Traffic-Driven Controller-Load-Balancing over Multi-Controller Software-Defined Networking Environment

Abstract

Currently, more studies are focusing on traffic classification in software-defined networks (SDNs). Accurate classification and selecting the appropriate controller have benefited from the application of machine learning (ML) in practice. In this research, we study different classification models to see which one best classifies the generated dataset and goes on to be implemented for real-time classification. In our case, the classification and regression tree (CART) classifier produces the best classification results for the generated dataset, and logistic regression is also considerable. Based on the evaluation of various algorithmic outputs for the training and validation datasets, and also when execution time is taken into account, the CART is found to be the best algorithm. While testing the impact of load balancing in a multi-controller SDN environment, in different load case scenarios, we observe network performance parameters like bit rate, packet rate, and jitter. Here, the use of traffic classification-based load balancing improves the bit rate as well as the packet rate of traffic flow on a network and thus considerably enhances throughput. Finally, the reduction in jitter while increasing the controllers confirms the improvement in QoS in a balanced multi-controller SDN environment.

1. Introduction

With the rapid migration of the world towards the ICT domain, there has been a surge in demand for computer networks with high bandwidths, accessibility, robustness, reliability, and dynamic management. The size, variety, and complexity of networks make traditional methods ineffective and possibly insufficient for setting up, improving performance, and resolving problems with computer networks. With a boom in the use of the internet, identifying and managing traffic loads based on the importance of different traffic types is becoming an increasingly important function of networks. Software-defined networking (SDN), a new paradigm, enables the dynamic nature of networks and smart services by providing simplified network management, improving the user experience, and requiring less money for setup, operation, and maintenance [1]. To handle a whole network, it isolates the control plane from the data plane, enabling network scalability and programmability.

In SDN, load balancing is a crucial component of network management; it is a technique that spreads the traffic over several resources in order to prevent overload on any of the resources [2]. It entails an effective distribution of network resources to enhance efficiency and prevent bottlenecks. Recently, SDN load-balancing methods have become more and more popular because of their affordability, scalability, and flexibility. Appropriate load balancing also aids in increasing throughput, decreasing response times, minimizing utilization of resources, preventing resource overload, and maximizing scalability. Although load-balancing research for SDN has advanced, to achieve better outcomes and greater adoption, there are still a number of issues and challenges (for example, multi-controller load-balancing) that need to be resolved [3].

Researchers and practitioners have proposed a number of SDN load-balancing approaches. This ensures network management, performance, scalability, and high availability. By offering a better quality of service, using SDN load balancing makes networks more flexible and allows for better management, which in turn makes application services for end users more efficient and adaptive [4].

Controller overload, scalability, security, traffic engineering, service-level agreements, and dynamic load balancing for multiple controllers are common issues and challenges in SDN load balancing. Designing effective and efficient traffic algorithms can manage intricate network topologies and a variety of traffic patterns.

Gasmelseed et al. [5] propose a new load-balancing technique for SDN based on the traffic pattern that separates the traffic into TCP and UDP. The distributed controller design used in this study addresses the management, scalability, and availability limitations of the centralized controller. TCP is connection-orientated; it guarantees the establishment of a trustworthy communication channel. TCP is ideal for applications where reliability is crucial, such as web browsing, email, and file transfers. UDP is connectionless, and each packet is sent independently, without checking if the receiver is ready. UDP is suitable for real-time applications like VoIP, online gaming, and video streaming, where speed is more important than reliability.

Traditional methods like port number identification and payload inspection are ineffective because today’s traffic is dynamic and encrypted [6]. The access control list for IP addresses and port numbers associated with various applications is typically updated manually in the traditional port-based methodology of classification, which can be a slow and challenging method of improving network QoS even though it may have high accuracy.

In the real world, not all network traffics are equally crucial. For instance, for some organizations, voice and message traffic may be more significant than game and video traffic, yet video streaming and gaming data may be significant for other organizations. This situation leads to poor performance of the network and load imbalance.

Even for experienced professionals in the field employing cutting-edge techniques, processing and analyzing large dataset generated from vast internet traffic volumes is challenging. Identification of the type of traffic supports managing the resources and allocating them to the critical application, thus ensuring an improvement in QoS and stability of the system. Due to the high volume of traffic moving across the internet, internet service providers (ISPs) and networking service providers (NSPs) are looking for a number of approaches to properly predicting the type of application flow that is now running through it [7]. Thus, developing a system that dynamically classifies network traffic and reroutes traffic based on the criticality of the data received is the main motivation behind the research. Modern machine learning (ML) advancements have proven the effectiveness of prediction applications, particularly in the field of networking.

In this paper, different ML algorithms (for example, logistic regression, Support Vector Machine (SVM), and K-nearest neighbors (K-NN), XGBoost, classification and regression trees (CARTs), and OPTICS) are employed to classify different types of network traffic in order to evade the constraints of traditional approaches and raise QoS. Also, in order to choose the optimal algorithm for implementation, the efficacy of a few algorithms is examined. Load balancing is then performed to give the shortest route higher priority for the crucial traffic type. Additionally, the issue of network congestion is addressed by installing three controllers in the network that can share responsibility for traffic classification and flow table updates.

