Behavioral Traffic Monitoring and Analysis in Software-Defined Networks

In Software-Defined Networking (SDN), the centralized control model introduces both operational flexibility and new security challenges. While much research has focused on detection-based solutions, this paper presents a monitoring-centric framework for analyzing traffic behavior in SDN environments without relying on classification models. Using both the InSDN public dataset and a custom-generated dataset in a Mininet-Ryu testbed, traffic features such as flow duration, destination port entropy, and controller packet-in rates were examined. Results demonstrate that behavioral anomalies, such as entropy drops and packet-in rate spikes, can be effectively identified through statistical and control-plane analysis. The findings validate the feasibility of behavior-based traffic monitoring as a foundation for proactive network management.