Software Defined Networking Control Plane Research Articles

Analysis of the Use of Artificial Intelligence in Software-Defined Intelligent Networks: A Survey

The distributed structure of traditional networks often fails to promptly and accurately provide the computational power required for artificial intelligence (AI), hindering its practical application and implementation. Consequently, this research aims to analyze the use of AI in software-defined networks (SDNs). To achieve this goal, a systematic literature review (SLR) is conducted based on the PRISMA 2020 statement. Through this review, it is found that, bottom-up, from the perspective of the data plane, control plane, and application plane of SDNs, the integration of various network planes with AI is feasible, giving rise to Intelligent Software Defined Networking (ISDN). As a primary conclusion, it was found that the application of AI-related algorithms in SDNs is extensive and faces numerous challenges. Nonetheless, these challenges are propelling the development of SDNs in a more promising direction through the adoption of novel methods and tools such as route optimization, software-defined routing, intelligent methods for network security, and AI-based traffic engineering, among others.

Internet of medical things and blockchain-enabled patient-centric agent through SDN for remote patient monitoring in 5G network

During the COVID-19 pandemic, there has been a significant increase in the use of internet resources for accessing medical care, resulting in the development and advancement of the Internet of Medical Things (IoMT). This technology utilizes a range of medical equipment and testing software to broadcast patient results over the internet, hence enabling the provision of remote healthcare services. Nevertheless, the preservation of privacy and security in the realm of online communication continues to provide a significant and pressing obstacle. Blockchain technology has shown the potential to mitigate security apprehensions across several sectors, such as the healthcare industry. Recent advancements in research have included intelligent agents in patient monitoring systems by integrating blockchain technology. However, the conventional network configuration of the agent and blockchain introduces a level of complexity. In order to address this disparity, we present a proposed architectural framework that combines software defined networking (SDN) with Blockchain technology. This framework is specially tailored for the purpose of facilitating remote patient monitoring systems within the context of a 5G environment. The architectural design contains a patient-centric agent (PCA) inside the SDN control plane for the purpose of managing user data on behalf of the patients. The appropriate handling of patient data is ensured by the PCA via the provision of essential instructions to the forwarding devices. The suggested model is assessed using hyperledger fabric on docker-engine, and its performance is compared to that of current models in fifth generation (5G) networks. The performance of our suggested model surpasses current methodologies, as shown by our extensive study including factors such as throughput, dependability, communication overhead, and packet error rate.

Flow Table Overflow Attacks in Software Defined Networks: A Survey

<p>While Software-Defined Networks (SDNs) have separated control and data planes and completely decouple the flow control from the data forwarding to enable network flexibility, programmability, and innovation, they also raise serious security concerns in each plane and the interfaces between the two planes. This paper, instead of studying the security issues in the SDN control plane as many literatures have done in current research, focuses on the security issues in the SDN data plane, aiming at the state of the art mechanims to identify, detect, and mitigate them. Specifically, this paper reviews the typical models, detections, and mitigations of SDN flow table overflow attacks. After reviewing the various vulnerabilities in SDNs, this paper categorizes the flow table overflow attacks into saturation, low-rate table exhaustion, and slow saturation attacks, and summarizes the attack models, detections, and mitigations of each category. It reviews the typical attacks that can overflow the flow tables and provides the main challenges and open issues for the future research.</p> <p> </p>

An intelligent zero trust secure framework for software defined networking

Software-defined networking (SDN) faces many of the same security threats as traditional networks. The separation of the SDN control plane and data plane makes the controller more vulnerable to cyber attacks. The conventional “perimeter defense” network security model cannot prevent lateral movement attacks caused by malicious insider users or hardware and software vulnerabilities. The “zero trust architecture” has become a new security network model to protect enterprise network security. In this article, we propose an intelligent zero-trust security framework IZTSDN for the software-defined networking by integrating deep learning and zero-trust architecture, which adopts zero-trust architecture to protect every resource and network connection in the network. IZTSDN uses a traffic anomaly detection mode CALSeq2Seql based on a deep learning algorithm to analyze users’ network behavior in real-time and achieve continuous tracking and analysis of users, restrict malicious users from accessing network resources, and realize the dynamic authorization process. Finally, the Mininet simulation platform is extended to build the simulation platform MiniIZTA supporting zero-trust architecture and the proposed security framework IZTSDN is experimentally analyzed. The experimental results show that the IZTSDN security framework can provide about 80.5% of throughput when the network is attacked. The accuracy of abnormal traffic detection reaches 99.56% on the SDN dataset, which verifies that the reliability and availability of the IZTSDN security framework are verified.

