This paper proposes a novel traffic monitoring framework, namely, DeepMonitor, for SDN-based IoT networks to provide fine-grained traffic analysis capability for different IoT traffic types at the network edges. Specifically, we first develop an intelligent flow rule match-field control system, called DeepMonitor agent, for SDN-based IoT edge nodes, taking different granularity-level requirements and their maximum flow-table capacity into consideration. We then formulate the control optimization problem for each edge node employing the Markov decision process (MDP). Next, we develop a double deep Q{Q} -network (DDQN) algorithm to quickly achieve the optimal flow rule match-field policy. Moreover, we propose a federated DDQN-based traffic monitoring mechanism to significantly improve the learning performance of the edge nodes. The results obtained through extensive emulations show that by applying the DeepMonitor, the flow-table overflow problem at the edge nodes can be completely bypassed. The average number of match-fields in a flow rule achieved by DeepMonitor is increased by approximately 37% (for medium and diverse granularity-level requirements) and 41.9% (for high granularity-level requirement) compared to that of an existing solution, i.e., FlowStat. Finally, by adopting DeepMonitor, the DDoS attack detection performance of an intrusion detection system can be enhanced by up to 22.83% compared with that of FlowStat.

中文翻译：

---

基于 SDN 的物联网网络中用于流量监控的联合深度强化学习


本文针对基于SDN的物联网网络提出了一种新颖的流量监控框架，即DeepMonitor，为网络边缘的不同物联网流量类型提供细粒度的流量分析能力。具体来说，我们首先为基于SDN的物联网边缘节点开发一个智能流规则匹配字段控制系统，称为DeepMonitor代理，考虑到不同粒度级别的要求及其最大流表容量。然后，我们采用马尔可夫决策过程（MDP）制定每个边缘节点的控制优化问题。接下来，我们开发了双深度 Q{Q} 网络（DDQN）算法来快速实现最优流规则匹配字段策略。此外，我们提出了一种基于联邦DDQN的流量监控机制，以显着提高边缘节点的学习性能。通过大量仿真得到的结果表明，应用DeepMonitor可以完全绕过边缘节点的流表溢出问题。 DeepMonitor实现的流规则平均匹配字段数较现有方案分别提升约37%（针对中、多种粒度级需求）和41.9%（针对高粒度级需求），即，流量统计。最后，采用DeepMonitor，入侵检测系统的DDoS攻击检测性能相比FlowStat可提升高达22.83%。