SDN-based solutions for malware analysis and detection: State-of-the-art, open issues and research challenges

Abstract

Software-Defined Networking (SDN) has emerged as a key technology for countering evolving malware threats in 5G and Internet-of-Things (IoT) environments. This paper provides a comprehensive survey of SDN-based strategies for malware analysis and detection, consolidating several hundred candidate works and distilling a focused set of studies published up to April 2025. We examine approaches ranging from static code inspection and heuristic traffic monitoring to advanced machine learning and deep learning frameworks, demonstrating that these methods consistently achieve high detection accuracy with low false-positive rates while imposing only modest latency and resource overhead. We illustrate how SDN’s centralized control and programmable data plane enable rapid policy updates and real-time mitigation of malicious flows, surpassing traditional network defense mechanisms. Our review clarifies how AI-driven techniques enhance the identification of novel and obfuscated malware, and highlights persistent challenges such as the need for standardized datasets, controller scalability, and privacy-preserving inspection. By synthesizing key insights, open issues, and future research directions, this survey underscores the essential role of SDN in fortifying contemporary cybersecurity architectures.