributed, or hybrid). This multidimensional perspective clarifies patterns of research concentration, reveals domain-specific algorithmic preferences, and identifies key trends in architectural evolution within the field. Figure 2 provides the complete classification and serves as the conceptual backbone for the domain-specific analyses in Section 5, Section 6, Section 7, Section 8, Section 9, Section 10 and Section 11.
Figure 2. Hierarchical taxonomy of ML-SDWSN solutions.

4.1. Problem-Domain Dimension

The surveyed literature reveals a dual emphasis on security and performance, with security-oriented research constituting 60% of the total. This predominance underscores the acute vulnerability of software-defined wireless sensor networks—not only to conventional network attacks but also to threats specific to software-defined networking, particularly those that target the centralized control plane. In parallel, performance optimization emerges as a central concern, addressing the stringent resource constraints of wireless sensor deployments, where energy efficiency and adaptive routing are critical determinants of both network longevity and service quality.
Security (60% of papers):
  • DDoS Mitigation: Detection and response to distributed denial-of-service attacks (18 papers discussing DoS as well as other domains, with 13 focused on DoS);
  • Intrusion Detection Systems: General anomaly detection beyond DDoS (16 papers, 9 focused papers);
  • Privacy Preservation: Federated learning and encrypted routing (four papers);
  • Data Integrity: Tamper detection and trust evaluation (two papers).
Performance Optimization (52% of papers):
  • Routing: Adaptive path selection and load balancing (25 papers, 11 focused papers);
  • QoS Management: Latency optimization and bandwidth allocation (21 papers, 12 focused papers);
  • Energy Efficiency: Lifetime extension and power management (15 papers, 12 focused papers).
Note: Many papers address multiple domains (e.g., secure routing combines security and routing), which is why the total is more than 100%.
The significant overlap between security and performance domains—evident in 12% of surveyed papers—signals a maturing discipline in which practitioners increasingly acknowledge the necessity of addressing multiple objectives concurrently. For instance, secure routing protocols are expected not only to detect malicious nodes but also to maintain energy efficiency, while DDoS mitigation strategies must safeguard QoS for legitimate traffic. This multi-objective paradigm underpins the rising prominence of ensemble methods and multi-criteria decision algorithms observed in recent literature.

4.2. ML Technique Family Dimension

The algorithmic landscape exhibits a clear pragmatic preference for ensemble methods and supervised learning approaches over deep learning architectures. This distribution is fundamentally shaped by the resource constraints inherent to SDN controllers and edge devices, where inference latency and computational overhead exert a direct influence on network performance. The dominance of supervised learning (50% of surveyed papers) can be attributed to the widespread availability of well-labeled benchmark datasets (such as CICIDS and UNSW-NB15) and the critical need for interpretability in network security applications.
Note: As with problem domains, the following percentages indicate that many papers utilize multiple families of machine learning techniques—for example, combining supervised learning with ensemble methods or incorporating deep reinforcement learning. As a result, the proportions across ML families exceed 100%.
Supervised Learning (50% of papers):
  • Tree-based: Random Forest (23 papers), Decision Tree (12 papers), and XGBoost (18 papers);
  • Neural Networks: MLP (8 papers) and deep neural networks (10 papers).
  • Other: SVM (nine papers), Naive Bayes (seven papers), and K-NN (eight papers).
Ensemble Methods (40% of papers):
  • Voting: Majority/soft voting (six papers);
  • Stacking: Meta-learner architectures (five papers);
  • Boosting: AdaBoost and Gradient Boosting (four papers).
Tree-based algorithms—such as Random Forest, XGBoost, and Decision Tree—emerge as the most frequently adopted technique family in the surveyed literature, appearing in 53 instances. Their popularity stems from several notable strengths: rapid inference times (typically under 15 ms), consistently high accuracy on tabular flow features (98–99%), intrinsic feature-importance measures that enhance interpretability, and a reduced need for extensive hyperparameter tuning compared to neural networks. Ensemble methods, in particular, routinely achieve very high reported accuracies (approximately 99%) while incurring only a modest latency overhead of 10–20 ms. These attributes make tree-based ensembles a common choice in studies that aim to balance high accuracy with real-time responsiveness. Nevertheless, their reported performance should still be validated under realistic deployment conditions.
Reinforcement Learning (21% of papers):
  • Value-based: Q-learning (four papers) and DQN (three papers);
  • Policy-based: Actor–Critic (two papers);
  • Multi-agent: Distributed RL (two papers).
Deep Learning (27% of papers):
  • Graph Neural Networks: GCN (four papers) and GNN (three papers);
  • CNNs: 1D-CNN (two papers);
  • RNNs/LSTMs: Sequence modeling (three papers);
  • Autoencoders: Dimensionality reduction and anomaly detection (two papers).
Reinforcement learning (21% of surveyed papers) is predominantly employed in dynamic routing and quality-of-service (QoS) optimization tasks, where its capacity for sequential decision-making and adaptive policy development yields substantial throughput improvements—typically, 15–42% over static protocols. Despite these advantages, reinforcement learning faces practical barriers: high training requirements and convergence difficulties restrict its deployment to contexts with access to offline training infrastructure.
Deep learning approaches (27%) are mainly adopted in specialized use cases, such as utilizing graph neural networks for topology-aware routing, convolutional neural networks for traffic pattern recognition, and autoencoders for dimensionality reduction on resource-constrained edge devices. The comparatively limited adoption of deep learning—especially when contrasted with its prevalence in computer vision or natural language processing—stems from its inherent latency penalty (30–60 ms inference), which renders these architectures unsuitable for real-time SDN control loops.
Unsupervised Learning (10% of papers):
  • Clustering: K-means and DBSCAN (three papers);
  • Anomaly Detection: Isolation Forest (two papers).
The relatively low adoption rate of unsupervised learning (10% of surveyed papers) suggests that labeled datasets remain readily accessible for prevalent attack types, thereby diminishing the necessity of unsupervised approaches in most cases. Nevertheless, studies that leverage unsupervised methods focus on addressing novel challenges—such as zero-day attack detection, network topology clustering, and operational contexts where labeled data is scarce or prohibitively costly to obtain.

4.3. Deployment-Architecture Dimension

The deployment architecture exerts a direct influence on inference latency, scalability, and controller workload. The field is undergoing a marked transition away from predominantly centralized controller-based machine learning architectures (which accounted for 78% of deployments in 2024) toward edge-based and distributed solutions (projected to reach 46% adoption by Q1 of 2025). This shift is largely propelled by the stringent latency demands of industrial IoT applications and the inherent scalability constraints of centralized inference, particularly in networks exceeding 1000 nodes.
Centralized Controller-Based Architectures (65% of papers):
  • ML models that reside in SDN controllers;
  • Flow statistics collected via OpenFlow;
  • Mitigation through flow-rule updates.
Centralized architectures continue to predominate as the deployment model of choice (65%) because of their implementation simplicity, comprehensive network visibility, and seamless integration with existing SDN infrastructure. Controllers in this paradigm possess ample computational resources to support complex ensemble models and deep neural networks, enabling deployments that prioritize accuracy. Nevertheless, centralized approaches are not without limitations: they create a single point of failure, risk bottlenecks as network scale increases, and introduce inference latencies of 25–75 ms—levels that may prove prohibitive for ultra-low-latency applications.
Edge-Based Architectures (23% of papers):
  • ML inference at edge servers/fog nodes;
  • Reduced controller load and latency;
  • API-based controller notification.
Distributed Architectures (15% of papers):
  • Multi-agent RL with per-switch intelligence;
  • Federated learning across domains;
  • P4-programmable switch integration.
Hybrid (12% of papers):
  • Lightweight models at edges/switches;
  • Complex models for controllers/clouds;
  • Hierarchical decision-making.
Edge-based architectures represent 23% of the reviewed papers. Multiple studies report that their evaluated edge configurations achieve low inference or runtime values and reduce controller resource usage. Nevertheless, variations in hardware platforms, traffic loads, model complexity, feature-processing pipelines, and timing definitions limit direct comparability across studies. As such, these reported values should be viewed as study-specific evidence, not as a pooled estimate of an edge-based latency advantage.
Distributed architectures (15%) address the challenges of multi-domain environments by leveraging federated learning for collaborative security—enabling knowledge sharing without direct exchange of raw data—and employing multi-agent reinforcement learning to grant per-switch autonomy in routing decisions.
Hybrid architectures comprise 12% of the reviewed papers. Typically, these studies deploy lightweight models—such as Decision Trees or small Random Forests—at the edge to perform initial filtering while reserving more complex controller-based models for uncertain cases. This two-tier approach aims to leverage the advantages of local processing alongside detailed analysis. However, its end-to-end timing, accuracy, and resource benefits require validation within a consistent deployment workflow.

5. Security: DDoS Mitigation

Distributed Denial-of-Service (DDoS) attacks continue to pose a significant threat to Software-Defined Wireless Sensor Network (SDWSN) infrastructures, taking advantage of both vulnerabilities in the network layer and the centralized controller bottleneck. This section analyzes 18 DDoS detection and mitigation approaches (concentrated in 13 unique papers) that propose ML-based frameworks for DDoS detection and mitigation, categorized by their architectural approaches.
Note: Inless specified otherwise, “DDoS” denotes distributed denial-of-service attacks. For studies that explicitly address non-distributed denial-of-service incidents, we use the term “DoS”.

5.1. Centralized Controller-Based Detection

5.1.1. Real-Time Flow Analysis Approaches

Ensemble Methods for High-Accuracy Detection: Two recent studies demonstrate that ensemble classifiers achieve better accuracy–efficiency trade-offs than single models. Kaushik et al. [10] implemented a RYU-controlled Mininet environment with 18 hosts, extracting seven-tuple flow features. Their comparative analysis of Random Forest (RF), Decision Tree, Gaussian Naive Bayes, and Logistic Regression shows that RF achieves an accuracy of 99.4% with the lowest false-positive rate.
Similarly, Sathish et al. [11] proposed DoSGuard, which combines the Improved Coyote Optimization Algorithm (ICOA) for feature selection with an ensemble voting mechanism using am ANN and XGBoost. On the CSE-CIC-IDS2018 dataset, DoSGuard achieved 99.2% accuracy, with a false-alarm rate of just 0.1%. This represents a 4.8% improvement over standalone XGBoost while reducing CPU usage by 37%.
The trend towards ensemble methods highlights a key trade-off: while single high-capacity models like deep neural networks can achieve slightly higher peak accuracy, they can also come with significant computational overhead that makes them unsuitable for real-time integration in SDN controllers. By combining fast, shallow learners such as decision trees (DTs) for speed with highly accurate boosted models like XGBoost for precision, ensemble methods strike an optimal balance.
Feature Engineering and Optimization: K et al. [12] went beyond standard flow features by utilizing metaheuristic optimization. Their two-stage framework employs Genetic Algorithms (GAs) and Chimp Optimization to extract six key features from the SDNDDOS2020 dataset. They trained classifiers including GARF, ChimpRF, GAMLP, and ChimpMLP. Notably, ChimpMLP achieved an accuracy of 98.68%, with a false-alarm rate of just 0.74%. This demonstrates that intelligent feature selection can maintain high performance while reducing the number of features by 77%, which is crucial for low-latency decision-making in Software-Defined Networking (SDN). The streamlined feature set enables inference times of under 10 ms, compared to 40–60 ms for models using the full set of 78 features.
Optimization-based feature selection has a significant limitation: models become specific to the dataset they were trained on. For instance, when K et al.’s ChimpMLP was tested on the CICIDS2017 dataset, which was not used during training, the accuracy dropped to 91.3%. This demonstrates a lack of generalization in the model. This issue highlights an important research gap: the need to develop transferable feature sets that are robust across various attack variants and network contexts.

5.1.2. Deep Learning Architectures

Salatino et al. [13] and Sharma et al. [14] investigated deep neural network (DNN) and stacked DNN frameworks, respectively. Salatino’s method reduces the number of features from 80 to 26 using Pearson correlation and mean decrease impurity techniques. They trained Decision Tree (DT), Random Forest (RF), and DNN models on the CSE-CIC-IDS2018 dataset. The DNN achieved an impressive accuracy of 98.33% in detecting UDP floods, with a response time of just 0.06 s in the GNS3 testbed. Notably, their analysis revealed attack-type specificity: the Random Forest model performed best for SYN floods, achieving 97.8% accuracy, while the DNN excelled in detecting Slowloris attacks, with an accuracy of 98.9%.
Sharma et al. [14] expanded upon this concept by utilizing stacked meta-learning, employing K-Nearest Neighbors (KNN), Decision Trees (DTs), Naive Bayes (NB), and two Deep Neural Networks (DNNs) as base learners, all feeding into a DNN meta-learner. This ensemble achieved an accuracy of 99.09%, which is a modest improvement over the accuracy of single DNNs, at 98.98%. However, this improvement comes at a cost, requiring three times the computational resources. This diminishing return indicates that for SDN DDoS detection, shallow ensemble methods such as Random Forest (RF) and XGBoost offer a better cost–benefit ratio than deep stacking.

5.1.3. Feature-Engineered Ensemble for Robust Detection

Madoune et al. [15] enhanced the robustness of DDoS detection through techniques of dimensionality reduction and ensemble learning. Their framework combines Principal Component Analysis (PCA) and t-Distributed Stochastic Neighbor Embedding (t-SNE) for dimensionality reduction, followed by K-means clustering for feature augmentation. This approach reduces the feature space while preserving critical patterns.
They achieved an impressive accuracy of 99.93%, with an execution time of 1.61 s on real SDN traffic datasets, by using a soft voting ensemble that integrates Random Forest and XGBoost. Notably, XGBoost alone demonstrates exceptional real-time performance, achieving 99.91% accuracy, with a response time of just 0.2 s. The ensemble method further enhances robustness across various DDoS attack variants.

5.1.4. Flow Table-Based Control-Plane Protection

Sendil Vadivu et al. [16] introduced a novel defense mechanism that monitors the dynamics of SDN flow tables using the Ryu controller. The system employs a Random Forest classifier to analyze extracted flow features, including duration, protocol, port numbers, byte count, and packet count, in order to detect attacks targeting the control-plane infrastructure. This approach achieves an impressive 99.9% accuracy in attack detection, with a response time of just 12 ms for the blocking of malicious hosts. By focusing on flow-table patterns instead of raw traffic, this method complements traditional packet-based detection techniques and helps protect SDN infrastructure from resource exhaustion attacks.

5.1.5. Hardware-Accelerated Isolation Forest on FPGA

M et al. [17] implemented an integration of Software-Defined Networking (SDN) and ML using the Isolation Forest algorithm, deployed on hardware acceleration platforms. The system employs the Xilinx Vivado Design Suite, along with the Edge Artix-7 FPGA Development Board, for real-time detection and mitigation of Distributed Denial of Service (DDoS) attacks. The Isolation Forest algorithm analyzes network traffic to identify anomalies, which triggers the SDN control plane to dynamically reroute traffic using the Bellman–Ford algorithm when attacks are detected. The FPGA implementation delivers rapid feedback, and the system is evaluated using metrics such as packet propagation delay and the packet loss rate. Results indicate that the hardware-based approach achieves lower delay and loss compared to the software baseline, demonstrating the promise of hardware-accelerated Isolation Forest for real-time DDoS mitigation in SDN environments.