A deep learning technique to detect distributed denial of service attacks in software-defined networks

Software-Defined Network (SDN) is an established networking paradigm that separates the control plane from the data plane. It has central network control, and programmability facilities, therefore SDN can improve network flexibility, management, performance, and scalability. The programmability and control centralization of SDN have improved network functions but also exposed it to security challenges such as Distributed Denial of Service (DDoS) attacks that target both control and data planes. This paper proposes an effective detection technique against DDoS attack in SDN control plane and data plane. For the control plane, the technique detects DDoS attacks through a Deep Learning (DL) model using new features extracted from traffic statistics. A DL method (AE-BGRU) for DDoS detection uses Autoencoder (AE) with Bidirectional Gated Recurrent Unit (BGRU). The proposed features for the control plane include unknown IP destination address, packets inter-arrival time, Transport layer protocol (TLP) header, and Type of service (ToS) header. For the data plane, the technique tracks the switch's average arrival bit rate with an unknown destination address in the data plane. Then, the technique detects DDoS attacks through a DL-based model which also uses AE with BGRU. The proposed features in the data plane include the switch's stored capacity, the average rate of packets with unknown destination addresses, the IP Options header, and the average number of flows. The dataset is generated from feature extraction and computations from normal and attack packets and used with the classifier. Also, additional Machine Learning (ML) methods are used to enhance the detection process. If the model detects an attack, the technique mitigates DDoS effects by updating the user's trust value and blocking suspicious senders based on the trust value. The experimental results proved that compared to related techniques, the suggested method had a higher accuracy and lower false alarm rate.

Digital twin-driven SDN for smart grid: A deep learning integrated blockchain for cybersecurity

Internet of Things (IoT)-enabled Smart Grid (SG) network is envisioned as the next-generation network for intelligent and efficient electric power transmission. In SG environment, the Smart Meters (SMs) mostly exchange services and data from Service Providers (SPs) via insecure public channel. This makes the entire SG ecosystem vulnerable to various security threats. Motivated from the aforementioned challenges, we incorporate Digital Twin (DT) technology, Software-Defined Networking (SDN), Deep Learning (DL) and blockchain into the design of a novel SG network. Specifically, a secure communication channel is first designed using an authentication method based on blockchain technology that has the ability to withstand a number of well-known assaults. Second, a new DL architecture that includes a self-attention mechanism, a Bidirectional-Gated Recurrent Unit (Bi-GRU) model, fully connected layers, and a softmax classifier is designed to enhance the attack detection process in SG environments. To deliver low latency and real-time services, the SDN is next employed as the network’s backbone to send requests from SMs to a global SDN controller. DT technology is finally integrated into the SDN control plane, which stores the operating states and behavior models of SMs and communicates with SMs. The efficiency of the proposed framework is demonstrated by the blockchain implementation used in the SG network to assess computing time for the various numbers of transactions per block. Finally, the numerical results based on the N-BaIoT dataset shows better intrusion detection.

ITC: Intrusion tolerant controller for multicontroller SDN architecture

Software-Defined Networking (SDN) is a novel paradigm where the data plane and the control plane are decoupled on network devices. This approach places the control plane in an external entity, rather than in each individual device as in the traditional networking architecture to conquer the latter weaknesses such as the lack of global visibility of the network state. SDN simplifies network management, offers flexibility, and makes communication networks easier. However, SDN faces several security challenges, since the controller is considered as a single point of failure that may return the whole network down in case of a security compromise. Indeed, the single point of failure is partially tackled by the use of multi-controller mechanisms. However, simply using these mechanisms cannot avoid compromising vulnerable controllers due to their visible nature. In fact, the attacker needs just much more time to compromise the whole system. In this paper, we propose to approach the issue of intrusion tolerance in the SDN control plane by first applying a Recovery Based model which assumes that as soon as a system comes online it is compromised; therefore, periodic restoration to a good state is necessary. Secondly, we aim to establish Moving Target Defense (MTD) that provides a proactive defense against adaptive adversaries. The goal of the MTD in the Dispatcher is to constantly shift between multiple controllers with diverse configurations in order to increase the uncertainty for the attacker, in effect, diminishing the information gathered from the control plan during the reconnaissance phase of a potential attack. Finally, We put in place probabilistic models that can contribute to the perception of the performance of self-cleansing intrusion tolerance in the SDN control plane.