The main contributions of this paper are summarized as follows:

• A trained model is developed for traffic classification and controller-load-balancing;
• The performance of the models developed are measured with different ML algorithms for effective load balancing in a multi-controller SDN environment.

The remainder of the paper is organized as follows: The background and related work are discussed in Section 2, which includes the SDN and its architecture, OpenFlow, the controller placement problem (CPP), traffic classification approaches, load balancing in the SDN, and related works. Section 3 details the methodology, including the system scenario, dataset generation, and the proposed work flow model consisting of a traffic classification model and traffic priority-based load balancing. Results and analysis are presented in Section 4, and, finally, Section 5 concludes with a summary and future work.

2. Background and the Related Work

2.1. Software-Defined Networking (SDN)

SDN is a modern networking approach that is flexible, manageable, cost-effective, and adaptable. The objective of SDN is to simplify network management, promote innovation, improve network resource utilization, and optimize network performance. It is well suited for high-bandwidth, dynamic applications. In large networks with hundreds of switches and routers, network management is a highly difficult and time-consuming procedure. Thus, SDN, a novel approach, seeks to improve the present unfavorable scenarios for building, developing, and maintaining networks. The core concept of SDN is to logically centralize network control in an SDN controller, which controls and monitors network behavior [8].

Data traffic in our society is increasing exponentially as a result of the recent rapid growth of intelligent devices and network technologies. Networks are growing more heterogeneous and advanced in order to manage higher numbers of devices and optimize traffic distribution. One possible approach to solving these issues is to increase network intelligence. Fortunately, SDN makes learning easier [9]. The traditional methods of configuring, optimizing, and troubleshooting computer networks may not be sufficient or efficient due to the large size, heterogeneity, and complexity of current and future networks [10]. SDN offers security, energy efficiency, and network virtualization for enhanced network performance as a result of the rising prevalence of smart programmable devices in networks [11]. Even though SDN provides many benefits, such as scalability, agility, and ease of administration, security is one of the most important aspects to take into account while using it  [12]. The benefits of SDN and the explanations for its rapid acceptance are depicted in Figure 1.

Since the SDN architecture is centralized, programmable, and able to collect real-time data from the controller, it is conceivable to use some “intelligence” (ML techniques) for efficient routing and QoS provisioning [9]. By utilizing SDN’s programmability, ML could be used to provide real-time QoS solutions. In SDN, the control and forwarding functions of a network are separated, enabling the control of the network to be programmable and the infrastructure for applications and network services to be abstracted. This design makes SDN a suitable choice for current and future networking needs. SDN architecture majorly consists of three layers, namely (a) the application layer, (b) the control layer, and (c) the infrastructure layer. Each of these layers performs certain functions and communicates with the others via interfaces [13].

2.1.1. Infrastructure Layer

The infrastructure layer includes all physical components of a network, including a switch, router, openVswitch, a wireless access point, etc. Receiving the client’s request and sending the information to the control layer are the main responsibilities of these devices’.

2.1.2. Control Layer

The controller manages the flow of data in the network. The southbound APIs enable the controller to configure the forwarding devices, proceed traffic to the data plane in accordance with forwarding policies, and determine the best network path. In essence, the controller provides a centralized view of the network for better management and performance tuning, and it offers network abstraction for high-level network functionality. Some examples of controllers are ONOS, OpenDaylight, Floodlight, Beacon, Ryu, and POX etc. [14,15]. Specifically, the southbound interface named OpenFlow allows for communication between the control layer and the network layer. Hu et al. [16] explained the analysis on the SDN controller based on throughput, response time, etc. To analyze the performance depending on variables like RTT, jitter, delay, etc., authors employed a mininet emulator that includes a Ryu controller.

2.1.3. Application Layer

Several end-user applications, including network monitors, time delays in traffic, traffic classifiers, and load balancing, are implemented in this layer. The network monitor keeps track of incoming traffic and counts the bytes, the traffic classifier uses ML to classify incoming traffic in real-time, and load balancing reroutes incoming network traffic to the chosen controller based on the nature of the traffic. The SDN’s control and data plane separation allows for effective domain-wide traffic routing and management. Programming forwarding devices is the responsibility of the controllers in the control plane, whereas network programming and policy enforcement are the responsibilities of the application plane, which is the top layer [1].

2.2. Openflow

OpenFlow (OF) enables routing decisions and the transmission of rules such as load balancing, security, and quality of service (QoS) from the SDN controller to devices in the data plane. Southbound API is a widely used SDN protocol for facilitating communication between network devices and the SDN controller. The three primary components of an OpenFlow network architecture are the OpenFlow controller, OpenFlow protocol, and OpenFlow switch [17]. One or more flow tables containing flow entries are present in OpenFlow switches. Match fields and actions are included in each flow entry, and the controller fills the tables. The match fields are made up of a packet’s header data, including the source and destination IP and MAC addresses, port numbers, and other details. Each action determines the packet’s instructions. Along with basic flow data, like IP and port numbers, OpenFlow’s flow table also offers a number of statistical features, including packet and byte numbers, duration, and so on [18].

An OpenFlow switch looks up the appropriate command in its flow table when a packet arrives at the switch (for example, discarding or forwarding the packet). The packet is sent to the controller, a process known as packet-in, if there are no instructions in the flow table. Based on the packet’s payload, header information, and statistics, the controller chooses the appropriate instruction. The packet is sent back to the switch, a process known as packet out, after the instructions have been decided. The flow table is updated in the interim. Subsequent packets from the same flow are treated in accordance with the instruction.