5.2. Edge-Based Detection Architectures

A paradigm shift occurred from 2024 to 2025, transitioning ML inference from centralized controllers to edge servers. This change addresses two critical issues: the computational load on controllers and latency in detection.
Edge-SDN Hybrid Frameworks: Belachew et al. [18] are pioneers in edge-based DDoS detection for SDN-Edge-IoT environments. Their framework utilizes XGBoost classifiers on resource-rich edge servers to analyze sFlow-RT statistics from IoT traffic. When an attack is detected, the edge servers notify the SDN controller through a REST API to implement mitigation rules. This architecture achieves the following goals:
  • Accuracy: 99.99% on CICIDS2017 and Edge-IIoTset;
  • Latency: <4 ms inference time (83% reduction vs. controller-based architecture);
  • Scalability: Handles 10,000+ concurrent flows without controller overload.
The key innovation is computational offloading—edge servers handle resource-intensive ML inference while controllers concentrate on installing flow rules. This separation allows for horizontal scaling: adding edge servers enhances detection capacity without creating a bottleneck at the controller.
Sivakumar and Jeyaselvi [19] introduced AEXGB, a method that combines autoencoders for dimensionality reduction with XGBoost classification at the edge. When tested on the LATAM-IoT-DDoS dataset, AEXGB achieved an impressive accuracy of 95.71%, with a remarkable runtime of just 0.002 s—75 times faster than traditional controller-based approaches. The autoencoder compresses 78-dimensional feature vectors down to 12 dimensions, allowing for real-time processing on resource-constrained edge devices such as the Raspberry Pi 4 with 2 GB of RAM.
Trade-off Analysis: Edge-based architectures incur a 0.5–2% accuracy loss compared to centralized DNNs but achieve an 80–85% reduction in latency and a 60% savings in controller CPU usage. For latency-sensitive applications, such as industrial IoT and healthcare, this trade-off is advantageous.

5.3. Specialized Attack Detection

5.3.1. ICMP-Based DDoS

Shehabat et al. [20] focused specifically on ICMP flood attacks, which are often overlooked in favor of TCP/UDP attacks. Their approach involves extracting features specific to ICMP, such as request/reply ratios and time-to-live patterns. They trained a random forest (RF) classifier that achieved an impressive accuracy of 99.1% on a custom ICMP-DDoS dataset. For mitigation, their strategy uses adaptive thresholds: legitimate ICMP traffic (for example, pings used for network diagnostics) is rate-limited to 10 packets per second instead of being blocked, while traffic identified as an attack is immediately dropped.

5.3.2. Explainable AI for DDoS Detection

Raihan and Islam [21] integrated SHAP (SHapley Additive exPlanations) with XGBoost to enhance the interpretability of DDoS detection. In their work with the CIC-DDoS2019 dataset, the optimized XGBoost model achieved an impressive 100% recall, meaning there were no false negatives. This is crucial in attack scenarios, where missing detections can have severe consequences. The SHAP analysis highlights Fwd_Packet_Length_Min and Destination_Port as the most important predictive features. This allows network administrators to better understand attack signatures and create additional firewall rules as needed.
This explainability is essential for regulatory compliance (e.g., GDPR’s “right to explanation”) and operational trust. However, the computation of SHAP adds 15–20% overhead, making it more suitable for offline analysis than for real-time detection pipelines.

5.4. Federated Learning for Privacy-Preserving DDoS Detection

Mateus et al. [22] explored multi-domain SDN scenarios in which controllers are unable to share raw traffic data due to privacy regulations. They proposed a horizontal federated learning framework that locally trains Deep Neural Networks (DNNs), Convolutional Neural Networks (CNNs), and Long Short-Term Memory (LSTM) models on five edge servers. The framework then aggregates the weights using the FedAvg algorithm. By the fifth round of training, the global model achieved an accuracy of 99.95% to 99.99% across various attack types, including UDP Flood, TCP SYN, and DNS Flood. This performance matches that of centralized training while maintaining data privacy.
Privacy–Accuracy Trade-off: Federated learning typically incurs a 2–3% accuracy penalty during the initial rounds but eventually converges to performance levels close to those of centralized systems. The advantage is that raw network flows remain within local domains, fulfilling privacy requirements while ensuring collective security.
Limitation: Federated approaches assume that participants are non-adversarial. Poisoning attacks, where compromised edge servers submit malicious model updates, remain an open challenge, which is addressed by only one paper in our survey.

5.5. Performance Analysis and Design Implications

A summary of key performance metrics for various DDoS mitigation approaches can be found in Table 2.
Table 2. Comparative performance of DDoS mitigation approaches.
Key Findings and Design Implications:
1. Algorithm Selection by Constraint:
  • Latency-sensitive scenarios: Consider deploying lightweight models at the edge or data plane;
  • Accuracy-Critical (>99.5%): Ensemble (ANN-XGBoost) or Federated DNN;
  • Explainability-Required: XGBoost + SHAP (accept 15% latency overhead);
  • Privacy-Constrained: Federated learning (2–3% accuracy penalty).
2. Deployment Architecture Considerations: Researchers frequently investigate edge-based strategies to alleviate controller load and enable local processing. Several studies report lower timing values and decreased controller-resource usage.
3. Dataset Generalization Gap: Only 3 out of 18 papers tested on multiple datasets. The cross-dataset accuracy decreases by 5–8%, indicating overfitting to specific attack signatures.
4. Emerging Trend—Hybrid Models: Using lightweight edge classifiers such as decision trees for initial filtering, in combination with controller-based DNNs for uncertain cases, effectively balances speed and accuracy. This two-tier approach is discussed in four papers published after mid-2024.

6. Security: Intrusion Detection Systems

In addition to DDoS-specific detection, this section addresses a broader range of intrusion detection that includes various attack vectors: port scanning, brute-force attacks, botnet traffic, and zero-day anomalies. We analyze a total of 16 IDS frameworks (9 unique papers), organized by their detection methodology and architectural innovations.

6.1. Signature-Based vs. Anomaly-Based Approaches

Traditional signature-based intrusion detection systems encounter difficulties with zero-day attacks and polymorphic malware. Among the 16 papers surveyed, all utilize anomaly-based detection through machine learning to analyze normal traffic patterns. Out of these, 11 employ supervised learning techniques using labeled attack datasets, while 4 adopt unsupervised methods.
Supervised Learning IDS:
Multi-Classifier Ensemble Frameworks: O. Rodrigues et al. [24] developed a modular Software-Defined Networking and Machine Learning (SDN-ML) architecture for Internet of Things (IoT) applications in smart cities, utilizing MQTT over LoRaWAN. Their RYU controller, equipped with a Flask REST API, hosts 13 pre-trained supervised machine learning algorithms, including XGBoost, Random Forest (RF), Decision Tree, AdaBoost, Gradient Boosting, Extra Trees, Logistic Regression, Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Naive Bayes, neural networks, Stochastic Gradient Descent (SGD) Classifier, and Perceptron. Trained on the UNSW-NB15 dataset, XGBoost demonstrates the best performance among these algorithms:
  • Accuracy: 89.95%;
  • AUC: 0.9927;
  • Inference Latency: <75 ms.
The modular design enables hot-swapping ML models without restarting the controller, which is critical for operational networks. Prototype validation using ESP32 sensors and Mininet gateways confirms scalability to over 500 concurrent flows.
Healthcare-Specific IDS: Nagaraj et al. [25] tackled the unique requirements of healthcare IoT systems, emphasizing the need for high reliability—specifically, avoiding false positives that could disrupt critical devices—and ensuring compliance with privacy regulations. Their approach employs ensemble stacking, where various algorithms such as K-Nearest Neighbors (KNN), Decision Trees (DT), Random Forest (RF), Naive Bayes (NB), Logistic Regression, AdaBoost, and XGBoost serve as base learners. These models are then fed into a meta-learner that utilizes a soft voting classifier. When tested on medical device traffic, the framework achieves flawless metrics:
  • Accuracy: 100%;
  • F1-Score: 1.00 for both normal and attack classes;
  • Throughput: 5.7 M samples/s.
The Flask-based Web interface provides real-time alerts to healthcare administrators without the need for cybersecurity expertise. This focus on usability sets healthcare IDSs apart from general-purpose systems.
Transportation-System IDSs: Sheth et al. [26] designed an AI-assisted Software-Defined Network (SDN) for Intelligent Transportation Systems (ITSs) in smart cities, focusing on the security of vehicle-to-infrastructure (V2I) communication. In testing on the SDNFlow dataset, which contains 662,828 samples and 39 features, XGBoost demonstrated superior performance compared to Decision Tree, Random Forest, and SVM:
  • Accuracy: 99%;
  • Precision/Recall/F1: 1.00.
The ITS-specific contribution involves integration with roadside unit (RSU) controllers to filter out the flow of malicious data before they reach traffic management systems. False data injection attacks, such as misleading congestion alerts, are detected with 99.2% accuracy.

6.2. Feature Selection for Efficient IDSs

High-dimensional flow features, comprising 50 to 80 attributes, can create computational bottlenecks. Five papers specifically focus on the topic of feature selection.

6.2.1. SHAP-Based Feature Importance

Di Gennaro et al. [27] applied SHapley Additive exPlanations to the InSDN dataset, which contains 343,939 flows of TCP, UDP, and ICMP. Their approach consists of two phases:
  • Train baseline models (DT, RF, SVM, NB, KNN, and MLP) with k-fold cross-validation;
  • Use SHAP to rank feature importance per attack type.
Results show dramatic dimensionality reduction is possible:
  • DDoS attacks: One to three features maintain >90% accuracy;
  • Port scans: Five features are sufficient;
  • Botnet traffic: Eight features required.
This attack-specific feature selection allows for specialized lightweight models instead of using monolithic classifiers, which reduces inference time by 60%.

6.2.2. Ensemble Feature Selection

Sindhula and Pradeep [28] combined three feature selection methods: Mutual Information Gain (MIG), Chi-Square (CHI), and Variance Threshold (VT). On the CICIDS2017 dataset, ensemble selection reduces the number of features from 78 to 11 based on mean importance scores. The Random Forest classifier achieves:
  • Accuracy: 99.95%;
  • Training Time: 2.21 s (vs. 18.4 s with full features);
  • Memory: 41.3 MB (vs. 312 MB).
The 85% memory reduction allows for deployment on resource-constrained IoT gateways, such as ARM Cortex-M4 microcontrollers with 512 KB of RAM.

6.3. Three-Tier Adaptive Security Framework

Ahlawat et al. [29] proposed a hybrid architecture designed for resource-constrained IoT and edge devices, which features coordinated security across three tiers. In this architecture, edge nodes utilize lightweight Random Forest classifiers for real-time anomaly detection, achieving minimal computational overhead of 14.8% CPU usage and 19.3% memory consumption. The SDN-based fog layer provides real-time mitigation through isolation and recovery mechanisms, with average isolation times of 1.84 s and recovery times of 9.85 s. Meanwhile, the cloud tier continuously refines and deploys updated models. This framework is effective in detecting Denial of Service (DoS) attacks, abnormal state transitions, and resource exhaustion, achieving an accuracy of 94.2%, a F1-score of 92.1%, and a ROC-AUC of 96.4%. This demonstrates its capability for fail-safe operation even when network connectivity is limited.

6.4. Online Learning and Adaptive IDSs

Static models degrade when traffic patterns evolve. Two papers address continuous learning.

6.4.1. Collaborative Machine Learning IDS

Golchin et al. [30] presented COML-IDS, which integrates online learning into SDN IDSs. The architecture features the following…:
  • Data-Plane IDS (DP-IDS): Lightweight Random Forest in programmable switches (P4) for fast classification;
  • Control-Plane IDS (CP-IDS): Ensemble (RF, XGBoost, and MLP) for accurate labeling when DP-IDS confidence is low;
  • Online Learning Modules: Alert monitoring, Isolation Forest for annotation, dataset collection, and retraining.
When performance degrades (for example, when the F1-score drops by more than 5%), the system triggers retraining. Evaluations indicate that COML-IDS enhances the detection of unseen attack patterns by 33% compared to static CML-IDS while decreasing the control-plane load by 40% through efficient DP-IDS filtering.

6.4.2. Proactive Prediction

Cabral et al. [31] proposed proactive SDN IDS (pSID) for 5G networks, utilizing Random Forest to predict attacks before they fully manifest. Trained on ten key flow features from SDN monitors, pSID achieves:
  • Cross-Validation Accuracy: 98.73%;
  • Precision/Recall/F1: 0.9841/0.9883/0.9862;
  • Detection Rate: 100% for DoS and port scan; 66% for complex Web brute force (due to class imbalance).
The proactive approach prevents malicious hosts before they cause significant damage, reducing the mean time to mitigation from 8.2 s (reactive) to 1.3 s.

6.5. Privacy-Preserving IDSs

6.5.1. Federated Learning for Multi-Domain IDSs

In addition to DDoS-specific federated learning (refer to Section 5.4), collaborative learning also enhances general Intrusion Detection System (IDS) scenarios. De O. Rodrigues et al. [24] explored (despite not implementing) federated extensions to their modular framework. In this framework, various smart-city domains can train local models on MQTT-IoT traffic while keeping raw packet data private.

6.5.2. Traffic Classification Without Deep Packet Inspection

Patel et al. [32] explored the issue of privacy in smart power grids, highlighting how deep packet inspection can breach regulatory constraints. They proposed an ensemble learning framework that classifies 20 types of traffic into 7 distinct categories by utilizing only flow-level statistics, such as packet sizes, inter-arrival times, and port numbers. The LightGBM ensemble demonstrates effective performance in this classification task:
  • Accuracy/Precision/Recall/F1: 0.983;
  • ROC-AUC: 0.9997.
This flow-only approach allows for IDS deployment in privacy-sensitive environments, such as healthcare and financial services, while adhering to data protection laws.

6.6. Performance Analysis and Design Implications

Table 3 provides a summary of the performance of various IDS frameworks across different datasets and types of attacks.
Table 3. Comparative performance of intrusion detection systems.
Design Guidelines for IDS Deployment:
1. Dataset Selection Impacts Generalization:
  • CICIDS2017/2018: This dataset is widely used, but it is becoming outdated. It does not adequately represent modern attacks, such as machine learning adversarial examples
  • UNSW-NB15: This dataset features a wider variety of attack types, making it more suitable for use in general-purpose IDSs.
  • InSDN: This dataset is specific to SDN and includes attacks aimed at controllers that are not present in generic datasets.
  • Domain-Specific (SDNFlow for ITSs and medical IoT traffic): Essential for specialized deployments.
2. Deployment and Processing Considerations:
  • Data-plane or edge integration: Deploy lightweight models at the data plane or edge for local processing and rapid initial filtering. Evaluate their performance using the specific hardware, traffic load, and end-to-end workflow intended for deployment.
  • Controller-based processing: Use controller-based architectures to support more complex models and centralized policy enforcement. Assess timing and resource requirements within the designated deployment environment.
  • Hybrid architectures: Combine switch- or edge-based initial filtering with controller-level analysis for uncertain or complex events. Validate the end-to-end benefit using consistent timing definitions across the workflow.
3. Addressing Class Imbalance:
  • Attack traffic typically constitutes less than 1% of the total network flows.
  • Possible solutions include SMOTE oversampling (Kumar et al.), the use of weighted loss functions (Nagaraj et al.), and the application of anomaly detection instead of classification.
4. Feature Engineering Recommendations:
  • High-Resource Environments: Utilize the complete set of features (78–80 features) in conjunction with ensemble models.
  • Edge/IoT Gateways: Use SHAP (SHapley Additive exPlanations) or ensemble feature selection methods to narrow down the feature set to between 8 and 15 key features.
  • Privacy-Constrained: Only flow-level statistics are collected, with no inspection of the payload.

