Intelligent Real-Time Traffic Classification in SDN Using Deep Learning

Software-Defined Networking (SDN) enables programmable, centralized control of network forwarding, but effective controller applications depend on timely and reliable identification of heterogeneous traffic flows. This study evaluates a hybrid Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) classifier for flow-level traffic classification in an SDN test environment. The CNN component learns discriminative feature patterns, while the LSTM component models temporal dependencies. CICIDS 2017 and controlled SDN traffic support the supervised classification experiment, while MAWI traces are used as background backbone traffic context rather than as a source of the five supervised labels. A balanced 500-flow diagnostic test subset (100 flows per class) yields 91.2% overall accuracy, macro-precision of 91.2%, macro-recall of 91.2%, and macro-F1 of 91.2%; malicious traffic achieves recall of 0.91 and F1-score of 0.901. Average model inference latency ranges from 1.1 to 2.3 ms across the reported traffic classes. The results show that the CNN-LSTM model provides a strong classification-performance/latency trade-off for real-time SDN traffic analysis. The classifier supplies traffic labels to the controller-facing policy layer, where they can inform downstream routing, queueing, or prioritization decisions. Because the experimental results reported here evaluate classification and model inference rather than a full before-and-after routing benchmark, network-level load-balancing gains are treated as a deployment implication rather than as a directly measured outcome. The study therefore contributes an internally consistent flow-classification evaluation together with an SDN-oriented integration pathway and clearly defined directions for controller-level validation.