When load balancing is used, the architecture enables a global view of the network and ongoing evaluation of the load on various links. This makes it simple to alter forwarding rules so that the load is shared equally. The basis of OpenFlow networks is the ability to conceive all traffic as flows, which means that different flows will have different entries in a flow table and that different rules can be defined for each entry. More specifically, the OpenFlow protocol facilitates information exchange between network devices in the forwarding plane and the SDN controller.

2.3. Controller Placement Problem (CPP)

Since the existing form of SDN requires multiple controllers, the CPP is the issue of determining the optimum number of controllers as well as where to place them [19]. The CPP is an urgent problem that needs to be solved, asking how many controllers are needed and where they should be positioned [20]. The type, number, and location of these controllers directly affect the cost and average latency of control packets [21]. The CPP has three different components. The number of controllers to be placed in a network, their locations, and the function of assigning controllers to switches are all important to the design of an effective control plane [22].

After performing an extensive review of the literature, Sood et al. [23] conclude that no rigid placement rule exists in SDN that can be applied to every network. Dynamically adding and removing controllers is inevitable. Our concern in this article is not to present an issue in regard to the CPP but simply to evaluate the traffic classification-based load balancing made by a prepositioned SDN controller.

2.4. Traffic Classification Approaches

The process by which the network protocols or applications that are present in a network are identified and then classified is known as network traffic classification. Network management, service measures, network architecture, security monitoring, and advertising have all made extensive use of traffic classification. Knowing what kinds of network applications flow through a network is a crucial challenge for internet service providers (ISPs). Through this technique, internet service providers or network operators can manage the overall performance of a network. Traditional techniques for classifying internet traffic include those that use ports, payloads, and ML. The ML approach is currently the most commonly utilized method [24].

ML-Based Approach

The use of traffic classification techniques based on ML has recently solved the drawbacks of traditional traffic classification methods. In this method, an ML classifier is trained as input, and then unknown classes are identified using the trained sample prediction. The ML-based technique is further classified into three categories (supervised, unsupervised, and semi-supervised) based on the mechanism followed by the model and the requirement of training data [25].

2.5. Load Balancing in SDN

To improve system efficiency and the user experience, the primary goal of load balancing is to prevent severe system load variance over extended periods of time. To effectively manage incoming traffic and resources and enhance network performance, the load balancing issue must be addressed due to the rising demand and depletion of resources. The role of the controller in SDN is to balance the load for better quality of service (QoS), which is one of the most crucial concerns [26].

Load balancing is a technique for allocating load to various network components or processors to maximize network performance and improve QoS [27]. Load balancing makes it possible to predict bottlenecks before they occur. Some of the load balancing objectives include increasing throughput, reducing response time, and improving traffic. SDN load-balancing techniques are more precise and feature better performance. Due to industrial concerns, load balancing is one of the most crucial topics in SDN-related research. Neghabi et al. [28] presented a thorough review of the load balancing strategies employed in SDN, categorized into two types: non-deterministic and deterministic. Round Robin, Weighted Round Robin, least connections, weighted least connections, and random load balancing approaches were demonstrated and evaluated on a single switch architecture in [29].

Improving end-to-end QoS metrics, maximizing throughput, minimizing response time, avoiding bottlenecks, reducing transmission latency, and optimizing resources use are the objectives of load balancing [30]. Researchers have mentioned several load balancing metrics, including packet loss, transmission hop count, root mean squared error, utilization ratio, packet loss, throughput, response time, end-to-end latency, and types of traffic. After reviewing the state of the art and research conducted on various controllers, load balancing can be divided into being logically centralized/physically distributed. Physically distributed controllers are further subdivided into hierarchical, horizontal (flat), and virtualization controller load balancing.

Ahmad et al. [31] identified and emphasized the variety of SDN controllers and research challenges in different SDN control plane architectures, including distributed, hybrid, and centralized SDN control planes. They assessed the most well-known SDN controllers using the four performance metrics of scalability, consistency, reliability, and security. Issues like interoperability, consistency, network partition, controller placement and load balancing, and security have been raised in regard to distributed control plane architecture.

Ali et al. [32] propose an efficient slave controller allocation-based load balancing approach named ESCALB for a multi-domain SDN-enabled IoT network which aims to transfer switches to a controller with idle resources effectively.

Kumari et al. [33] and Li et al. [34] surveyed load balancing for both the data plane and the control plane, with a focus on SDN in the data center. Load balancing has been used to efficiently distribute network resources in order to improve both quality of service (QoS) and overall network performance, and this technology has been proven to be essential.

Liu et al. [35] propose bidirectional switch migration based on load prediction (BSM-LP), which avoids needless switch migrations by properly predicting controller loads using historical load data and an ATT-GRU model. Their BSM algorithm enhances migration efficiency to prevent overloading the target controller and another algorithm for identifying and integrating isolated nodes to decrease their frequency.

In our previous study [3], we highlighted that it is necessary to measure the load statistics for multiple controllers by developing an intelligent load distribution strategy and to optimize the number and location of controllers in order to establish balanced controller-load distributions throughout the ISP/Telco network.