7. Security: Privacy Preservation

Privacy concerns in SDWSN arise from the visibility of centralized controllers, inter-domain data sharing, and risks associated with surveillance. Four specific papers address privacy issues using methods such as encrypted routing, federated learning, and privacy-preserving computation.

7.1. Federated Learning Frameworks

Mateus et al. [22] (discussed in Section 5.4 for DDoS) illustrated the dual benefit of federated learning: it maintains detection accuracy while preventing exposure of raw traffic. FedAvg weight aggregation ensures that no SDN domain reveals flow-level data to others.
Privacy Guarantee: In the semi-honest adversary model, where participants adhere to the protocol but may try to deduce information from updates, differential privacy can be achieved by adding noise to gradients. Nevertheless, none of the surveyed papers implemented differential privacy, leaving gradient-based inference attacks as a significant vulnerability.

7.2. Scalable Privacy-Preserving Routing

Andreoletti et al. [33] addressed inter-AS routing privacy through machine learning-based graph pruning. In multi-domain SDN, calculating the shortest paths using secure multiparty computation (SMPC) exposes the topology to all involved parties. Their method is outlined as follows:
  • Train a decision tree using public topology graphs by employing unit-cost paths to ensure privacy.
  • Identify which Autonomous System (AS) nodes are likely to be part of the shortest paths between specific source and destination pairs.
  • Prune low-probability nodes (likelihood < 0.3).
  • Run Dijkstra’s algorithm based on Secure Multi-Party Computation (SMPC) on the simplified graph.
Results on realistic network topologies (5000 to 20,000 Autonomous Systems):
  • Computational Complexity Reduction: 75%;
  • Communication Complexity Reduction: 85%;
  • Path-Length Overhead: ≤16% (acceptable for privacy gain).
The key innovation is anchor-based node embeddings, which represent each AS by the shortest-path distances to K fixed anchor nodes. This feature engineering allows for decision-tree training without disclosing private link costs.
Limitation: This approach assumes a public topology structure. In cases where the topology is sensitive, such as military networks, this method can expose the graph structure.

7.3. Anonymous Routing with Intelligent Traffic Management

Yaseen et al. [34] introduced ITor-SDN, which integrates Tor anonymization with SDN routing intelligence. Traditional Tor experiences long circuit establishment delays of 3 to 7 s due to its random path selection. ITor-SDN enhances this process as follows:
  • Blockchain-Based Key Management: Storing public keys and node capacities on chain eliminates the vulnerability of a centralized directory authority.
  • Semi-Supervised 1D-CNN: This approach optimizes relay selection by taking into account bandwidth, latency, and load predictions.
  • SDN Controller Integration: Tor nodes function as OpenFlow switches, allowing for dynamic rerouting of traffic.
Evaluations show the following:
  • Circuit Setup Time: Reduced from 5.2 s to 1.8 s, representing a 65% improvement;
  • Throughput: 40% increase under high load;
  • Anonymity Preservation: Equivalent to standard Tor (k-anonymity analysis).
This shows that privacy and performance do not have to be mutually exclusive; intelligent relay selection can enhance both.

7.4. Privacy in IoT Data Transmission

Qazi et al. [35] discussed end-to-end encryption for the monitoring of underground utilities using LoRaWAN. Their scheme for lightweight cryptography is designed to enhance security:
  • Convert sensor readings into ASCII matrices.
  • Perform piecewise multiplication using a 2 × 2 key matrix.
  • Incorporate routing flags into encrypted packets to optimize SDN.
Testing on TI CC1352P1 LaunchPads shows that encryption and decryption introduce only a 15 ms delay over LoRaWAN’s inherent transmission time of 1–2 s, which is negligible overhead. The matrix-based encryption is less computationally intensive than AES, allowing for deployment on microcontrollers with 128 KB of flash memory.
Security Caveat: The paper lacks formal security proofs, presenting a security caveat. Matrix-based ciphers are susceptible to known-plaintext attacks, especially with key reuse; the cited study does not address this vulnerability.

7.5. Privacy–Utility Trade-Off Analysis

Figure 3 conceptually illustrates the trade-offs observed across privacy-preserving approaches:
Figure 3. Privacy–utility trade-off analysis of the four SDWSN privacy-preserving approaches.
  • Federated Learning: High privacy (raw data never leaves the domains), moderate accuracy penalty (2–3% in early rounds), and high communication cost (frequent model updates).
  • SMPC-Based Routing: Offers maximum privacy with cryptographic guarantees, but incurs a high computational cost, as a 75% reduction still requires minutes for processing large graphs. There is an acceptable loss in path optimality of 16%.
  • Encrypted Forwarding: Offers high privacy for data in transit with minimal performance impact (15 ms overhead) but lacks anonymity, as traffic analysis remains possible.
  • Anonymous Networks (ITor-SDN): Provide maximum anonymity, have moderate latency overhead (65% reduction compared to vanilla Tor but still 1.8 s), and experience a throughput penalty (40% improvement yet remain below Clearnet speeds).
Design recommendations should align with privacy requirements for method selection. For regulatory compliance with standards such as GDPR and HIPAA, federated learning or encrypted forwarding is adequate. In adversarial scenarios like dissident communications, anonymous networks become essential, despite potential performance costs.

8. Security: Data Integrity

Data integrity in SDWSN ensures that the transmitted sensor readings remain unaltered and the sources are authenticated. Two papers discuss trust evaluation and tamper detection using machine learning.

8.1. Trust-Based Routing

Zhang et al. [36] proposed the QTSRA method, which combines Dempster–Shafer evidence theory with Q-learning for trusted routing in Software-Defined Network and Wireless Sensor Networks (SDN-WSNs). The framework is outlined as follows.
Evidence Collection: Tracks packet loss rates, measures the success of interactions, and verifies the correctness of forwarding for each node.
Credibility Computation: The Dempster–Shafer theory combines evidence to assign trust scores on a scale from 0 to 1.
Q-Learning Routing: The agent selects paths that balance hop-count minimization and node reliability maximization.
The simulation conducted in NS3 using a 50-node topology against black-hole and flood attackers demonstrates the following findings:
  • Throughput: 85% of ideal (vs. 62% for AODV, 68% for OLSR);
  • Delay: 120 ms average (vs. 180 ms AODV);
  • Path Trustworthiness: 0.91 mean score (vs. 0.64 AODV).
QTSRA successfully isolates malicious nodes within 15 routing episodes, preventing them from forwarding data.
Limitation: Trust initialization assumes that all nodes begin with a neutral score of 0.5. In scenarios where nodes are pre-compromised, such as in supply-chain attacks, the challenge of initial trust assignment remains an unresolved issue.

8.2. Cryptographic Data Integrity

Qazi et al. [35] (Section 7.4) presented an encryption method that ensures confidentiality and integrity through matrix multiplication. However, their scheme does not utilize Message Authentication Codes (MACs) or digital signatures, resulting in implicit rather than explicit integrity verification.

8.3. Design Implications

A critical gap in data integrity persists within the ML-SDWSN literature: only 2 of 46 surveyed papers (4.3%) directly address integrity, with the overwhelming majority prioritizing detection systems (IDSs) rather than prevention via cryptographic guarantees. This imbalance highlights a prevailing reactive rather than proactive security posture in current research.
Existing approaches cluster into two complementary strategies:
  • Trust-Based Routing: Effective for identifying and isolating compromised nodes through behavioral analysis. For instance, QTSRA achieves 85% throughput with a trust score of 0.91, but this method relies on initial trust bootstrapping and presumes honest initialization.
  • Cryptographic Integrity: Delivers stronger security guarantees yet lacks formal security analysis in the surveyed literature. Matrix-based schemes incur a 15 ms overhead and require additional safeguards against known plaintext attacks.
Underexplored Solutions: Lightweight digital signature schemes (e.g., EdDSA and ECDSA), which are well-suited to the constraints of IoT environments, are notably absent from the SDWSN literature. Likewise, while blockchain-based integrity verification (as briefly mentioned in ITor-SD [34]) can provides a tamper-proof audit trail, it has not been systematically evaluated for sensor data integrity.
Recommendation: Adopt a hybrid approach that integrates trust-based routing for dynamic threat detection with lightweight cryptographic mechanisms for end-to-end integrity verification. Such a solution—addressing both behavioral and cryptographic security dimensions—remains absent from existing literature and represents a promising direction for future research.

9. Routing Optimization

Efficient routing in SDWSN must adapt to dynamic topology changes, heterogeneous link qualities, and diverse traffic demands. This section examines 25 routing approaches, focusing on 11 unique papers, organized by algorithmic family and deployment architecture.

9.1. Reinforcement Learning-Based Routing

RL excels in routing due to its trial-and-error learning approach, which aligns well with the sequential decision-making nature of path selection. In total, ten papers utilize variants of RL.

9.1.1. Graph-Based Deep RL

He et al. [37] presented GRL-R, which combines a custom Graph Convolutional Network (CeGCN) for the co-embedding of nodes and edges with the Soft Actor–Critic (SAC) method for optimization of continuous link weights. The three-layer architecture is outlined as follows:
  • Co-Embedding GCN: Produces joint representations that capture topology and dynamic metrics, including bandwidth, delay, and packet loss;
  • SAC Agent: Produces link weights that optimize the composite reward, i.e.,
    R = w 1 · throughput − w 2 · delay − w 3 · packet_loss ;
  • Safe Learning Mechanism: This mechanism ensures reliability during link failures by utilizing a constraint-satisfaction layer.
An evaluation of the NSFNET and GEANT2 topologies shows the following:
  • Throughput: 18% improvement over OSPF and 12% over Q-routing;
  • Packet Loss: Reduced by 35% under congestion;
  • Convergence: The training process consists of 200,000 steps, compared to 500,000 steps for the standard DQN.
The co-embedding innovation captures critical node–edge interactions for QoS-aware routing; edge features alone, using the standard GNN approach, overlook vital node-specific constraints such as buffer capacity.

9.1.2. Multi-Agent Distributed RL

Angi et al. [38] proposed ROAR, which deploys independent reinforcement learning agents in each P4-programmable switch. Unlike centralized reinforcement learning approaches, such as GRL-R, these agents cooperatively learn optimal forwarding policies through distributed training. The following metrics apply for each agent:
  • State: Current destination, next-hop destination, and the last two routing actions;
  • Action: Select an outgoing port from the available interfaces;
  • Reward: R i = α 1 ( 1 − β 1 ) − α 2 q − α 3 β 2 − α 4 β 3 d , where: α i are hyperparameters, β 1 indicates correct routing, q is the queue delay, β 2 indicates packet drop, β 3 indicates a spine switch, and d is the hop distance.
Agents update policies every 10,000 packets using a three-layer neural network with 50, 30, and 20 neurons. This evaluation was conducted on a Mininet leaf-spine topology utilizing realistic Datacenter TCP (DCTCP) traffic:
  • Throughput: 27% higher than OSPF and 15% higher than QR-SDN under high load.
  • Latency: 42% lower than OSPF, specifically in tail latency (P99).
  • Packet Loss: 0.3% compared to 2.1% for OSPF at 80% link utilization.
The distributed architecture removes the single-point controller bottleneck but introduces coordination challenges. ROAR addresses this issue through topology knowledge sharing, where agents broadcast link-state information every 5 s.

9.1.3. Q-Learning for Time-Sensitive Routing

Garcia-Canton et al. [39] addressed Time-Sensitive Networking (TSN) requirements for ultra-reliable low-latency communication (URLLC). Their Deep Q-Network (DQN) agent jointly optimizes the following:
  • Routing: Selecting the best path from the source to the destination;
  • Scheduling: Allocating time slots for each link to prevent conflicts.
Modeled as a Markov Decision Process (MDP) with state encoding for packet parameters such as length, period, delay bound, current node, accumulated delay, and link availabilities, the agent employs an ε -greedy policy with ε set to 0.1 and utilizes optimized hyperparameters:
  • Batch size: 6;
  • Target network update: every 400 steps;
  • Learning rate: 0.0001;
  • Discount factor γ : 0.999.
In evaluations of synthetic TSN topologies, DQN successfully routes all flows within delay bounds while ensuring an even distribution of load. This approach is compared to the Integer Linear Programming (ILP) baseline:
  • Scalability: Solves 100-flow scenarios in 2.3 s (vs. 180 s ILP);
  • Optimality Gap: 5% suboptimal but acceptable for real-time constraints.
This highlights the advantage of reinforcement learning in NP-hard routing problems: achieving a 5% sacrifice in optimality allows for a 78× speedup, enabling online adaptation that is impossible with exact optimization.

9.2. Graph Neural Network Routing

GNNs effectively represent network topologies as graphs, making them suitable for routing. Four research papers utilize GNN architectures.
Tsegaye and Sacchi [40] utilized graph convolutional networks in Beyond-5G non-terrestrial networks, specifically in low Earth orbit (LEO) satellite Cloud Radio Access Networks (C-RANs). Their monitoring solution is outlined as follows:
  • Graph Construction: Nodes represent gNB-CU/DU pods, while edges correspond to F1 interface links, which include delay metrics.
  • Training: Offline training of the Graph Convolutional Network (GCN) is conducted using historical traffic and topology data.
  • Operation: The system detects link failures in real time and predicts delay anomalies.
  • Mitigation: Automatic rerouting occurs via the Mosaic5G operator, directing traffic to closer satellites.
Results indicate that GCN-driven rerouting achieves a 31% reduction in average end-to-end delay and a 48% decrease in jitter compared to static routing, thereby satisfying URLLC quality-of-service requirements (less than 10 ms latency, less than 1 ms jitter), even in dynamic low Earth orbit environments.
Generalization Capability: GCNs trained on one satellite constellation topology can generalize to different configurations, such as when tested on 12-satellite versus 24-satellite systems, unlike heuristics that are specific to a single topology.

9.3. Traditional ML for Path Selection

9.3.1. Regression-Based Bandwidth Prediction

Al-Najjar et al. [41] integrated Hecate AI/ML traffic engineering with PolKA source routing. Their framework is outlined as follows:
  • Telemetry Collection: Collect real-time flow metrics using SDN switches.
  • Supervised Regression: Predict end-to-end path bandwidth based on the last 10 measurements.
  • Optimization: Balance bandwidth, latency, and congestion using predicted QoS.
  • Path Installation: PolKA configures source-routing labels.
The wireless LTE/WiFi dataset was tested on an emulated P4 testbed:
  • Prediction Accuracy: RMSE values of 6.7 Mbps for LTE and 14.2 Mbps for WiFi;
  • Path Migration Latency: Reduced from 850 ms to 320 ms;
  • Multipath Throughput: Achieved a 23% improvement through intelligent load distribution.
The regression approach is less computationally intensive than RL, with inference times of 2–5 ms; however, it necessitates retraining when network conditions change significantly.

