Unleashing the power of SDN and GNN for network anomaly detection: State‐of‐the‐art, challenges, and future directions

Abstract Modern computer networks' increasing complexity and scale need serious attention towards network anomaly detection. Software‐defined networking (SDN) and graph neural networks (GNN) have emerged as promising approaches for anomaly detection due to their ability to capture dynamic network behavior and learn complex patterns from large‐scale network data. The amalgamation of SDN and GNN for network anomaly detection presents promising opportunities for improving the accuracy and efficiency of network anomaly detection. This paper focuses on various trends, issues, and challenges by integrating GNN on the top of SDN for network anomaly detection. The article highlights the advantages of using SDN for providing fine‐grained control and programmability in network monitoring. At the same time, GNN can model network behavior as a graph and learn representations from graph‐structured data. The authors also discuss the limitations of traditional anomaly detection methods in SDN, such as rule‐based approaches, and the potential of GNN to overcome these limitations by leveraging their ability to capture non‐linear and dynamic patterns in network data. This paper also presents a case study of DoS attack detection using SDN. The result shows that SDN based approach helps to detect attacks with an accuracy of 97% with future research directions.