2.6. Related Works

Using a broad perspective of the network, a network controller in SDN decides how to forward data. As a result, it may manage network traffic “on demand” to meet application requirements. Traffic management is essential for ensuring the quality of service (QoS) for real-time business traffic, which is sensitive to packet losses and delays. Therefore, a lot of researchers have concentrated on designing dynamic-data-forwarding path-planning algorithms that may satisfy end-user requirements.

Currently, network traffic classification is a hot topic in computer science. Understanding the variety of network applications that are used in a network is a crucial task for internet service providers (ISPs). Traditional techniques for classifying internet traffic include those that use ports, payloads, and ML. The ML approach is currently the most commonly utilized method. It has received excellent, accurate results and is utilized by numerous researchers.

Shafiq et al. [36] discuss network traffic classification approaches step by step. The classifiers Support Vector Machine, C4.5 decision tree, Naive Bays, and Bayes Net are used. According to experimental data, C4.5 classifiers perform quite well in terms of accuracy when compared to other classifiers.

Qazi et al. [37] introduce the framework Atlas, which uses ML-based classification techniques in order to incorporate fine-grained application awareness in SDN. The proposed approach can classify network traffic in real-time since it gathers the packet size of the first N packets of a network flow. Atlas is installed on a wireless network and uses the Android OS to collect network traffic.

Using the distributed controllers, Gasmelseed et al. [5] propose a mechanism that splits the traffic into TCP and UDP and employs a failover strategy to provide a high-availability environment that ensures reliability.

Amaral et al. [38] use three supervised classification techniques, such as Random Forest (RF), Stochastic Gradient Boosting (SGB), and Extreme Gradient Boosting (EGB)-XG Boost. They set up this platform in an enterprise network and gathered data using the following schemes: Bittorrent, Dropbox, Facebook, HTTP, LinkedIn, Skype, Vimeo, and YouTube. The OpenFlow protocol was used to collect the data for this study, and features such as packet size, interval arrival time, source and destination IP/MAC/Port, flow length, byte count, and the packet count of the first five packets were collected.

Raikar et al. [39] suggest a supervised learning model for classifying data traffic in the SDN context. SVM, closest centroid, and Nave Bayes are the three different models employed to categorize the data traffic based on the applications in an SDN platform. In all three supervised learning models, the accuracy of traffic classification is greater than 90%.

Amiri et al. [40] describe a technique for raising the quality of service (QoS) for traffic flows in a cloud data center by utilizing SDN and ML-based traffic classification. The proposed real-time traffic classification module makes use of ML techniques to improve traffic classification accuracy. Compared to Equal Cost Multi-Path (ECMP), the proposed optimization method increases bandwidth consumption. This improvement may be extremely important in ensuring that users’ interactions with cloud data centers have a sufficient QoE.

In order to address the mislabeled training data issue, Wang et al. [41] introduce a novel approach in their research called Noise-resistant Statistical Traffic Classification (NSTC), which integrates reliability estimates and noise reduction into traffic classification. In the case of large amounts of unclean data, NSTC can dramatically outperform state-of-the-art approaches in terms of classification performance.

Eom et al. [42] propose an SDN-based system for classifying network traffic. Applying four ensemble algorithms—Random Forest (RF), Gradient Boosting Machine (GBM), Extreme Gradient Boosting (XGBoost), and Light Gradient Boosting Machine (LightGBM)—researchers examine the classification performance of each algorithm in terms of accuracy, precision, recall, F 1-score, training time, and classification time. The experimental results show that classifiers based on ensemble models outperform those based on the proposed framework and the real-world network traffic dataset. Notably, the classification performance achieved by the LightGBM model is the best.

Mohammed et al. [43] look at existing deep learning (DL) techniques for classifying and predicting traffic in an SDN environment. Malik et al. [44] offer Deep-SDN, a new deep learning model for SDN that can quickly and reliably identify a variety of traffic applications. Better results were reported in terms of accuracy, precision, recall, and f-measure when the proposed model’s performance was compared to the state of the art. According to the research, the proposed model could achieve an overall accuracy of 96%. The researcher’s claim is that the proposed model can accurately and quickly identify the different network traffic application types, making it useful for identifying online traffic.

Load balancing is a technique used to divide the workload among multiple resources in order to avoid overloading any of the resources [2]. Some of the objectives of load balancing include maximizing throughput, minimizing response time, and optimizing traffic. Ejaz et al. in [45] balance the load with a focus on the controller. The incoming traffic is balanced using virtual SDN (vSDN) controller duplication and shared load. Using two vSDN controllers in a mininet emulator, the authors experimentally confirmed the load balancing in the Fat-Tree architecture.

Hai et al. [46] provide load balancing in the control plane based on load status and the dynamic weight coefficient of each controller to improve resource use, reliability, and resilience in the network. Additionally, compared to current methods, communication overhead is greatly decreased by employing a pre-defined load threshold.

Mousa et al. [47] provide an in-depth review of recently introduced SDN-based load balancing and routing methods. There are different types of possible load balancing techniques, such as switch migration, routing, controller placement, traffic classification, heuristic algorithms, AI-based techniques, etc.