9.3.2. Neural Network Reliability Prediction

Ghosh et al. [42] introduced iRaaS (Intelligent Routing as a Service) for knowledge-defined networks. The three-tier design is outlined as follows:
  • Client Layer: Gathers topology graphs from SDN and non-SDN controllers;
  • Telemetry Framework (ShellMon): Collects KPI streams using REST/AMQP protocols;
  • Server Layer: Implements routing logic enhanced by RNN-based link reliability predictions.
The RNN model predicts the probability of link failure over the next 60-second window based on historical packet loss, latency variance, and control-plane events. Integration with Dijkstra’s algorithm provides reliability-aware shortest paths. A proof of concept demonstrated on Mininet-ODL shows the following:
  • Convergence Time: 120 ms for a 50-node topology (compared to 450 ms for reactive recovery);
  • Proactive Rerouting: Reduces 73% of potential failures by predicting instability.

9.4. Clustering and Optimization-Based Routing

9.4.1. UAV-Assisted WSN Data Collection

Deepankumar et al. [43] compared the RPL and SDN-WISE protocols in scenarios involving UAV mobile sinks. Their methodology is as outlined as follows:
  • K-Means Clustering: Group sensor nodes and identify their centroids.
  • Ant Colony Optimization (ACO): Solve the Traveling Salesman Problem for UAV trajectories.
  • Routing Protocol: Use RPL or SDN-WISE for data forwarding to UAVs.
Performance metrics at different node densities (ranging from 50 to 250 nodes):
  • Average E2E Delay: SDN-WISE achieves 45 ms (compared to 78 ms for RPL) due to centralized path computation.
  • Packet Delivery Ratio: RPL: 94.2%; SDN-WISE: 91.8% (RPL’s distributed nature manages mobility more effectively).
  • UAV Energy Consumption: SDN-WISE: 12% lower (by optimizing hovering positions).
Identified Trade-Off: SDN-WISE optimizes latency and energy efficiency but requires reliable connectivity between the controller and UAV. RPL prioritizes robustness in intermittent connectivity scenarios at the expense of efficiency.

9.4.2. Cognitive Radio Game Theory

K et al. [44] proposed the Cognitive Radio Multi-Stage Game Theory (CR-MSGT), which combines spectrum sensing, game-theoretic channel selection, and SDN routing in sensor nodes:
  • Availability of the sense spectrum (detection of primary users);
  • Engage in a multi-phase game for channel access;
  • Route data through paths optimized by Software-Defined Networking (SDN).
Using Gaussian filtering at cluster heads decreases data redundancy by 40%, helping to conserve energy. Simulations demonstrate this effectiveness:
  • Network Lifetime: 38% extension compared to traditional WSN routing;
  • Throughput: 22% increase achieved through cognitive spectrum access;
  • Collision Rate: Reduced by 65% through game-theoretic coordination.

9.5. Lightweight SDN Routing for IoT

Three papers focus on efficient routing in resource-constrained environments.

9.5.1. Threshold-Based Signaling Reduction

Djennadi et al. [45] introduced e-SDN, designed for smart-building Low-Power and Lossy Networks (LLNs). Key optimizations include the following:
  • NSU Regulation: Node-state updates sent only when RPL metrics change by more than a 15% threshold;
  • Proactive Flow Establishment: Predefined rules for scheduled traffic, such as periodic sensor readings;
  • Adaptive Parameters: Dynamic RPL configuration for day and night operation modes.
Contiki-based performance tests show the following:
  • Signaling Overhead: Reduced by 52%;
  • Energy Consumption: 48% lower compared to standard SDN-LLN;
  • Access Delay: Eliminated for periodic traffic (0 ms vs. 120–180 ms reactive).
This shows that merging SDN’s centralized intelligence with protocol-level optimizations facilitates deployment in ultra-constrained IoT scenarios once deemed unsuitable for SDN.

9.5.2. Energy-Efficient Cluster-Head Selection

Shreeram Hudda et al. [46] proposed MMulCriApp, which integrates DBSCAN clustering with Multi-Criteria Decision Analysis (MCDA) for energy-aware routing. The framework is outlined as follows:
  • DBSCAN Clustering: Groups nodes based on proximity, thereby reducing dataset size;
  • MCDA Methods: RCA, RRA, and SRA select cluster heads considering residual energy, distance to the sink, and cluster density;
  • SDN Routing: The controller aggregates cluster data through optimal paths.
MATLAB simulations involving a 200-node wireless sensor network (WSN) demonstrate that the MMulCriApp method outperforms methods that rely solely on ML:
  • Energy Consumption: 31% reduction;
  • Active Nodes (after 5000 rounds): 68% compared to 42% (K-means);
  • Data Delivery: 94% success rate sustained throughout the lifetime.
The MCDA approach balances multiple objectives—energy, distance, and load—without the overhead of machine learning training, making it suitable for dynamic topologies where retraining is impractical.

9.6. Comparative Analysis: ML vs. Traditional Routing

Tang et al. [47] conducted a systematic benchmarking of ML-based routing methods, specifically those using Deep RL integrated with Graph Neural Networks (GNNs), comparing them against traditional algorithms like Shortest Available Path and Load Balancing. This comparison took place across NSFnet and GEANT2 topologies under various network conditions.
Their comprehensive evaluation found that traditional algorithms often deliver comparable or even superior bandwidth allocation performance, achieving up to 17% better outcomes under heterogeneous capacity distributions, all while incurring significantly lower computational costs. Although ML methods show advantages in scenarios with high packet loss—attaining delivery success rates up to 40% higher by intelligently avoiding unreliable links—they necessitate extensive training, considerable computational resources, and may perform poorly in network conditions that differ from those encountered during training.
The study establishes decision frameworks, highlighting that traditional algorithms remain effective for well-characterized traffic patterns. In contrast, ML methods justify their complexity mainly in dynamic and unreliable networks characterized by non-stationary traffic.

9.7. Performance Analysis and Design Implications

Table 4 provides a summary of various routing approaches evaluated against key metrics.
Table 4. Comparative performance of routing approaches.
Design Guidelines:
Algorithm Selection by Scenario:
  • Dynamic Traffic, QoS-Critical: Deep reinforcement learning (GRL-R, ROAR) achieves a 15–27% increase in throughput and enables adaptive optimization.
  • Ultra-Low Latency (URLLC): Deep Q-Network (DQN) with integrated routing and scheduling ensures compliance with Time-Sensitive Networking (TSN).
  • Predictable Traffic: Regression-based prediction (Hecate + PolKA) achieves an adaptation time of 320 ms.
  • Resource-Constrained IoT: Lightweight solutions (e-SDN and MMulCriApp) reduce energy consumption by 30–50%.
  • Mobile Sinks/UAVs: Trajectory optimization is achieved through a hybrid approach using RPL-SDN or Ant Colony Optimization (ACO).
Deployment Architecture:
  • Centralized RL: This approach is suitable for environments with fewer than 100 nodes. Beyond this limit, the controller may become a bottleneck.
  • Distributed Multi-Agent RL: This method can scale to data-center environments with over 100 switches, but it requires careful coordination among agents.
  • P4-Integrated: This configuration allows for line-rate decision-making; however, it restricts the use of more complex models by only supporting neural networks with fewer than 1000 parameters.
Training Considerations:
  • RL Convergence: Requires 200,000 to 500,000 training steps; offline simulation is necessary before deployment.
  • GNN Generalization: Pre-train on diverse topologies, which vary from 30% to 50%, to enable transfer learning.
  • Regression Models: Retrain every 24 to 48 h to account for traffic-pattern drift.

10. Quality-of-Service Management

QoS in SDWSN includes latency guarantees, bandwidth allocation, jitter control, and admission management. This section analyzes 21 QoS optimization approaches sourced from 10 to 12 unique papers, many of which incorporate routing or efficiency objectives.

10.1. Latency-Aware Traffic Management

10.1.1. Compression and Multipath Optimization

Feng et al. [48] introduced COMPRESSO, a solution designed to optimize latency-aware data transmission for IoT devices. The framework is outlined as follows:
  • Batching: Aggregates sensor readings into fixed-size bundles;
  • Compression: Utilizes lossless algorithms such as LZ4, Zstandard, and Brotli;
  • Multipath QUIC: Facilitates transmission over multiple SDN paths.
The optimization problem (O-STOCED) minimizes end-to-end latency while considering compression overhead and network conditions. It is NP-hard and is solved using heuristic ranking compression algorithms based on a ratio-over-overhead metric. Simulations were conducted on the Abilene, Chinanet, and Ion topologies:
  • Latency Reduction: Improved by 15–40 ms compared to the single-path uncompressed configuration;
  • Decision Time: Less than 50% of the optimal ILP solver (sub-second compared to minutes);
  • Compression Ratio: Average of 2.3× (varies by data type).
Key Insight: Compression benefits are related to data entropy. Highly redundant sensor data, such as temperature readings with 0.1 °C precision, can achieve compression ratios of 3 to 4 times. In contrast, diverse IoT streams like video, audio, and binary commands yield only 1.5 to 2 times compression.

10.1.2. Admission Control with Q-Learning

Pourrashidi Shahrbabaki et al. [49] proposed SDNQ for management of IoT video flows in the edge-cloud continuum. The Q-learning agent makes three decisions for each flow:
  • Admit or Block: Decide based on network congestion and latency requirements.
  • Routing: Choose a path that minimizes the cost function by balancing latency and admission rates.
  • Offloading: Determine the processing location based on server load—either edge or cloud.
The MDP formulation includes the following elements:
  • State: A vector of per-flow latencies, link utilization, and server loads;
  • Actions: Block or admit flows and select from 5 to 10 candidate paths;
  • Cost function: C ( s , a ) = B k + C k + D k , where
    –
    B k is the penalty when L ¯ s k + σ s k ≥ τ k (latency threshold violation);
    –
    C k is the unitary penalty for blocking flow ( a = 0 );
    –
    D k = std ( s ′ ) , if std ( s ′ ) = 0 , 0 , if std ( s ) = std ( s ′ ) , std ( s ′ ) std ( s ) , otherwise .
Numerical evaluations demonstrate that SDNQ achieves a latency of less than 50% compared to greedy admission baselines while only blocking 3–5% of flows, in contrast to the 12% blockage seen with greedy methods under high load. The Q-learning approach effectively learns optimal rejection policies by blocking delay-tolerant flows to preserve resources for latency-critical video.

10.2. Predictive QoS Management

Path-Failure Prediction:
Alawadh et al. [50] introduced DYNAPARC for industrial IoT-Fog networks, which combines proactive secondary path pre-installation with reactive calculations. The five-module SDN controller consists of the following components:
  • Monitoring: Provides real-time metrics on link quality;
  • Intelligent Analysis: Utilizes a feedforward neural network to predict the probability of link failure over windows of 10 to 60 s;
  • Routing: Pre-installs backup paths for links with a failure probability greater than 30%;
  • Failure Detection: Enables rapid local detection in less than 50 ms;
  • Recovery: Ensures immediate switchover to the pre-installed paths in the event of a link failure.
DYNAPARC consistently achieves QoS scores greater than 0.975 both before and after failures, compared to a reactive recovery score of 0.72. This results in a 67% reduction in packet loss through AI-integrated optimization, with a mean recovery time of 85 ms, which is significantly quicker than the 2.3 s of reactive recovery.
The neural network, which consists of three hidden layers with 20, 15, and 10 neurons respectively, is trained using historical failure events such as link congestion, physical layer errors, and power fluctuations. An analysis of feature importance reveals the following contributions:
  • Link utilization variance: 32% importance;
  • Packet-loss trend: 28%;
  • Control-plane event frequency: 18%;
  • Physical-layer SNR degradation: 22%.

10.3. Traffic Classification and QoS-Aware Clustering

10.3.1. Ensemble Learning for Smart Grid

Patel et al. [32] implemented a three-layer architecture for smart grids, which is discussed in Section 6.5.2 regarding privacy. The layers are described as follows:
  • Smart-Grid Layer: This layer includes energy plants and IoT devices.
  • Ensemble Learning Layer: In this layer, LightGBM is used to classify 20 different types of traffic into 7 distinct classes.
  • Clustered SDN: This layer features controllers that are organized into clusters based on traffic predictions.
The clustering strategy organizes controllers that manage similar types of traffic, allowing for the following benefits:
  • Specialized QoS Policies: Prioritization of real-time energy monitoring traffic over non-critical IoT communications.
  • Load Distribution: A 35% reduction in load on each controller compared to a flat hierarchy.
  • Fault Tolerance: Cluster redundancy helps eliminate single points of failure.
LightGBM classification achieves 98.3% accuracy and an ROC-AUC of 0.9997, enabling traffic categorization in under 5 ms. This meets the smart-grid latency requirements (less than 10 ms for protection relays).

10.3.2. Load Balancing via Stacking Classifier

Shah et al. [51] introduced FAST, a method that utilizes a stacking ensemble approach—comprising Logistic Regression, Decision Trees, and Random Forest—to classify network flows, which are then distributed to dedicated SDN clusters. The method was tested on a dataset of 2.7 million flows, resulting in the following metrics:
  • F1-Score: 0.9641;
  • ROC-AUC: Ranges from 0.90 to 1.00 across different traffic classes;
  • PR-AUC: Ranges from 0.91 to 1.00;
  • Latency Reduction: 28% compared to a single-controller setup;
  • Scalability: Demonstrates linear scaling up to 10 controller clusters.
The stacking meta-learner corrects misclassifications from the base learners, improving accuracy by 4% over a single Random Forest while adding only 3 ms of latency.

10.4. QoS in Specialized Domains

10.4.1. Non-Terrestrial Networks

Rojas et al. [52] developed MeteorNet, a continuous-time emulation framework designed for Low Earth Orbit (LEO) constellations, incorporating SDN and Mobile Edge Computing (MEC). The framework utilizes SGP4 orbit propagation and contact tables to manage dynamic link parameters, which include the following:
  • Delay Modeling: Latency between LEO satellites and ground stations ranges from 25 to 50 ms, along with dynamic inter-satellite links.
  • Capacity Variation: Bandwidth fluctuates between 10 and 100 Mbps, depending on the elevation angle of the satellites.
  • Topology Changes: Satellite positions change every 1 to 3 s as they move.
The Ryu-based SDN controller utilizes the Spanning Tree Protocol to prevent loops and facilitate MEC task offloading. A case study focused on a ring topology generates synthetic datasets, including ping measurements and task completion times, which are used to train machine learning-driven routing models. This framework highlights the limitations of standard protocols, such as the slow convergence of OSPF in response to NTN dynamics, thereby guiding the development of GNN-based adaptive routing solutions.

