Abstract
Data centers, the critical infrastructure underpinning Cloud computing, often employ Software-Defined Networks (SDN) to manage cluster, wide-area and enterprise networks. As the network forwarding in SDN is dynamically programmed by controllers, it is crucial to ensure that the controller intent is correctly translated into underlying forwarding rules. Therefore, detecting and locating forwarding anomalies in SDN is a fundamental problem in production networks. Existing research proposals, roughly categorized into probing-based, packet piggybacking-based, and flow statistics analysis-based, either impose significant overhead or do not provide sufficient coverage for certain forwarding anomalies. In this article, we propose <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> , a controllable and passive measuring scheme to simultaneously deliver detection efficiency and accuracy. <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> first analyzes the entire network topology and flow rules, and then computes a minimal set of flows that can cover all forwarding rules. For each selected network flow, <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> decides the optimal number of monitoring positions on its path (much less than total number of hops), and installs dedicated rules to collect flow statistics. <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> controls the installation and expiration of these rules, along with unique flow labels, to guarantee the accuracy of collected statistics, based on which <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> algorithmically decides whether a forwarding anomaly is detected, and if so it further locates the anomaly. On top of <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> , we propose <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math></inline-formula> (a more scalable version of <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> ) to further optimize the usage and deployment of dedicated measurement rules. <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math></inline-formula> achieves over 40 percent rule reduction compared with <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> . We implement a prototype of both <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math></inline-formula> in about 12000 lines of code and evaluate the prototype extensively. The experiment results demonstrate <inline-formula><tex-math notation="LaTeX">${\sf (i)}$</tex-math></inline-formula> <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math></inline-formula> are accurate, e.g., they achieve over 95 percent true positive rate and 99 percent true negative rate in anomaly detection; <inline-formula><tex-math notation="LaTeX">${\sf (ii)}$</tex-math></inline-formula> <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math></inline-formula> are lightweight, e.g., they reduce the overhead of control messages compared with state-of-the-art by about 50 and 90 percent, respectively.
Highlights
DATA centers are critical infrastructure underpinning the Cloud computing
In production Software-Defined Networking (SDN) networks such as B4 [2] and Jupiter [1], a gigantic software, conceptually a Routing Agent [10] or a control plane [37], is responsible for translating the desired forwarding intent given by the controllers to the actual forwarding rules on switches, and the translation is often performed on different levels, including the global level that controls the entire network and the domain level that controls a sector of the network
ÐiiÞWhat is the control-plane and data-plane overhead introduced by Forwarding Anomaly Detection architEcture (FADE) and iFADE? In Section 7.3, we show that both FADE and iFADE introduce only several milliseconds of latency to react to network dynamics, and achieve nearly identical control-plane throughput as if they were not enabled
Summary
DATA centers are critical infrastructure underpinning the Cloud computing. Nowadays, production data centers often employ Software-Defined Networking (SDN) to manage both cluster networks [1], wide area networks [2], [3] and enterprise networks [4]. As a result, routing policies in SDN go beyond the typical shortest path routing This benefit is truly realized in the era of Cloud computing when Cloud providers build numerous data centers across the globe. To hyperconnect these data centers (both connecting the computing clusters within a data center [1] and interconnecting different data centers [2]), data center networks are required to deliver extremely high bisection bandwidth Towards this end, Cloud providers often build rich topologies in data center networks, such as Fat-tree [36], and apply SDN to intelligently and dynamically program routing paths (e.g., perform traffic engineering) to fully utilize the available network paths. As a result, checking the consistency between the control-plane intent and data-plane realization to detect and rectify forwarding anomalies is critical in production SDN networks. Prior works (such as [11], [38]) show that deliberate attacks may result in forwarding anomalies in SDN networks
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callMore From: IEEE Transactions on Parallel and Distributed Systems
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