Maity et al. [48] propose CORE, a prediction-based technique consisting of mobility prediction, rule-caching, and master controller assignment, to minimize controller overload and distribute the dynamic traffic optimally under the consideration of heterogeneous IoT devices.

Sapkota et al. [49] propose the Naked Mole-Rat (NMR) algorithm, a novel population-based meta-heuristic algorithm, to optimize the location for controller placement based on switch–controller and controller–controller latency while maintaining load balance among the controllers. Two commonly available standard topologies, Ernet and Savvis, are used to demonstrate the concepts and methods.

Xue et al. [50] propose a novel approach for load balancing of SDN which combines Genetic-Ant (GA) with Colony Optimization (ACO), called (G-ACO). It benefits from the speedy genetic algorithm (GA) global search and the effective search for an ACO optimal solution. Computer simulation reveals that the proposed scheme significantly improves the round trip time (RTT) and packet delivery ratio compared to the Round Robin (RR) and ACO algorithms by effectively achieving the LB.

3. Methodology

3.1. System Scenario

The Ryu framework, which acts as the OpenFlow/SDN controller, is designed to run on a host computer connected over TCP to the simulated mininet network topology. Python programming is used to implement the Ryu controller and the OpenFlow protocol 1.3.

Table 1. Testbed requirements.

No.	Specification
1	Operating System: Ubuntu 22.0.4 LTS (64 bits)
2	Ryu Controller (Ryu): version 4.34
3	Mininet Emulator (Mininet): version 2.3.0
4	OpenFlow Protocol (OpenFlow): version 1.3
5	Type of control plane: hierarchical
6	Queuing model: based on traffic type
7	Link capacity: default (not defined in topology)

provides a list of the particular testbed specifications employed.

Figure 2 depicts the experimental network use case that is used in our study. After setting up the basic network topology consisting of three clients (one sender and two receivers) in the mininet, the output is shown in Figure 3.

Three controllers, namely one main and two secondary local controllers, are connected to a global controller that monitors the CPU utilization of all controllers and switches roles if the threshold is exceeded. Figure 4 demonstrates three local controllers connected to a global controller.

3.2. Dataset Generation

The D-ITG program generates traffic flow data, which is then used to train ML models [51]. D-ITG is capable of producing IPv4 and IPv6 traffic by accurately modelling the workload of current internet applications. The D-ITG program helps to mimic real-world traffic conditions by providing fine control over characteristics like packet size, inter-departure time, and traffic allocation. Some limitations, such as multiport and burst traffic options, are not considered for this research, as this research is an attempt to check if multi-controller SDN improves QoS over single controller SDN using a traffic classification approach in a controlled environment.

Ping, telnet, game, and DNS are all put in the “data” class to demonstrate the concept of traffic classification, while voice and video are put in the “voice” and “video” classes, respectively. These three types have been selected because almost all normal traffic generated by the D-ITG tool belongs to one of these classes.

A training dataset sample [52] is shown in

Table 2. Training dataset sample.

Forward Packets	Forward Average Packets/Second	Reverse Packets	Traffic Type
454	1.16	507	Voice
790	0.92	1018	Voice
856	0.10	508	Data
856	0.10	508	Data
856	0.09	507	Video
1622	0.32	507	Video

. To save operating time, only the essential hyper parameters are retrieved, while extraneous parameters are eliminated from the dataset because all of its contents are irrelevant for performing data pre-processing.

3.3. Proposed Work Flow Model

Firstly, let us examine a scenario in which the model can be applied to enhance the network’s overall quality of service (QoS). Consider a company that uses VoIP calls for customer service and grievance handling. In such a scenario, voice traffic from customers has the highest priority and needs to go across the network with minimum latency and maximum throughput. Other forms of traffic, such as data traffic and video traffic, from sources like Facebook and YouTube on their personal devices, should be given less priority without affecting the organization’s performance. The proposed model may work well in this situation since it classifies traffic first and then simply balances the load according to the various types of traffic.

To achieve excellent performance and quality of service (QoS) in modern SDN environments, efficient flow management of network traffic and load balancing across multiple controllers are essential. As network traffic continues to expand rapidly due to diverse applications and varying traffic patterns, real-time precise traffic management and load control across many controllers play a significant role in improving the QoS [53].

Additionally, to manage dynamic traffic patterns and guarantee optimal resource use, traditional load balancing solutions might not be adequate. In order to handle any controller failures or overload scenarios, load balancing must be conducted intelligently and adaptively in order to classify network traffic in real-time and perform load balancing based on the priorities and characteristics of the traffic [54].

After the steps of traffic classification, the packets are forwarded to the respective controllers assigned for each traffic type, and then the data is sent to the destination address based on the priority and queuing policies defined in the Ryu controller and OpenFlow switches.

The goal of this research work is to create a traffic-driven controller-load-balancing solution for multi-controller SDN systems. To achieve precise traffic classification and dynamic load distribution, ML techniques will be utilized.

This study has been broadly classified into two sections, namely traffic classification and load balancing.

3.3.1. Traffic Classification Model

For the purpose of traffic classification, various supervised ML algorithms have been tested to find the best model capable of performing multi-class traffic classification with appreciable accuracy and precision while also keeping the inference time and resource utilization low. Some of the tested algorithms include logistic regression, SVM, K-NN, XGBoost, decision tree (CART), and optics. The ML algorithms were selected based on the findings in [36,38,39] to find the best possible algorithm for the classification of data before the operation of load balancing.

