A Computational Intelligence-Driven Reference Architecture for Anomaly Detection in Software-Defined Networking (SDN) - Fernandes, Rivaldo; Dalmazo, Bruno L.; Riker, André; Rocha Filho, Geraldo Pereira; Meneguette, Rodolfo; Pereira Júnior, Lourenço; Immich, Roger (Anais do Simpósio Brasileiro de Sistemas de Informação (SBSI), 2026)
Research Context: The rise of Cloud, 5G, and IoT demands the continuous control of millions of networked devices. While Software-Defined Networking (SDN) simplifies network management, it struggles with security and the fine-grained analysis necessary for reliable operational problem detection. Scientific Problem: A critical architectural gap exists as there is no standardized, flexible framework to catalog diverse network scenarios and automatically associate them with the most effective Computational Intelligence (CI) techniques. This lack of a self-learning structure severely hinders the intelligence of the SDN control layer. Proposed Solution: We present a novel, technology-agnostic Reference Architecture for anomaly detection, applicable to both SDN and traditional networks. This highly resilient design leverages hexagonal microservices and rigorously adopts the TM Forum’s Open Digital Architecture (ODA) model (TAM and eTOM) to achieve crucial industry standardization and interoperability. Related IS Theory: Work Systems Theory (proposing a systemic framework for an organizational process) and Institutional Theory, highlighted by the strategic adoption of ODA/TM Forum standards to ensure industry legitimacy. Research Method: An experimental methodology utilizing a Proof-of-Concept (PoC) prototype validated the architecture. We trained and assessed seven distinct Machine Learning (ML) algorithms against two different public datasets, proving the architecture’s inherent versatility. Summary of Results: Results confirm the absolute need for a flexible architecture, as the solution model varies significantly across scenarios. The analysis showed that the choice of the most effective algorithm is strictly contingent upon the specific anomaly type and the chosen evaluation metric. Contributions and Impact to IS Area: The main contribution is a standardized Reference Architecture that standardizes the evaluation, promotion, and application of diverse computational intelligence techniques according to the network context. This provides a blueprint for next-generation, self-learning, and standards-compliant network operations, marking a significant step towards truly autonomous networks.