10.4.2. QoS for DDoS Mitigation

Kumar and Kolhe [53] incorporated QoS parameters into their DDoS mitigation strategy, focusing on prioritizing legitimate traffic during attacks. Their approach consists of the following steps:
  • Traffic Filtering: They employ a machine learning classifier (such as Random Forest, Support Vector Machine, k-Nearest Neighbors, or artificial neural networks) trained on the CIDDS-001 dataset.
  • QoS Prioritization: Traffic is categorized into classes (0–7) based on the type of application.
  • Flow-Rule Installation: High-priority rules are established for legitimate traffic, while rules that drop traffic are applied to potential attacks.
During a DDoS attack, critical services like healthcare and emergency services maintain over 95% throughput while attack traffic is rate-limited or discarded. This ensures the availability of essential services, even under heavy load.

10.5. Performance Analysis and Design Implications

Table 5 summarizes QoS management approaches.
Table 5. Comparative Performance of QoS management approaches.
QoS Design Guidelines:
1. Proactive vs. Reactive QoS:
  • Predictive Approaches (DYNAPARC, SDNQ): These methods can reduce recovery time by over 90%, but they require historical data for training.
  • Reactive Approaches: These are easier to implement but may cause disruptions lasting 2 to 3 s during failures.
  • Recommendation: It is advisable to use proactive approaches for critical infrastructure, such as industrial IoT and healthcare, while reactive approaches are acceptable for best-effort services.
2. Traffic Classification Granularity:
  • Coarse (seven classes): Classification in under 5 ms, ideal for real-time QoS;
  • Fine (20 types): Latency of 10–15 ms, suitable for offline traffic engineering.
3. Admission Control Policies:
  • Q-Learning: Achieves optimal long-term throughput but requires training of over 50,000 episodes;
  • Rule-Based: Allows for immediate deployment but results in suboptimal performance with 12% unnecessary rejections;
  • Hybrid: Initially utilizes rules, gradually transitioning to trained Q-policies.

11. Network Efficiency Optimization

Energy efficiency is crucial in resource-constrained wireless sensor network (WSN) deployments. This section examines 15 optimization approaches focused on efficiency, concentrating on 12 unique papers, covering topics such as energy harvesting, load balancing, sleep scheduling, and computational offloading.

11.1. Energy-Aware Protocols

11.1.1. Gaussian Filtering for Data Reduction

K et al. [44] (Section 9.4.2) used Gaussian filtering at cluster heads, which reduces redundant sensor transmissions by 40%. The filter smooths temporal readings, eliminating updates caused by noise. Combined with CR-MSGT routing, the network lifetime increases by 38% due to reduced radio-on time.

11.1.2. Cognitive Radio-Spectrum Efficiency

The same work shows that cognitive radio integration enhances spectrum efficiency by 22% through opportunistic access to licensed bands when primary users are not present. Game-theoretic channel selection reduces interference while maximizing throughput per unit of energy.

11.2. Computational Efficiency

11.2.1. Feature Selection for Edge Devices

Sindhula and Pradeep [28] (Section 6.2.2) achieved an 85% reduction in memory usage, decreasing it from 312 MB to 41.3 MB through the use of ensemble feature selection. This significant reduction allows for deployment on ARM Cortex-M4 microcontrollers. Additionally, the training time was reduced from 18.4 s to just 2.21 s, which is critical for online learning scenarios that require frequent retraining.

11.2.2. Autoencoder Compression

Sivakumar and Jeyaselvi [19] (Section 5.2) employed autoencoders to reduce 78-dimensional features to 12 dimensions while maintaining a classification accuracy of 95.71%. The runtime decreased from 0.15 s to 0.002 s, achieving a 75× speedup, which enabled real-time edge inference on Raspberry Pi devices.

11.3. Controller Efficiency

11.3.1. Edge Offloading

Belachew et al. [18] (Section 5.2) showed that edge-based machine learning inference reduces controller CPU usage by 60% and latency by 83%. This architectural pattern appears in 11 of the 45 surveyed papers published after 2024, indicating a strong trend toward edge intelligence.

11.3.2. Distributed Control

Tyagi et al. [54] proposed a load-sharing control-node migration (LS-CNM) strategy for 6G Internet of Everything (IoE) WSN. Their approach includes the following key components:
  • Optimal Controller Count: An articulation-point analysis is conducted to determine the minimum number of controllers required, balancing latency and synchronization.
  • Placement: A nature-inspired algorithm known as cheetah optimization is used to minimize end-to-end latency through strategic placement of controllers.
  • Partial Migration: Instead of full migrations that can cause oscillations, overloaded controllers migrate a subset of their clusters to under-utilized assistants.
Evaluated using ONOS and ns-3:
  • Overload Frequency: Decreased by 68%;
  • Round-Trip Time: 34% lower compared to single-controller SDN;
  • Average Delay: 42% enhancement.
The partial migration innovation prevents thrashing, as full cluster movements can create new overload situations. LS-CNM avoids this by migrating only 20–40% of the load.

11.4. Protocol Overhead Reduction

11.4.1. Signaling Optimization

Djennadi et al. [45] (Section 9.5.1) reduced SDN signaling overhead by 52% through threshold-based node-state updates and proactive flow establishment. Additionally, energy consumption decreased by 48% compared to reactive SDN-LLN.

11.4.2. Flow-Table Efficiency

Sathish et al. [11] (Section 5.1.1) demonstrated that the DoSGuard ensemble reduces flow-table overhead by 31% compared to ILP approaches through collaborative learning across subdomains. By distributing detection, each controller manages smaller flow tables containing only locally relevant rules.

11.5. Evaluation Efficiency

Saghir et al. [55] evaluated Software-Defined Networking (SDN) for traffic management in WSNs, comparing the AODV protocol with SDN-enabled networks across ten test cases in Mininet. The results indicate the following improvements:
  • End-to-End Latency: A reduction of 35% when using the shortest-path SDN approach compared to AODV’s reactive method;
  • Throughput: An increase of 28%;
  • Packet Loss: 0.8% in SDN-enabled networks compared to 3.2% in AODV networks.
The POX controller using a grid topology shows that simple SDN implementations are more efficient than traditional WSN protocols.

11.6. Performance Analysis and Design Implications

Table 6 provides a summary of the efficiency improvements observed across various approaches.
Table 6. Comparative efficiency improvements.
Efficiency Design Guidelines:
1. Energy Optimization Hierarchy:
  • Data Reduction (Gaussian filtering): Achieves a 40% reduction in transmission costs without any loss in accuracy;
  • Efficient Routing (through CR-MSGT and e-SDN): Provides 30–50% energy savings by optimizing data paths;
  • Hardware Optimization: Involves utilizing low-power radios and implementing duty cycling, which, although outside the scope of machine learning, serves as a complementary approach.
2. Computational Efficiency Techniques:
  • Feature Selection: Implement this technique when memory usage is below 1 GB or when inference latency exceeds 50 ms.
  • Dimensionality Reduction (Autoencoders): This method is suitable for high-dimensional data (more than 50 features) that contain redundancy.
  • Model Pruning: This approach was not explored in the reviewed papers, representing an open research direction.
3. Scalability Approaches:
  • Edge Offloading: Ideal for environments with more than 1000 nodes, as the controller can become a bottleneck in performance;
  • Distributed Controllers: Essential when dealing with more than 5000 nodes; implement partial migration to prevent oscillations in the network;
  • Hierarchical Architecture: Combines lightweight edge models with comprehensive controller models to create a system of hybrid intelligence.

12. Quantitative Trend Synthesis

This section synthesizes reported performance values from the surveyed domains. These values, derived from more than 120 experimental configurations across 46 papers, reflect substantial diversity in datasets, attack definitions, network topologies, controller architectures, hardware resources, traffic conditions, and validation environments. Consequently, the summarized values should not be interpreted as directly comparable measurements of algorithmic or architectural performance.
  • Methodological Note.
The reviewed studies exhibit significant heterogeneity along several key dimensions:
  • Datasets and Tasks: CICIDS2017, CSE-CIC-IDS2018, UNSW-NB15, CIC-DDoS2019, custom traffic traces, and Mininet-generated datasets and task-specific security, routing, QoS, or efficiency objectives;
  • Network and Deployment Conditions: Different node counts, communication assumptions, routing structures, controller placements, and edge or cloud resources;
  • Validation Platforms: Simulation (e.g., NS3 and MATLAB), emulation (e.g., Mininet, GNS3, and Containernet), and a limited number of real-hardware testbeds;
  • Measurement Definitions: Studies report different quantities under similar labels, including per-flow inference time, end-to-end detection time, mitigation time, and total execution time.
Accordingly, descriptive distributions of values are presented as reported in the source studies. Where data permit, the observed range, median, interquartile range, and number of papers or experimental configurations reporting each measure are included. These summaries represent reported-value aggregates, not pooled effect estimates, formal meta-analytic statistics, confidence intervals, or controlled comparisons. As such, they do not establish universal algorithmic superiority, causal architectural effects, or deployment-ready performance guarantees.

12.1. Distribution of Reported ML Performance Values

Supervised Learning Classification Accuracy:
  • Random Forest: Reported accuracies range from 94.2% to 99.9% across 23 papers.
  • XGBoost: Reported accuracies range from 95.71% to 99.99% across 18 papers.
  • Decision Tree: Reported accuracies range from 91.3% to 99.97% across 12 papers.
  • Deep Neural Networks: Reported accuracies range from 94.8% to 100% across 10 papers.
  • Support Vector Machines (SVMs): Reported accuracies range from 89.2% to 99.0% across nine papers.
  • k-Nearest Neighbors (k-NN): Reported accuracies range from 88.5% to 98.5% across eight papers.
  • Naive Bayes: Reported accuracies range from 85.7% to 97.2% across seven papers.
Ensemble Methods:
  • Stacking/Voting: Reported accuracies for stacking and voting ensembles range from 97.4% to 100%, based on a total of 11 papers.
  • In many IDS and DDoS configurations, ensemble methods yield only slight improvements in accuracy compared to robust single-model baselines, yet they require greater computational resources for training and inference
  • Key Observations.
XGBoost and Random Forest consistently rank among the top performers in security-focused configurations and frequently serve as baseline models. Ensemble methods generally yield the highest reported accuracies; however, their incremental improvements over strong single-model baselines are typically modest, particularly given their greater computational and implementation costs. In contrast, traditional classifiers such as SVM, k-NN, and Naive Bayes exhibit broader variability in reported performance across different datasets and experimental conditions. This variability suggests increased sensitivity to feature engineering, traffic characteristics, and hyperparameter selection. These findings should be interpreted as indicative patterns in reported results rather than as universal performance rankings or deployment-ready endorsements for any specific algorithm family.
Reinforcement Learning Performance Gains:
  • Throughput Improvement: Studies that directly compare RL-based routing with OSPF under comparable traffic models report throughput gains clustering around 20.3%, with individual improvements ranging from 12% to 42% (10 papers).
  • Latency Reduction: Reported latency reductions for RL-based routing relative to OSPF span from approximately 18% to 52%, with a representative mean of 32.5% observed across eight papers.
These figures represent illustrative trends within specific experimental settings and should not be interpreted as universally applicable guarantees.

12.2. Dataset Usage Patterns

Most Common Datasets:
  • CICIDS2017: 18 papers (39%)
  • CSE-CIC-IDS2018: 12 papers (26%);
  • CIC-DDoS2019: 5 papers (10.8%);
  • UNSW-NB15: 4 papers (8.6%);
  • Custom/Mininet-Generated: 15 papers (32.5%).
Cross-Dataset Generalization (Figure 4): Only 15.2% of papers (7 of 46) test on multiple datasets. When tested,
Figure 4. Cross-dataset generalization performance shows a decline in accuracy when models trained on one dataset are evaluated on different ones.
  • Accuracy drops 5.2%, on average (CICIDS2017 → CICIDS2018);
  • Accuracydrops 7.8%, on average (CICIDS → UNSW-NB15);
  • Accuracydrops 11.3%, on average (Dataset → Custom real traffic)
These observed cross-dataset accuracy degradations underscore a tendency toward overfitting to dataset-specific properties, such as attack signatures, traffic distributions, and feature correlations. For instance, a model achieving 99% accuracy on CICIDS2017 would, based on empirical degradation patterns, be expected to reach only 93.8% on CICIDS2018, 91.2% on UNSW-NB15, and 87.7% on custom real-world traffic. The heavy reliance on CICIDS-family datasets (CICIDS2017: 39%; CSE-CIC-IDS2018: 26%; CIC-DDoS2019: 10.8%—a combined 75.8%) constrains the research community’s ability to rigorously assess model robustness across the full spectrum of operational contexts.
Since few papers assess cross-dataset behavior, generalization estimates require cautious interpretation. However, the evidence consistently shows that evaluating on a single dataset does not provide a sufficient basis for strong claims about deployment readiness.

12.3. Reported Timing Measures by Deployment Architecture

The reviewed studies define timing measures in varied ways. Depending on the context, a reported value may refer to per-flow model inference time, detection-decision time, end-to-end response time, mitigation time, controller rule-installation time, or total workflow execution time. These metrics are not interchangeable and cannot be combined into a single architecture-level latency comparison.
Section 5 and Section 6 present timing measures as reported in the original studies, retaining these figures as study-specific observations rather than directly comparable cross-study latency metrics. The available evidence demonstrates that edge and data-plane deployments can deliver low-latency processing in certain evaluated scenarios. Nonetheless, differences in hardware, workloads, model complexity, feature-processing pipelines, and timing definitions prevent direct comparisons across deployment architectures.

12.4. Experimental Validation Methods

Simulation vs. Emulation vs. Real Testbed:
  • Simulation Only (NS3 and MATLAB): 22 papers (45.8%);
  • Emulation (Mininet, GNS3, and Containernet): 21 papers (47%);
  • Real Hardware Testbed: Four papers (8.6%);
  • Hybrid (Simulation + Emulation): Five papers (10.8%).
Note that these categories are not mutually exclusive; where applicable, hybrid studies are included in both simulation and emulation counts. As a result, the percentages for validation types can exceed 100%.
Studies that incorporate real hardware validation consistently report performance reductions of 15–25% compared to results from simulations or emulations, highlighting a systematic optimistic bias in virtual environments. This validation gap raises a significant credibility concern: only 8.6% of surveyed papers conducted experiments on real hardware, while 92.8% rely exclusively on simulation or emulation. This bias primarily stems from simplified mobility models, idealized channel conditions, and the lack of real-world interference in virtual settings. As a result, very high accuracy claims from simulation-only studies may not translate directly to operational SDWSN deployments. The evidence underscores the optimistic bias inherent in purely virtual environments, reinforcing the need for hybrid validation pipelines and physical testbeds before making strong claims about deployment readiness.