Since traditional supervised ML produces acceptable outcomes and advanced ML may increase network complexity, we chose this form of traditional supervised ML rather than advanced ML. It is necessary to perform some pre-processing in order to accurately classify the data.

The pre-processing procedures include removing null values, separating feature sets and categories, converting traffic type categories from object types in the dataset for further manipulation, normalizing the feature sets to avoid over-fitting, and selecting the best features from the feature sets that are available because the ML classification model is not able to analyze a large number of features in an efficient manner. Based on the feature scores of several features, the features are extracted. The feature scores of the top eight features are utilized in this proposed system for traffic classification tasks.

In our system scenario, the main (local) controller performs traffic classification and load balancing while the secondary (local) controllers handle less critical traffic. Here, the proposed model itself collects training datasets using real-world scenarios.

The Algorithm 1 initiates with the collection of training datasets. For this, the Ryu controller is initiated in training mode and topology is started. The dataset is created by using a simulation tool known as D-ITG that simulates different types of traffic in a network. The data are extracted as a CSV file, which is then fed to the pre-processing state, where necessary feature sets are extracted and unnecessary features are dropped for easy and efficient manipulation in subsequent states. After pre-processing, the dataset is fed to the traffic classification model, where the model is trained using various ML algorithms for real-time traffic classification in future implementations.

Algorithm 1: Proposed work flow model

After training the model, it is ready to classify real-world traffic in real-time. The “pickle” library is then used to save the learned model and perform real-time traffic classification. Once it has been suitably trained and evaluated on Google Colab, the Ryu controller is used to run the model in a real-time classification mode. The mininet topology can be resumed after the controller has started running. Following that, when traffic is sent between hosts, the controller classifies it according to its type and presents it with additional data. The traffic received in real-time is classified into pre-defined categories, which are already labeled as “video”, “voice”, and “data”, as shown in Figure 5.

Following the completion of traffic classification by the main controller, the output of the classifier provided by the ML algorithm is used to produce the flow label of the traffic based on its type and is updated in the flow table of the OpenFlow switch. On the basis of the match provided by the OpenFlow switch, the groups are designed to carry out various specific actions on different types of received traffic. The OpenFLow switch manages the additional forwarding of traffic across various switches from source to destination if there is a match in the flow table. If there is no match, the Ryu controller is activated to extract the parameter and classify the traffic into the appropriate label that the controller has pre-defined during training. After being classified, a packet is then delivered to a switch to follow the routing procedure.

3.3.2. Traffic Priority Based Load Balancing

Despite the fact that there are many load balancing techniques in the state of the art, we have presented a typical example of IP-based multi-class traffic classification and load balancing in a multi-controller SDN environment.

Traffic priority-based load balancing is different from traditional load balancing schemes, where the decision of path selection is not made only on the basis of the shortest path or load on the controller or switch but also according to the severity of traffic. The proposed load balancing Algorithm 2 is shown below.

Algorithm 2: Proposed load balancing algorithm in multi-controller environment

Each traffic type has its own path, and, when congestion occurs, the traffic with the greatest priority is shifted to another path. Other types of traffic are either passed parallelly or blocked based on the path’s capacity at the time.

The Simple Depth First Search (DFS) algorithm, which analyzes the topology to find the path with the minimum cost between the source IP and destination IP, is used to calculate the shortest path. Thus, using the pre-defined rules, the controller and path that satisfy the delay requirement for the specific type of traffic are then chosen.

Each switch’s flow table and group table are updated to handle various types of traffic separately for the purpose of allocating different paths for different types of traffic. Then, the intermediate switch sends the traffic to the terminal switch connected to the host, following the shortest path given by DFS from the host to the destination user.

The global controller to which both local controllers, main and secondary, are connected monitors the CPU utilisation of both controllers using the get_cpu_utilisations() function. CPU UTILISATION THRESHOLD = 70 is used to set the threshold at 70%. Here, 70% of CPU utilization was arbitrarily chosen to ensure not to cross the warning level for the emulation purpose. The global controller runs on port 6633, which is the default port for the Ryu controller. The two local controllers run on ports 6634 and 6635, respectively. Using self.global_port, the local controller connects to the global controller by listening on its port. If the utilisation of the main controller exceeds the defined threshold value, i.e., 70%, the perform load balancing() function shares the classification and load balancing roles of the main controller with the secondary controller. The function send_role_request is called in order to accomplish this.

Further, the global controller continues monitoring the CPU utilization of both controllers, and if the threshold on the main controller drops below 70%, the complete role of traffic classification and load balancing is redirected to the main controller, reducing the resource consumption of the second controller. The threshold for this research was chosen at random and can be adjusted by the network administrator based on the network’s convenience or performance requirements. Furthermore, the performance of the proposed approach may be verified using various threshold values. The detailed flow of the controller-switching action in the case of CPU utilization exceeding the threshold is shown in Algorithm 3.

Algorithm 3: Proposed Controller Switching during Overload

4. Results and Analysis

Here, the results of every step of the model are presented together with a detailed explanation of each result.

