Elephant flow detection intelligence for software-defined networks: a survey on current techniques and future direction

Mosab Hamdan, Hashim Elshafie, Sayeed Salih, Samah Abdelsalam, Omayma Husain, Mohammed S.M. Gismalla, Mustafa Ghaleb*, M. N. Marsono

*Corresponding author for this work

Research output: Contribution to journalReview articlepeer-review


Software-defined networking (SDN) is characterized by the separation of the packet forwarding plane from the network control plane. This separation offers an extensive view of the network’s state, enhancing network resilience and management. Network traffic classification can improve SDN control and resource provisioning, particularly for elephant flows (EFs) detection. Existing techniques for detecting EFs utilize preset thresholds and bandwidth that are inadequate for changing traffic concepts. Moreover, these techniques consume high data plane-controller bandwidth and have a high detection time. This research first describes the related management techniques in SDN. Then according to the detecting location, elephant flow detection approaches are classified into four kinds: host-based, switch-based, controller-based, and hybrid controller-switch-based detection. This research examined four types of detection approaches and concluded that host-based detection primarily relies on the flow statistics threshold. Such approaches frequently gather flow statistics by monitoring the socket buffer or via the hypervisor. In contrast, switch-based detection can leverage both the flow statistics threshold and flow characteristics. Controller-based detection techniques in SDN focus on extracting flow feature statistics at the controller level, aiming to reduce switch overhead while potentially increasing controller loads. Finally, hybrid controller-switch-based detection combines both routing aspects, offering fine-grained flow control. However it faces challenges in maintaining a balance in timeliness, accuracy, and cost. Furthermore, the survey incorporates recent SDN advancements such as machine learning-based methods, programmable switches, and real-world SDN applications in data centers, global content delivery networks, healthcare, and IoT. Finally, the article makes a comprehensive comparison and puts forward several points of future prediction in terms of elephant flow detection, taking into account recent advances in SDN research.

Original languageEnglish
JournalEvolutionary Intelligence
StateAccepted/In press - 2024

Bibliographical note

Publisher Copyright:
© The Author(s), under exclusive licence to Springer-Verlag GmbH Germany, part of Springer Nature 2024. Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.


  • Elephant flow detection
  • Flow classification
  • Load balancing
  • Network traffic classification
  • Re-routing
  • Scheduling
  • Software-defined networking

ASJC Scopus subject areas

  • Mathematics (miscellaneous)
  • Computer Vision and Pattern Recognition
  • Cognitive Neuroscience
  • Artificial Intelligence


Dive into the research topics of 'Elephant flow detection intelligence for software-defined networks: a survey on current techniques and future direction'. Together they form a unique fingerprint.

Cite this