12.5. Scalability Assessment

Network Sizes Evaluated:
  • Small (<50 nodes): 28 papers (50.8%);
  • Medium (50–250 nodes): 16 papers (34.7%);
  • Large (>250 nodes): Four papers (8.6%)
Another limitation in the surveyed scalability evidence is that most studies describe network size mainly by node count, often neglecting to report the physical deployment area or spatial density. This omission is significant in WSN and SDWSN research, as node density directly affects interference, communication range, connectivity, contention, and energy consumption. Consequently, categories like small, medium, and large networks cannot be assumed to represent fully comparable deployment conditions across studies unless area and spatial distribution are clearly specified.
Scalability Trends:
  • Centralized RL approaches experience a 30–40% decrease in performance when exceeding 100 nodes.
  • Edge-based architectures scale linearly up to 1000 nodes, although data becomes limited beyond this point.
  • Distributed multi-agent RL maintains its performance; however, the convergence time increases by two to three times with every additional 100 nodes.

12.6. Temporal Trends (2024–2025)

Algorithm Adoption Over Time:
  • Q1–Q2 2024: Random Forest and XGBoost are the dominant methods, representing 62% of the researched papers.
  • Q3–Q4 2024: The use of ensemble methods increases significantly, rising to 40%, compared to 18% in Q1–Q2.
  • Q1 2025: Federated learning is featured in 15% of the papers, up from just 2% in 2024.
  • Q1 2025: The number of papers on graph neural networks doubles, increasing to eight papers—up from four in 2024.
Temporal trends (shown in Figure 5) in ML algorithm adoption are observed across 46 papers from Q1 2024 to Q1 2025. Three notable shifts have emerged: (1) Ensemble Methods: The use of ensemble methods, such as stacking, voting, and boosting, surged from 18% in Q1–Q2 2024 to 40% in Q3–Q4 2024. This increase reflects practitioners’ recognition of the accuracy gains these techniques provide over single models. (2) Federated Learning: Adoption of federated learning rose from 2% in 2024 to 15% in Q1 2025. This growth is primarily driven by privacy regulations, such as GDPR and HIPAA, as well as the need for collaboration across multiple domains. (3) Graph Neural Networks: The number of papers on graph neural networks has doubled, increasing from four in 2024 to eight in Q1 2025. This trend indicates a growing interest in topology-aware learning, particularly for applications in routing and non-terrestrial networks. In contrast, traditional supervised learning methods, such as random forest (RF) and XGBoost, have maintained a steady adoption rate of 50% across all quarters.
Figure 5. Temporal trends in ML algorithm adoption in 46 papers, along with projected future trends.
Deployment Architecture Shift:
  • 2024: 78% centralized controller-based configurations;
  • 2025: 54% centralized, 23% edge-based, 15% distributed, and 8% hybrid.
This indicates a clear shift towards decentralized intelligence, as shown in Figure 6. Additionally, this trend aligns with the increasing scale of networks, with studies involving more than 100 nodes rising from 12% in 2024 to 31% in 2025. The demand for latency-critical applications, such as ultra-reliable low-latency communication (URLLC) and industrial IoT, which require response times of less than 10 ms, further drives this evolution.
Figure 6. The evolution of deployment architecture from 2024 to 2025.

13. Design Guidelines for Practitioners

This section introduces decision frameworks for ML-SDWSN design and deployment that are grounded in quantitative synthesis (Section 12), hierarchical taxonomy (Section 4), and comparative evidence from Table 2, Table 3, Table 4, Table 5 and Table 6. The decision matrices align use cases with the three core taxonomy dimensions—problem domain, ML technique family, and deployment architecture—offering a coherent, multi-dimensional perspective on design options. These recommendations reflect trends identified across the surveyed literature and should be interpreted as practical, evidence-based guidance, not as universally applicable performance guarantees for all SDWSN contexts.

13.1. Evidence Maturity and Interpretation

Although the reviewed literature offers valuable guidance for selecting algorithms and architectures, the field’s empirical maturity remains uneven. The majority of studies depend on simulation or emulation, with only a small fraction validating results on actual hardware. Cross-dataset testing is also uncommon. As a result, the recommendations presented here should be regarded as evidence-informed heuristics to guide design choices rather than as assurances of production-grade performance. Before final deployment, practitioners should undertake dedicated validation in the intended operational environment, incorporating hardware-in-the-loop experiments and robustness assessments under realistic traffic and interference conditions.

13.2. Algorithm Selection and Deployment Architecture Framework

The deployment of ML-SDWSN solutions entails two interdependent decisions: selecting the most appropriate machine learning algorithm and identifying the optimal deployment architecture. Table 7 aligns use cases with recommended algorithms, considering specific performance requirements and operational constraints. In parallel, Table 8 offers a structured framework for determining the most suitable deployment architecture, accounting for key network characteristics and operational limitations.
Table 7. Algorithm selection decision matrix.
Table 8. Deployment architecture decision matrix.
The flowchart in Figure 7 guides the selection of algorithms for deploying Machine Learning in Software-Defined Wireless Sensor Networks (ML-SDWSNs). Practitioners navigate through four sequential decision points: (1) Network Scale Assessment: Determine whether a centralized or distributed approach is viable. (2) Latency Requirement Evaluation: Choose between edge/P4 deployment and controller-based deployment based on latency needs. (3) Privacy Constraint Analysis: Decide on the appropriate strategy for privacy—options include federated learning, encryption, and anonymization. (4) Resource Availability: Match the complexity of the selected algorithm to the capabilities of available hardware. At the end of this process, practitioners will find recommendations for algorithm families, including Random Forest (RF), XGBoost, Deep Reinforcement Learning (Deep RL), and Federated Deep Neural Networks (DNN), along with expected performance ranges and implementation notes based on the guidelines outlined in Section 12.
Figure 7. Algorithm selection decision flowchart for ML-SDWSN deployment.

13.3. Dataset Selection and Preparation

The choice of dataset exerts a critical influence on model generalization. As demonstrated in Section 12, cross-dataset accuracy typically declines by 5–11%, indicating a pronounced tendency for models to overfit to dataset-specific properties. The following guidelines provide practitioners with strategies for selecting appropriate training data and mitigating common pitfalls.
Selecting Training Datasets:
  • DDoS-Focused: CICIDS2017, CSE-CIC-IDS2018, CIC-DDoS2019, and SDNDDOS2020;
  • General IDS: UNSW-NB15 (featuring a broader range of attacks) and InSDN (specific to SDN);
  • Domain-Specific: Create custom datasets using Mininet/testbed to match the deployment environment.
Although benchmark datasets facilitate reproducible evaluation, they often fail to reflect the full complexity of operational traffic patterns. When deployment conditions diverge substantially from those in benchmark scenarios—such as differing network topologies, application mixes, or attack types—generating custom datasets becomes imperative. This step is crucial for mitigating the 5–11% generalization penalty reported in Section 12.
Addressing Class Imbalance:
  • SMOTE Oversampling: Applicable when the minority class is less than 10%;
  • Weighted Loss Functions: Necessary for extreme imbalance, specifically when attack traffic is less than 1%;
  • Anomaly Detection: Consider using unsupervised methods, such as Isolation Forest, instead of traditional classification.
Feature Engineering:
  • Begin with Standard Flow Features: Include packet and byte counts, duration, port numbers, protocol, flags, and wireless features such as the RSSI and the number of neighboring nodes.
  • Implement Feature Selection: Use methods such as SHAP, ensemble techniques, or Pearson correlation to narrow the field to 10–15 essential features.
  • Incorporate Domain-Specific Features: Add application-layer features, such as DNS query patterns and HTTP headers, when privacy allows.

13.4. Evaluation Best Practices

Robust evaluation methodologies are fundamental to ensuring both the credibility and reproducibility of ML-SDWSN research. The following best practices offer a structured framework for comprehensive performance assessment and comparative analysis.
Metrics to Report:
  • Security Applications: Accuracy, precision, recall, F1 score, false-alarm rate, and detection time;
  • Routing: Throughput, latency (mean, P95, and P99), packet loss, and convergence time;
  • QoS: Service-level objective violations, recovery time, and admission rejection rate;
  • Efficiency: Energy consumption, CPU/memory usage, network lifetime, and protocol overhead.
Validation Methodology:
  • Offline Evaluation: Conduct K-fold cross-validation (with k set to 5 or 10) using benchmark datasets.
  • Simulation/Emulation: Perform tests on OMNeT ++, Mininet, or GNS3 with realistic network topologies and traffic patterns.
  • Real Testbed: Whenever possible, validate results on physical hardware; even small-scale setups can enhance credibility.
  • Cross-Dataset Testing: Evaluate performance using at least two distinct datasets to demonstrate the model’s ability to generalize across different conditions
Baseline Comparisons: Always conduct comparisons based on the following criteria:
  • Traditional Protocol: OSPF (for routing) and reactive mitigation (for security);
  • State-of-the-Art ML: Utilize Random Forest or XGBoost as robust baselines;
  • Recent Related Work: Reference at least two to three recent papers that address the same problem.

14. Research Gaps and Future Directions

Through systematic analysis, we have identified eight critical research gaps, along with specific, actionable research questions.
Although the systematic inclusion window covers only SDWSN studies published between 2024 and 2025, post-2025 research from adjacent fields is occasionally referenced when it introduces learning or control mechanisms directly relevant to the identified gaps, such as few-shot physical-layer robustness, attention-based fault diagnosis, or dynamic event-triggered reinforcement learning. These adjacent-domain studies are cited solely as illustrative examples of emerging techniques. They are not considered SDWSN evidence, nor are they included in the systematic corpus or quantitative synthesis, and they do not represent a comprehensive review of post-2025 research.

14.1. Gap 1: Real-World Deployment Validation

Current State: Only 8.6% of papers validate their findings on real hardware, while 92% rely exclusively on simulation or emulation.
Problem: There is a simulation optimism bias, leading to a performance overestimation of 15–25%. This bias overlooks several critical factors, including the following:
  • Hardware constraints (such as limited CPU resources and memory fragmentation);
  • Implementation complexity (including overhead associated with controller integration);
  • Environmental factors (such as wireless interference and mobility issues).
Research Questions:
  • What are the gaps in accuracy, latency, and resource usage between simulated and real deployments of SDWSNs for machine learning-based IDSs?
  • How do variations in wireless channel dynamics impact the performance of Graph Neural Network (GNN)-based routing compared to simulated network topologies?
  • What practical challenges exist in implementing federated learning in multi-domain operational SDN environments?
Proposed Approach: Create shared physical testbeds (e.g., GENI and Chameleon Cloud) that utilize standardized benchmark scenarios for reproducible real-world validation.
While cyber attacks and network-layer intrusions have received considerable attention, physical-layer threats—such as intentional interference and jamming—remain largely underexplored in the SDWSN literature. The effectiveness of ML-SDWSN control fundamentally relies on robust wireless channels and the capacity to detect and classify interference patterns, even when labeled data are scarce. Emerging research published after 2025, although outside our formal 2024–2025 inclusion window, has begun to address this issue in related domains. For instance, Ding et al. introduced a conditional GAN-based fusion CNN framework for few-shot jamming-signal recognition in GNSS, reporting an 8% accuracy improvement over semi-supervised baselines and validating their approach on hardware-simulated satellite communication scenarios [56]. Although this work focuses on satellite navigation rather than SDWSNs, its integration of generative modeling and few-shot learning offers a promising blueprint for the development of intelligent anti-jamming modules that could be incorporated into SDWSN controllers to strengthen physical-layer resilience.

14.2. Gap 2: Adversarial Robustness

Current State: No research papers address adversarial machine learning attacks, even though the vulnerabilities of evasion, poisoning, and model inversion are well known.
Problem: Attackers can create malicious traffic that evades machine learning classifiers or poison training data in federated learning scenarios.
Research Questions:
  • How resilient are ensemble-based Distributed Denial of Service (DDoS) detectors against gradient-based evasion attacks such as FGSM and CW?
  • Can adversarially trained models achieve over 99% accuracy while maintaining a latency overhead of less than 20 ms in resisting evasion attacks?
  • What defenses can effectively prevent poisoning attacks in federated learning-based IDSs while still upholding privacy guarantees?
Proposed Approach: Incorporate adversarial training, such as robust optimization and certified defenses, along with Byzantine-robust aggregation techniques like Krum and median aggregation, into machine learning pipelines for SDWSNs.

14.3. Gap 3: Cross-Domain Transfer Learning

Current State: Models that were trained on the CICIDS2017 dataset typically experience accuracy decreases of 5% to 11% when evaluated on other datasets or real traffic.
Problem: Overfitting to a specific dataset restricts practical deployment, necessitating retraining for each different environment.
Research Questions:
  • Can meta-learning techniques such as MAML facilitate few-shot adaptation of Intrusion Detection System (IDS) models to new network environments with fewer than 100 labeled samples?
  • What domain-invariant features are present across CICIDS, UNSW-NB15, and real network traffic that support transfer learning?
  • How does pre-training on synthetic augmented datasets enhance generalization in real-world deployments?
Proposed Approach: Develop domain adaptation techniques such as adversarial domain adaptation and domain-invariant feature extraction specifically for the security applications of SDWSN.

14.4. Gap 4: Scalability Beyond 1000 Nodes

Current State: Only 8.6% of evaluations are conducted on more than 250 nodes, with the largest test involving approximately 1000 nodes.
Problem: It is uncertain whether these approaches can be scaled for enterprise or ISP deployments, which typically involve 10,000 to 100,000 nodes.
Research Questions:
  • At what network scale do centralized reinforcement learning routing algorithms become computationally infeasible (i.e., have a convergence time greater than 1 s)?
  • Can hierarchical federated learning (from edge to regional to global) maintain DDoS detection accuracy in networks with over 10,000 nodes?
  • What is the communication overhead associated with distributed multi-agent reinforcement learning in large-scale SDWSN with more than 100 switches?
Proposed Approach: Develop scalable simulation frameworks that enable evaluation using 10 k–100 k nodes with realistic traffic models and validate these frameworks on large cloud or ISP testbeds.
Most existing SDWSN routing studies rely on periodic or event-free control updates, a practice that can result in excessive controller load and unnecessary communication overhead, particularly as network size increases. By contrast, recent advances in human–machine cooperative control introduce dynamic event-triggered mechanisms, which update policies only when accumulated error surpasses a state-dependent threshold. Zhang et al. presented a dynamic event-triggered control framework combining adaptive dynamic programming with a fuzzy logic-based dynamic authority allocation module. This approach achieves resource-efficient policy updates, maintains bounded closed-loop signals, and prevents Zeno behavior [57]. Although their work focuses on human–machine cooperative systems rather than SDWSNs, the core concepts—dynamic event-triggered reinforcement learning updates and adaptive authority allocation—offer promising avenues for reducing control-plane overhead in SDWSN controllers while safeguarding performance and safety guarantees. Future research should investigate event-triggered reinforcement learning and dynamic control-authority allocation within the SDWSN context. Adapting techniques such as dynamic event-triggered thresholds and fuzzy authority allocation, as demonstrated in Zhang et al.’s framework, could enable SDWSN controllers to update routing policies only when warranted, thereby minimizing control-plane traffic and computational burden without compromising convergence or stability.