4.1. Dataset Pre-Processing

In order to train ML models for real-time classification in the future, the dataset generated during the network’s data collecting phase must first undergo pre-processing. After normalizing all traffic types to the traffic type with the fewest samples, each traffic type has an equal number of samples (i.e., 60,036), which reduces the chances of over-fitting to a particular traffic type. In this model, working on the 12 features was started first, and the feature importance score of all 12 features was estimated using the Random Forest classifier algorithm. Based on this score, the top eight features, which are shown in the

Table 3. Top eight features for traffic classification based on feature importance.

No.	Name	Specification
1	Forward Average Bytes per second	0.40223
2	Forward Average Packets per second	0.27834
3	Reverse Average Packets per second	0.10243
4	Reverse Average Bytes per second	0.08076
5	Delta Forward Bytes	0.05202
6	Forward Instantaneous Bytes per Second	0.04397
7	Delta Forward Packets	0.01610
8	Forward Instantaneous Packets per Second	0.01186

, were selected in order to simplify the next steps and expedite the classification process.

All subsequent stages of training a classification model employ these attributes. The removal of unnecessary elements from the feature set facilitates efficient model training, resulting in accurate real-time classification of all traffic classifications.

Although the average values may not be useful for classifying early flow stages, particularly for burst or short-lived traffic, nonetheless they are helpful for classifying long-lived data produced during our model implementation, such as video, lengthy calls, and file transfers. We have not yet taken into account short-lived burst datasets and how they affect the classification model, which could be a smart strategy for improving this research in the future. The incorporation of the “instantaneous” and “delta” parameters speeds up classification compared to using the “average” parameter alone.

4.2. Comparison of Various Classification Model

Different classification models were tested with the dataset to identify the best classifier.

Table 4. Comparison of various Traffic Classification Model.

ML Algorithm	Accuracy (%)	Precision (%)	Recall (%)	F-1 Score (%)
Logistic Regression	70	83	70	70
SVM	65	83	65	65
K-NN	56	81	56	52
XGBoost	69	82	69	69
Decision Tree (CART)	83	83	81	80
OPTICS	29	60	29	23

displays the accuracy, precision, recall, and f-1 score for each ML technique.

Figure 6 shows that, for the generated dataset, the decision tree (CART) classifier achieves the best classification results, whereas OPTICS has the worst classification report. Furthermore, it can be seen that logistic regression yields good results for all of the parameters.

After classification, we achieved 70% and 65% accuracy rate for logistic regression and SVM, respectively. The program performed well in regard to accurately classifying voice and data traffic in both cases, but it performed poorly in regard to video traffic.

Compared to the first two algorithms, K-Nearest Neighbors has a different pattern. It accurately classifies data and video traffic, while voice traffic is only classified with a precision of 43%. K-NN’s overall accuracy is likewise quite low, coming in at only 56%. Both data and voice traffic are accurately classified by XGBoost; however, video traffic is not.

While classifying, CART performs accurately; however, it cannot accurately classify video traffic in the manner that logistic regression and SVM can. However, the decision tree’s total f-1 score is higher than any other algorithm’s, and its accuracy is higher than average at 83%. Due to its strong classification report and strong performance in terms of accuracy, precision, recall, and f-1 score, CART is the most preferred algorithm for classification. The decision tree classifier is also well suited for real-time classification because of its short execution time.

4.3. Validation of Classification Model

The same algorithms with the same parameters are tested on a validation dataset to determine if the results for all ML methods are not over-fitted to a particular dataset. The sample of the validation dataset is shown in

Table 5. Sample of validation dataset.

Flow Duration (ms)	Total Fwd Packets (Bytes)	Total Backward Packets (Bytes)	Fwd Packet Length Mean (Bytes)	Total Length of Fwd Packets (Bytes)	L7 Protocol
45,523	22	55	6.000	132	131
1	2	0	6.000	12	131
217	1	3	0.000	0	7
78,068	5	0	215.200	1076	131
105,069	136	0	2305.544118	313,554	131

.

The comparison graph of all algorithms implemented for the classification of validation dataset is shown in Figure 7.

The comparison graph for each algorithm for the validation dataset also reveals results that are nearly identical to those of the generated dataset. Here, logistic regression produces the best results. However, the decision tree (CART) method also yields results that are almost identical; hence, based on both charts, CART is regarded as the best algorithm. The OPTICS algorithm’s output is not included in the validation dataset because it is unable to produce it even after running for 60 min and eventually experiencing an execution timeout.

4.4. Comparison of Execution Times of Classification Models

Figure 8 compares the execution times of all methods for the generated dataset and the validation dataset.

From the graph, it is clearly visible that K-NN has lowest execution time for both the generated and validation dataset. Since K-NN is an instance-based approach, it does not require a training phase in which a model is learned from training data. Rather, it just stores the training data and uses it to generate predictions during testing. K-NN can predict results quickly because it simply has to calculate the distance between the test instance and the saved training instances.

Additionally, among the five methods, SVM takes the longest to execute. Due to the complexity of the training process, SVMs require a training phase in order to identify the optimum decision boundary that separates the various classes, which increases the execution time of SVMs.

Once again, CART is identified as the best algorithm for real-time traffic classification when execution time and the classification report are taken into account. Logistic regression is an other algorithm to be considered in mind. OPTICS is not included in the graph since its execution took longer than a minute for the generated dataset and caused a “runtime timeout” for the validation dataset.