14.5. Gap 5: Energy–Performance Trade-Off Analysis

Current State: Energy and performance are often reported separately, and there is no analysis of the Pareto frontier.
Problem: Practitioners are unable to make informed trade-offs, such as deciding whether to accept a 5% loss in accuracy in exchange for a 40% reduction in energy consumption.
Research Questions:
  • What is the Pareto frontier of accuracy, energy, and latency for edge-based IDSs using different machine learning algorithms?
  • How do duty cycling and sleep scheduling interact with reinforcement learning-based routing—can energy savings compensate for performance losses?
  • Can multi-objective reinforcement learning optimize throughput, latency, and energy consumption simultaneously in wireless sensor network (WSN) routing?
Proposed Approach: Evaluate algorithms systematically across all dimensions, reporting Pareto fronts and hypervolume indicators for a multi-objective comparison.

14.6. Gap 6: Explainability and Operator Trust

Current State: Only two papers, which represents 4%, integrate explainable AI (XAI). The majority of machine learning models remain black boxes.
Problem: Network operators are hesitant to implement opaque machine learning systems in critical infrastructure because they do not fully understand the decision-making processes behind them.
Research Questions:
  • Can local explainability techniques such as LIME and SHAP provide real-time explanations for deep reinforcement learning (DRL) routing decisions with an overhead of less than 50 ms?
  • What visualization tools can help operators comprehend and, when necessary, override machine learning-based security decisions?
  • How do explainability requirements balance against model accuracy and latency in the context of SDWSN?
Proposed Approach: Develop specialized XAI interfaces for SDWSN operators, including user studies that evaluate trust, usability, and decision quality.
Recent progress in industrial fault diagnosis has yielded architectural innovations that offer valuable insights for IDSs and QoS fault prediction in SDWSNs. For example, a post-2025 study by Wu et al. presented the Multi-Scale Attention Bidirectional LSTM (MA-BLSTM) framework for chemical-process fault diagnosis. This approach integrates multi-scale convolutional feature extraction, residual bidirectional LSTM layers, and an adaptive attention mechanism designed to highlight fault-indicative temporal segments while suppressing noise [58]. Validated on the Tennessee Eastman Process benchmark, MA-BLSTM demonstrates improved robustness and generalization in noisy, high-dimensional industrial datasets. Attention-based temporal models such as MA-BLSTM exemplify how combining multi-scale feature extraction with adaptive attention can enhance both the performance and interpretability of fault diagnosis in complex industrial settings. Although MA-BLSTM has not yet been directly evaluated in SDWSNs, adapting similar multi-scale attention mechanisms and residual sequence models to SDWSN traffic and sensor time series could address existing gaps in explainability and robust fault diagnosis, particularly under non-stationary conditions.

14.7. Gap 7: Heterogeneous Network Integration

Current State: Papers assume a homogeneous SDN-WSN; however, real deployments integrate legacy devices, non-SDN domains, and diverse wireless technologies.
Problem: How do machine learning approaches perform when only 30% to 50% of the network is enabled for SDN?
Research Questions:
  • Can hybrid architectures deploy machine learning in SDN-enabled core networks while interfacing with legacy wireless sensor network (WSN) peripheries without experiencing performance degradation?
  • How does partial observability in non-SDN segments impact the convergence and optimality of RL routing?
  • What federated learning architectures facilitate collaboration between SDN, traditional IP networks, and wireless mesh networks?
Proposed Approach: Design hybrid machine learning frameworks that explicitly model partial SDN deployment and evaluate them on realistic heterogeneous testbeds.

14.8. Gap 8: Zero-Day Attack Detection

Current State: Supervised learning is the dominant approach, accounting for 50% of research papers, as it is trained on known attack signatures.
Problem: Unknown attack types, often referred to as zero-day exploits, can evade detection by signature-based machine learning classifiers.
Research Questions:
  • Can semi-supervised or self-supervised learning effectively detect zero-day attacks without labeled examples while maintaining an acceptable false-positive rate of less than 1%?
  • How do generative models such as Variational Autoencoders (VAEs) and Generative Adversarial Networks (GANs) perform in anomaly detection compared to discriminative classifiers in SDWSN?
  • Can continual learning frameworks adapt to evolving attack strategies in real time without experiencing catastrophic forgetting of previous patterns?
Proposed Approach: Develop benchmark datasets featuring held-out classes for zero-day attacks; evaluate approaches in unsupervised, semi-supervised, and continual learning.

14.9. Prioritization Matrix

Research-gap prioritization matrix (Figure 8) showing the assessed feasibility and impact of eight identified research gaps based on two dimensions: feasibility (which includes implementation complexity and resource requirements) and impact (consisting of scientific contribution and practical utility). The high-priority quadrant, where feasibility is at least medium and impact is high, includes the following areas: (1) real-world validation, (2) cross-domain transfer learning, and (3) energy–performance trade-off analysis. Medium-priority gaps encompass (1) explainability, (2) zero-day detection, (3) adversarial robustness, and (4) scalability beyond 1000 nodes. A lower-priority research gap is heterogeneous network integration. The radial distance on the chart represents the combined priority score, as outlined in Table 9.
Figure 8. Research Gap Prioritization Matrix Feasibility vs. Impact Analysis.
Table 9. Research-gap prioritization.

15. Conclusions

This systematic survey examines 46 papers (from 2024–2025) at the intersection of machine learning, software-defined networking, and wireless sensor networks. By categorizing the literature into seven problem-oriented domains (DDoS mitigation, intrusion detection, privacy, data integrity, routing, QoS, and efficiency) and mapping these domains to ML technique families and deployment architectures, the survey provides a structured perspective on the current design and evaluation of ML-SDWSNs.
In security and routing applications, tree-based ensemble methods such as Random Forest and XGBoost frequently achieve some of the highest reported accuracies for IDSs and DDoS detection and are commonly used as baseline models. Reinforcement learning, including deep and multi-agent variants, has been shown to enhance routing performance in various dynamic settings, although the specific tasks, datasets, and evaluation protocols differ across studies. From an architectural perspective, recent research trends indicate a shift from strictly centralized, controller-based deployments toward edge-based, distributed, and hybrid approaches, motivated by the need to address latency and scalability challenges. At the same time, privacy-preserving strategies—most notably, federated learning—are gaining traction as methods to protect data while enabling collaborative model training. However, adversarial robustness and defense against poisoning attacks remain largely unresolved. Collectively, these trends suggest an ongoing movement toward more decentralized, adaptive, and privacy-conscious SDWSN designs, despite continued methodological heterogeneity in the literature.
Despite these advances, several systemic limitations hinder the practical maturity of current approaches. Few studies have validated their results on real hardware, resulting in optimistic performance estimates and insufficient evidence for production deployment. The field’s heavy dependence on a limited set of benchmark datasets causes significant accuracy drops when models are evaluated across domains, highlighting the need for transfer learning and domain adaptation. Energy–performance trade-offs are seldom assessed in a multi-objective context, and most models remain opaque to network operators, impeding trust and adoption in critical infrastructure. The eight research gaps outlined in Section 14, including real-world validation, cross-domain transfer learning, multi-objective optimization, adversarial robustness, scalability, explainability, heterogeneous integration, and zero-day detection, encapsulate these shortcomings and set a clear agenda for future research.
Although the quantitative synthesis and taxonomy focus exclusively on SDWSN studies from 2024 and 2025, recent post-2025 research in related domains is advancing solutions relevant to the identified gaps. In industrial fault diagnosis, researchers have introduced hierarchical attention-based sequence models such as MA-BLSTM to improve robustness and interpretability when processing noisy, high-dimensional data [58]. In cooperative control, dynamic event-triggered reinforcement learning, combined with adaptive authority allocation, has enhanced resource efficiency and strengthened safety guarantees [57]. In the physical layer, few-shot jamming-recognition frameworks that integrate generative adversarial networks with convolutional classifiers demonstrate intelligent anti-jamming capabilities, even with limited labeled data [56]. While these innovations fall outside the formal SDWSN inclusion window and are excluded from the quantitative synthesis, they illustrate how future SDWSN research could leverage advanced attention mechanisms, event-triggered control, and few-shot learning to address ongoing challenges in explainability, scalability, and physical-layer robustness.
As networks grow in complexity and the threat landscape evolves, the intelligent and adaptive capabilities enabled by machine learning-driven SDWSNs will become increasingly important. Recognizing the discussed methodological limitations, this survey consolidates the current evidence base and provides practitioners with strategic guidance for the development of the next generation of ML-SDWSN architectures, security solutions, and routing strategies.

Supplementary Materials

The following supporting information can be downloaded at https://www.mdpi.com/article/10.3390/electronics15163733/s1, PRISMA_2020_checklist.

Author Contributions

Conceptualization, A.N.A.-D. and H.F.; methodology, A.N.A.-D.; formal analysis, A.N.A.-D.; investigation, A.N.A.-D.; data curation, A.N.A.-D.; writing—original draft preparation, A.N.A.-D.; writing—review and editing, A.N.A.-D. and H.F.; visualization, A.N.A.-D.; supervision, H.F.; project administration, H.F. All authors have read and agreed to the published version of the manuscript.

Funding

This research received no external funding.

Data Availability Statement

No new data were created in this study. Data sharing is not applicable to this article.

Conflicts of Interest

The authors declare no conflicts of interest.