4.5. Dynamic Load Balancing and QoS Improvement

For testing the impact of load balancing in multi-controller SDN environment, ten flows in Figure 9 were sent across the hosts in four case scenarios: no load balancing, traffic classification-based load balancing with a single controller, two controllers and three controllers.

The detail is demonstrated in

Table 6. Comparison of various scenarios on same network.

Condition	Path	Flows	Jitter (ms)	Bit Rate (Bits/s)	Packet Rate (Packets/s)
No load balancing	H1–H3	6	159	5317	23
	H3–H1	8	149	5303	23
	H1–H2	10	47	11,065	252
Load balancing with single controller	H1–H3	6	155	5317	26
	H3–H1	8	155	5316	28
	H1–H2	10	18	12,266	426
Load balancing with two controllers	H1–H3	6	99	5429	26
	H3–H1	8	104	5418	30
	H1–H2	10	7	16,822	982
Load balancing with three controllers	H1–H3	6	98	5699	49
	H3–H1	8	105	5690	49
	H1–H2	10	6	18,884	1969

. When compared to the scenario with a simple switching implementation or no load balancing, the scenario with the implementation of the traffic-based load balancing module shows improvement in a number of parameters.

To understand the impact on bit rate and packet rate after the application of the load balancing module in the Ryu controller, a graph is generated for ten network flows from host 1 to host 2.

From Figure 10 and Figure 11, we may conclude that the use of traffic classification-based load balancing improves the bit rate and packet rate of traffic flow on a network. When three controllers are used for load balancing instead of two, there is a noticeable increase in bit rate and packet rate, which justifies adding more controllers to increase the bit rate of the entire network.

When two controllers are implemented into the network and both are given the responsibility of traffic classification, the queuing of packets for classification is reduced. This is because, even if one controller is overloaded, another controller can classify incoming packets. The jitter is greatly reduced for two controller-load-balancing modules, which is clearly seen in the jitter graph.

Here, both the bit rate and packet rate output demonstrate that increasing the number of controllers in the network considerably enhances throughput, which is a critical factor for real-time traffic in any type of network.

Finally, jitter also monitors the variation in packet latency or the interval of time between a signal’s transmission and reception as it travels through the network. Network congestion, poor hardware performance, and a lack of packet priority are common causes of jitter. Improved load balancing can decrease network jitter, which will improve the quality of service for real-time applications like voice and video. Figure 12 illustrates the comparison of average jitter for load balancing and non-load balancing scenarios. In the figure, jitter is slightly decreased when single controller-based load balancing is performed. Although the graph shows that jitter appears to have increased at one point relative to no load balancing, this could be due to the large volume of packets queuing to be classified by a single controller.

The reduction in jitter confirms the improvement in QoS in a network by implementing traffic classification-based load balancing in a multi-controller SDN environment. According to Table 6, the jitter in this research work is nearly identical for two-controller-based and three-controller-based implementation. This may be the result of the fact that, despite the presence of two controllers, neither controller experienced congestion during our testing, resulting in the same jitter result for both circumstances.

5. Conclusions and Future Work

This paper focuses on creating a model that can classify incoming traffic first according to its type and then use that information as a function for a load-balancing module to route the traffic through various paths for various classes of traffic. To avoid network congestion when high traffic of a single class enters the network, multiple controllers are created. The multi-controller strategy also prevents link failure.

Different ML algorithms, including Logistic Regression, Support Vector Machine, K-Nearest Neighbors, XGBoost, decision tree (CART) and OPTICS have been implemented for classification purpose. In terms of accuracy, precision, recall, and f-1 score, decision tree is found to outperform others when the results of each of them are compared. In this case, logistic regression yields the best outcomes. However, the CART technique also produces results that are almost equal; as a result, after comparing the outputs of different algorithms for the training dataset and validation dataset, CART is considered to be the best algorithm. The considerable latency involved the classification process can be minimized by selecting the CART algorithm, which produces the least latency in the classification task. However, the calculation of latency during real-time classification before performing load-balancing has not been carried out in this study, and it remains one of the limitations that could be investigated in future work.

In order to avoid network congestion and link failure, two backup controllers are implemented to handle traffic classification in the event that the main controller’s CPU utilization exceeds the threshold value. The global controller keeps track of both the primary and secondary controllers. Further, the comparison of packet rate, bit rate, and jitter shows that applying load balancing based on traffic classification in multi-controller SDN environments enhances network performance as a whole.

Even if the research effort is effective in incorporating traffic classification-based load balancing in SDN to enhance system performance, there is still opportunity for improvement. We might be able to improve the network in a few ways to further improve performance and fully take advantage of SDN for network management, e.g., by testing the proposed approach on larger and more complex topologies, including real world scenarios; adding more traffic types and applications for more complex classification; using intelligent traffic classification and prediction in SDN; and integrating with edge computing, cloud services, and network slicing. Additionally, research on load balancing in SDN for data centers and ISP/Telco networks could cover a wide range of topics, including energy-efficient load balancing, intelligent multi-controller placement techniques, AI-based dynamic load balancing for multiple controllers, application-based load-balancing, blockchain technology and security issues in a multi-controller-based SDN environment. In the future, we plan to explore near-real-time attack detection and mitigation in a multi-controller-based SDN environment using ML.