References

  1. Page, M.J.; McKenzie, J.E.; Bossuyt, P.M.; Boutron, I.; Hoffmann, T.; Mulrow, C.D.; Shamseer, L.; Tetzlaff, J.; Akl, E.A.; Brennan, S.; et al. The PRISMA 2020 Statement: An Updated Guideline for Reporting Systematic Reviews. Syst. Rev. 2021, 10, 89. [Google Scholar] [CrossRef] [Scilit] [PubMed]
  2. Kitchenham, B.; Pearl Brereton, O.; Budgen, D.; Turner, M.; Bailey, J.; Linkman, S. Systematic literature reviews in software engineering—A systematic literature review. Inf. Softw. Technol. 2009, 51, 7–15. [Google Scholar] [CrossRef] [Scilit]
  3. Narwaria, A.; Mazumdar, A.P. Software-Defined Wireless Sensor Network: A Comprehensive Survey. J. Netw. Comput. Appl. 2023, 215, 103636. [Google Scholar] [CrossRef] [Scilit]
  4. J, M.B.; Suresh, D.; R, K. Challenges and Opportunities in IoT-based Software Defined Wireless Networks (SDWN) and the Current State of ML-SDWSNs. In Proceedings of the 2024 International Conference on Distributed Computing and Optimization Techniques (ICDCOT), Bengaluru, India, 15–16 March 2024; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  5. Parra, O.J.S.; Sanchez, L.C.; Gomez, J. The evolution of VANET: A review of emerging trends in artificial intelligence and software-defined networks. IEEE Access 2025, 13, 49187–49213. [Google Scholar] [CrossRef] [Scilit]
  6. Abdi, A.H.; Audah, L.; Salh, A.; Alhartomi, M.A.; Rasheed, H.; Ahmed, S.; Tahir, A. Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions. IEEE Access 2024, 12, 69941–69980. [Google Scholar] [CrossRef] [Scilit]
  7. Vijayan, A.; Anitha, A. A Review of Intrusion Detection Systems in Software Defined Networks. In Proceedings of the 2025 International Conference on Electronics and Renewable Systems (ICEARS), Tuticorin, India, 11–13 February 2025; pp. 859–864. [Google Scholar] [CrossRef] [Scilit]
  8. Rakine, I.; Oukaira, A.; El Guemmat, K.; Atouf, I.; Ouahabi, S.; Talea, M.; Bouragba, T. Comprehensive Review of Intrusion Detection Techniques: ML and DL in Different Networks. IEEE Access 2025, 13, 104345–104367. [Google Scholar] [CrossRef] [Scilit]
  9. Vivek, V.; Veeravalli, B. A Survey on Machine Learning Approaches for Intrusion Detection in Cloud Computing Environments for Improving Routing Payload Security and Network Privacy. In Proceedings of the 2024 IEEE International Conference on Industry 4.0, Artificial Intelligence, and Communications Technology (IAICT), Bali, Indonesia, 13 August 2024; pp. 79–85. [Google Scholar] [CrossRef] [Scilit]
  10. Kaushik, C.; VarunTeja, D.; Krishna, M.S.; Jaavali, S. DDoS Attack Detection and Mitigation Using Mininet and RYU Controller in SDN Environment. In Proceedings of the 2024 15th International Conference on Computing Communication and Networking Technologies (ICCCNT), Kamand, India, 24–28 June 2024; pp. 1–7. [Google Scholar] [CrossRef] [Scilit]
  11. Sathish, N.; Valarmathi, K.; Nagalakshmi, R.; Hema Priya, K. Denial of Service Attack Detection and Mitigation using Ensemble based ML in Software Defined Network. In Proceedings of the 2024 3rd International Conference on Applied Artificial Intelligence and Computing (ICAAIC), Salem, India, 5–7 June 2024; pp. 405–412. [Google Scholar] [CrossRef] [Scilit]
  12. K, S.; M, S.; R, A.M.; N, G.; Tamilselvi, S. Detection and Mitigation of DDOS Attack in SDN Using Feature Based RF & MLP Approach. In Proceedings of the 2025 3rd International Conference on Intelligent Data Communication Technologies and Internet of Things (IDCIoT), Bengaluru, India, 5–7 February 2025; pp. 457–461. [Google Scholar] [CrossRef] [Scilit]
  13. Salatino, F.; Spina, M.G.; Tropea, M.; De Rango, F. Detecting DDoS Attacks Through AI driven SDN Intrusion Detection System. In Proceedings of the 2024 IEEE 21st Consumer Communications & Networking Conference (CCNC), Las Vegas, NV, USA, 6–9 January 2024; pp. 990–993. [Google Scholar] [CrossRef] [Scilit]
  14. Sharma, A.; Singh, S.K.; Kumar, S.; Pan, S.H.; Gupta, B.B.; Chui, K.T. Enhancing DDoS Attack Detection in SDN with a Stacked Model Framework Utilizing Deep Neural Networks. In Proceedings of the 2025 IEEE International Conference on Consumer Electronics (ICCE), Las Vegas, NV, USA, 11–14 January 2025; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  15. Madoune, S.A.; Senouci, S.; Setitra, M.A.; Dingde, J. Toward Robust DDOS Detection in SDN: Leveraging Feature Engineering and Ensemble Learning. In Proceedings of the 2024 21st International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP), Chengdu, China, 14–16 December 2024; pp. 1–7. [Google Scholar] [CrossRef] [Scilit]
  16. Sendil Vadivu, D.; Rajagopalan, N. Mitigating DDoS Attack in SDN Using Random Forest Classifier–Based Flow Table Analysis with Ryu Controller. In Proceedings of the 2024 2nd International Conference on Advancement in Computation & Computer Technologies (InCACCT), Gharuan, India, 2–3 May 2024; pp. 220–224. [Google Scholar] [CrossRef] [Scilit]
  17. M, S.; V K, H.; Saravanan, P.; Jeyalakshmi, V. Integration of SDN and ML Techniques for Detection and Prevention of DDoS Attacks. In Proceedings of the 2024 8th International Conference on Computational System and Information Technology for Sustainable Solutions (CSITSS), Bengaluru, India, 7–9 November 2024; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  18. Belachew, H.M.; Beyene, M.Y.; Desta, A.B.; Alemu, B.T.; Musa, S.S.; Muhammed, A.J. Design a Robust DDoS Attack Detection and Mitigation Scheme in SDN-Edge-IoT by Leveraging Machine Learning. IEEE Access 2025, 13, 10194–10214. [Google Scholar] [CrossRef] [Scilit]
  19. Sivakumar, P.; M, J. Edge based Autoencoder XGBoost Framework to Enhance IoT Security Against DoS Attack. In Proceedings of the 2025 8th International Conference on Computing Methodologies and Communication (ICCMC), Erode, India, 23–25 July 2025; pp. 424–429. [Google Scholar] [CrossRef] [Scilit]
  20. Shehabat, M.M.; Shurman, M.M. Detection and Mitigation of ICMP-based DDoS in Software Defined Networks. In Proceedings of the 2024 15th International Conference on Information and Communication Systems (ICICS), Irbid, Jordan, 13–15 August 2024; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  21. Raihan, Z.; Islam, S. Enhancing Transparency in DDoS Detection on SDN Using Explainable ML Models. In Proceedings of the 2024 2nd International Conference on Information and Communication Technology (ICICT), Dhaka, Bangladesh, 21–22 October 2024; pp. 76–80. [Google Scholar] [CrossRef] [Scilit]
  22. Mateus, J.; Zodi, G.A.L.; Bagula, A. Federated Learning-Based Solution for DDoS Detection in SDN. In Proceedings of the 2024 International Conference on Computing, Networking and Communications (ICNC), Big Island, HI, USA, 19–22 February 2024; pp. 875–880. [Google Scholar] [CrossRef] [Scilit]
  23. Amrani, S.; Medani, K.; Gherbi, C. Secure SDN-based IoT Networks for Drought Management: Mitigating DDoS Attacks with Machine Learning. In Proceedings of the 2024 International Conference on Information and Communication Technologies for Disaster Management (ICT-DM), Setif, Algeria, 19–21 November 2024; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  24. De O. Rodrigues, A.W.; Freitas, F.E.D.; Rodrigues, R.C.S.; Filho, R.G.D.; De Araújo, A.L.C. Deployment of a Machine Learning-SDN Pipeline for IoT Threat Detection in Smart City Environments. In Proceedings of the 2025 IEEE 31st International Symposium on Local and Metropolitan Area Networks (LANMAN), Liile, France, 7–8 July 2025; pp. 1–2. [Google Scholar] [CrossRef] [Scilit]
  25. P, N.; T, M.; J, B.M.; S, M.; R, M.D.; M, K.V. Protecting Healthcare Systems Through an ML-Powered Cyberattack Detection Within Software-Defined Networking (SDN). In Proceedings of the 2024 International Conference on Science Technology Engineering and Management (ICSTEM), Coimbatore, India, 26–27 April 2024; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  26. Sheth, A.; Choxi, B.; Trivedi, C.; Gupta, R.; Tanwar, S.; Shahinzadeh, H.; Azani, S. Artificial Intelligence-assisted Software Defined Networking for Securing ITS in Smart Cities. In Proceedings of the 2024 11th International Symposium on Telecommunications (IST), Tehran, Iran, 9–10 October 2024; pp. 351–356. [Google Scholar] [CrossRef] [Scilit]
  27. Di Gennaro, F.; Cucchiarelli, A.; Morbidoni, C.; Spalazzi, L. Feature selection in ML-based SDN intrusion detection system. In Proceedings of the 2024 11th International Conference on Future Internet of Things and Cloud (FiCloud), Vienna, Austria, 19–21 August 2024; pp. 152–159. [Google Scholar] [CrossRef] [Scilit]
  28. Sindhula, R.; Pradeep, S. EFSMDCD: Method for Detecting and Categorzing Dos and DDoS Attacks using Ensemble Feature Selection. In Proceedings of the 2025 International Conference on Innovation in Artificial Intelligence and Internet of Things (AIIT), Jeddah, Saudi Arabia, 7–8 May 2025; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  29. Ahlawat, A.S.; Nanduri, S. Adaptive Cybersecurity for IoT and Edge Computing Devices Using AI/ML. In Proceedings of the 2025 International Conference on Innovations in Intelligent Systems: Advancements in Computing, Communication, and Cybersecurity (ISAC3); IEEE: Piscataway, NJ, USA, 2025; pp. 1–7. [Google Scholar] [CrossRef] [Scilit]
  30. Golchin, P.; Zhou, C.; Liu, H.; Scheuermann, B.; Kundel, R.; Meuser, T. Integrating Online Learning with Collaborative Machine Learning for Continuous Intrusion Detection in SDN. In Proceedings of the 2024 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), Natal, Brazil, 5–7 November 2024; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  31. Cabral, J.; Neto, A.V.; Da Silva, H.W. Proactive Intrusion Detection in SDN Infrastructures Harnessing Machine Learning Predictions. In Proceedings of the 2024 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), Natal, Brazil, 5–7 November 2024; pp. 1–4. [Google Scholar] [CrossRef] [Scilit]
  32. Patel, M.; Jain, N.; Patel, J.; Ramoliya, F.; Gupta, R.; Tanwar, S. Ensemble Learning for Network Data Classification with SDN Clustering Underlying Smart Power Grid-Enabled Smart Cities. In Proceedings of the 2024 IEEE Third International Conference on Power Electronics, Intelligent Control and Energy Systems (ICPEICES), Delhi, India, 26–28 April 2024; pp. 470–475. [Google Scholar] [CrossRef] [Scilit]
  33. Andreoletti, D.; Rottondi, C.; Giordano, S.; Bianco, A. Scalable and Privacy-Preserving Inter-AS Routing Through Machine-Learning-Based Graph Pruning. IEEE Access 2025, 13, 21891–21905. [Google Scholar] [CrossRef] [Scilit]
  34. Yaseen, F.A.; Alkhalidi, N.A.; Al-Raweshidy, H.S. ITor-SDN: Intelligent Tor Networks-Based SDN for Data Forwarding Management. IEEE Access 2024, 12, 4792–4800. [Google Scholar] [CrossRef] [Scilit]
  35. Qazi, S.; Besher, K.; Ali, M.Z. Security for Underground Utility Data Transmission in IoT Sensor Networks. In Proceedings of the 2024 International Wireless Communications and Mobile Computing (IWCMC), Ayia Napa, Cyprus, 27–31 May 2024; pp. 1161–1165. [Google Scholar] [CrossRef] [Scilit]
  36. Zhang, Y.; Li, P.; Fan, W.; Wang, R. QTSRA: A Q-learning-based Trusted Routing Algorithm in SDN Wireless Sensor Networks. In Proceedings of the 2024 27th International Conference on Computer Supported Cooperative Work in Design (CSCWD), Tianjin, China, 8–10 May 2024; pp. 1881–1886. [Google Scholar] [CrossRef] [Scilit]
  37. He, Y.; Xiao, G.; Liang, Y.; Lu, D.; Cheng, X. A Graph Reinforcement Learning Routing Scheme Based on Nodes and Edges Co-Embedding. In Proceedings of the ICC 2024—IEEE International Conference on Communications, Denver, CO, USA, 9–13 June 2024; pp. 5431–5436. [Google Scholar] [CrossRef] [Scilit]
  38. Angi, A.; Sacco, A.; Esposito, F.; Marchetto, G. ROAR: Routing Packets in P4 Switches With Multi-Agent Decisions Logic. In Proceedings of the 2024 IEEE International Conference on Machine Learning for Communication and Networking (ICMLCN), Stockholm, Sweden, 5–8 May 2024; pp. 63–68. [Google Scholar] [CrossRef] [Scilit]
  39. Garcia-Cantón, S.; Cervelló-Pastor, C.; Rincón, D.; Sallent, S. Deep Reinforcement Learning-Based Joint Scheduling and Routing for Time-Sensitive Networks. In Proceedings of the 2024 24th International Conference on Transparent Optical Networks (ICTON), Bari, Italy, 14–18 July 2024; pp. 1–4. [Google Scholar] [CrossRef] [Scilit]
  40. Tsegaye, H.B.; Sacchi, C. Graph Neural Network-based C-RAN Monitoring for Beyond 5G Non-Terrestrial Networks. In Proceedings of the 2024 11th International Workshop on Metrology for AeroSpace (MetroAeroSpace), Lublin, Poland, 3–5 June 2024; pp. 338–343. [Google Scholar] [CrossRef] [Scilit]
  41. Al-Najjar, A.; Paraiso, D.; Kiran, M.; Dominicini, C.; Borges, E.; Guimaraes, R.; Martinello, M.; Newman, H. Framework for Integrating Machine Learning Methods for Path-Aware Source Routing. In Proceedings of the SC24-W: Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis, Atlanta, GA, USA, 17–22 November 2024; pp. 829–838. [Google Scholar] [CrossRef] [Scilit]
  42. Ghosh, S.; Antonakoglou, K.; Mavromatis, I.; Katsaros, K. Intelligent Routing as a Service (iRaaS) A Flexible Routing Framework for Knowledge-Defined Networks. In Proceedings of the 2024 IFIP Networking Conference (IFIP Networking), Thessaloniki, Greece, 3–6 June 2024; pp. 5–13. [Google Scholar] [CrossRef] [Scilit]
  43. S, D.; R, R.; Gupta, B.M.R.K.; K, N. Evaluation of RPL and SDN-WISE in UAV assisted WSN data collection. IET Conf. Proc. 2025, 2024, 301–306. [Google Scholar] [CrossRef] [Scilit]
  44. K, S.; V, V.; R, G.; R, D. Optimizing Energy and Performance in Wireless Sensor Networks for IoT Applications Using CR-MSGT, SDN, and Gaussian Filters. In Proceedings of the 2024 Third International Conference on Smart Technologies and Systems for Next Generation Computing (ICSTSN), Villupuram, India, 18–19 July 2024; pp. 1–7. [Google Scholar] [CrossRef] [Scilit]
  45. Djennadi, L.; Diaz, G.; Boussetta, K.; Cerin, C. SDN-based approach for adaptive reconfiguration of routing in IoT for smart-buildings. In Proceedings of the 2024 IEEE 25th International Conference on High Performance Switching and Routing (HPSR), Pisa, Italy, 22–24 July 2024; pp. 137–142. [Google Scholar] [CrossRef] [Scilit]
  46. Hudda, S.; Dandwate, A.; Haribabu, K. MMulCriApp: ML and MCDA Based Approach for Energy Efficient Communication for WSN Based Resource Constrained IoT Devices. In Proceedings of the NOMS 2025–2025 IEEE Network Operations and Management Symposium, Honolulu, HI, USA, 12–16 May 2025; pp. 1–5. [Google Scholar] [CrossRef] [Scilit]
  47. Tang, L.; Krishnamurthy, P.; Abdelhakim, M. Is Machine Learning the Best Option for Network Routing? In Proceedings of the ICC 2024-IEEE International Conference on Communications, Denver, CO, USA, 9–13 June 2024; pp. 5425–5430. [Google Scholar] [CrossRef] [Scilit]
  48. Feng, W.; Dou, X.; Taherkordi, A.; Cheng, B.; Zhang, W. Compresso: Latency-Aware Transmission of Compressed IoT Measurement Data Over SDN. IEEE Internet Things J. 2025, 12, 20462–20472. [Google Scholar] [CrossRef] [Scilit]
  49. Shahrbabaki, P.P.; Coutinho, R.W.L.; Shayan, Y.R. SDNQ: A Novel SDN Controller for the Management of IoT Video Flows in the Edge/Cloud Continuum. In Proceedings of the ICC 2024-IEEE International Conference on Communications, Denver, CO, USA, 9–13 June 2024; pp. 5419–5424. [Google Scholar] [CrossRef] [Scilit]
  50. Alawadh, R.; Yadav, P.; Ahmadi, H. DYNAPARC: AI-Driven Predictive Path Failure Management for Industrial IoT-Fog Networks. In Proceedings of the IEEE INFOCOM 2025-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), London, UK, 19 May 2025; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  51. Shah, D.; Shah, D.; Ramoliya, F.; Gupta, R.; Shah, H.B.; Tanwar, S.; Shahinzadeh, H.; Garg, D. FAST: AI-based Network Traffic Analysis and Load Balancing Framework Underlying SDN Clusters. In Proceedings of the 2024 8th International Conference on Smart Cities, Internet of Things and Applications (SCIoT), Mashhad, Iran, 14–15 May 2024; pp. 82–87. [Google Scholar] [CrossRef] [Scilit]
  52. Rojas, C.; Fraire, J.A.; Patrone, F.; Marchese, M. Advanced Constellation Emulation and Synthetic Datasets Generation for Non-Terrestrial Networks. In Proceedings of the 2024 IEEE International Mediterranean Conference on Communications and Networking (MeditCom), Madrid, Spain, 8–11 July 2024; pp. 37–43. [Google Scholar] [CrossRef] [Scilit]
  53. Kumar, S.; Kolhe, K. Implementation of QOS in SDN and Distributed Networks for mitigation of DDOS based attacks using Machine Learning. In Proceedings of the 2024 IEEE International Conference on Blockchain and Distributed Systems Security (ICBDS), Pune, India, 17–19 October 2024; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  54. Tyagi, V.; Singh, S.; Wu, H.; Gill, S.S. Load Balancing in SDN-Enabled WSNs Toward 6G IoE: Partial Cluster Migration Approach. IEEE Internet Things J. 2024, 11, 29557–29568. [Google Scholar] [CrossRef] [Scilit]
  55. Saghir, A.; Ashraf, M.; Bhatti, B.A.; Ahmed, K.; Siddiqui, A.A.; Hassan, A. Performance Evaluation of Software Defined Networking (SDN) for Traffic Management in Wireless Sensor Networks. In Proceedings of the 2024 Global Conference on Wireless and Optical Technologies (GCWOT), Malaga, Spain, 25–27 September 2024; pp. 1–6. [Google Scholar] [CrossRef] [Scilit]
  56. Ding, X.; Lu, Q.; Zhang, Y.; Li, G.; Gao, X.; Ye, N.; Niyato, D.; Yang, K. Few-shot recognition and classification framework for jamming signal: A CGAN-based fusion CNN approach. IEEE Trans. Veh. Technol. 2026, 75, 17494–17508. [Google Scholar] [CrossRef] [Scilit]
  57. Zhang, D.; Meng, L.; Liang, L.; Qin, C.; Liu, D. Dynamic event-triggered control for human–machine cooperative systems based on dynamic authority allocation. IEEE Trans. Syst. Man Cybern. Syst. 2026, 56, 3733–3744. [Google Scholar] [CrossRef] [Scilit]
  58. Wu, H.; Fan, C.; Zhang, D. An innovative neural network architecture designed for industrial fault diagnosis with hierarchical adaptive attention mechanism. Process Saf. Environ. Prot. 2025, 205, 108162. [Google Scholar] [CrossRef] [Scilit]
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Article Metrics

Citations

Article Access Statistics

Journal Statistics
Multiple requests from the same IP address are counted as one view.
Contactless ECG Reconstruction from Millimeter-Wave Radar Signals Using a CNN-BiLSTM Network
Previous
Water Level Estimation by Means of Microwave Reflection Measurements and Machine Learning Processing in a Multimode Cavity
Next