Detection and Mitigation of Malicious DDoS Floods in Software Defined Networks

The advent of software-defined networking (SDN) has significantly transformed network management by offering modular control and data plane characteristics, enabling adaptability and flexibility in managing networks. This innovation entails the separation of control and data plane elements to facilitate efficient network administration. Nevertheless, the centralization resulting from control plane separation renders SDN vulnerable to cyber threats, particularly Distributed Denial-of-service (DDoS) attacks that target SDN controllers. Recently, studies have highlighted the relevance of entropy-based attack detection techniques compared to alternative methods. However, relying solely on entropy may overlook detection in specific variables, such as flow specification variations. To address the limitations of entropy-based detection systems, we developed a DDoS attack detection framework within the SDN control plane, integrating the packet flow initiation and specification properties with an entropy-based algorithm to ensure accurate attack detection measures. Our lightweight framework aims to mitigate DDoS attacks by detecting their impact in the early stages, thus preventing SDN controllers from being hijacked due to excessive packet flooding. The simulation is employed in Mininet network simulator to implement, and the testbed is created by focusing UDP flood attacks in widely used data-centric tree topologies. The experimental results demonstrate that our proposed solution effectively detects and mitigates novel parameters of SDN-based DDoS floods within 150 packets while maintaining minimal delay and high accuracy

A Survey on SDN and SDCN Traffic Measurement: Existing Approaches and Research Challenges

The Software-Defined Network (SDN) is a next-generation network that uses OpenFlow to decouple the control plane from the data plane of forwarding devices. Other protocols for southbound interfaces include ForCES and POF. However, some security issues might be in action on the SDN, so that attackers can take control of the SDN control plane. Since live video calling, QoS control, high bandwidth needs, and resource management are inevitable in any SDN/Software-Defined Cellular Network (SDCN), traffic monitoring is an integral approach for safeguarding against DDoS, heavy hitters, and superspreaders. In such a scenario, SDN traffic measurement comes into action. Thus, we survey SDN traffic measurement solutions to assess how these solutions can make a secure, efficient, and robust SDN/SDCN architecture. This research classifies SDN traffic measurement solutions according to network application behavior and compares several ML approaches. Furthermore, we find out the challenges related to SDN/SDCN traffic measurement and the future scope of research, which will guide the design and development of more advanced traffic measurement solutions for a scalable, heterogeneous, hierarchical, and widely deployed SDN/SDCN architecture. In more detail, we list different kinds of practical machine learning (ML) approaches to analyze how we can improve traffic measurement performances. We conclude that using ML in SDN traffic measurement solutions will help secure SDNs/SDCNs in complementary ways.

Measuring the Consistency Between Data and Control Plane in SDN

Software Defined Networking (SDN) simplifies network control and management by decoupling the control plane from the data plane. However, the actual packet behaviors, conforming to the rules in the data plane flow tables, may violate the original policies in the controller due to the inconsistency between the data plane and control plane. To address this problem, we propose 2MVeri, a framework for measuring the consistency between the Data and Control plane, defined as the consistency between the control plane policies and data plane rules. 2MVeri uses a modules, a Bloom filter and a two-dimensional vector as a tag which is inserted in the packet header and is updated in each switch that the packet traverses. By exploiting path information compressed in the tag, 2MVeri can verify the consistency between the data and control plane. Moreover, when verification fails, 2MVeri is able to localize the faulty switch. Experimental results show that in the k = 4 fat tree topology, the verification accuracy of 2MVeri is as high as 100%. In addition, when the actual path is inconsistent with the expected path, 2MVeri can locate the wrong switch with an accuracy of 99.8%.

Jointly optimized resource allocation for SDN control and forwarding planes in edge-cloud SDN-based networks

Today’s resource allocation strategies for edge-cloud network based on Software-Defined Network (SDN) and Network Function Virtualization (NFV) architectures often make a decision of placing resource based on network locations, i.e. edge or core cloud. Unfortunately, these strategies are not optimally tailored for a growing class of Internet-of-Things (IoT) services whose traffic is designated to go through a Virtual Network Functions (VNF) service chain. Without considering the communication between SDN control plane and forwarding plane, inappropriate SDN controllers could be selected for switches, which may result in a significant setup delay of the whole service chain. In addition, the fluctuate demand of IoT services requires the entire system, that is composed of controllers, forwarding elements, i.e. switches, and physical machines, being stable during service provisioning. In this paper, we jointly address two issues, i.e. SDN controller-switch assignment and VNF placement, both are high-complexity problems. We formulate the joint optimization problem of dynamically provisioning resource for SDN controllers and VNFs in a long run. We then apply the Lyapunov optimization framework to transform a long-term optimization problem into a series of real-time problems and employ exponentiated gradient ascent (EGA) method to find a near-optimal solution. Extensive simulation and experiments show that our approach helps to optimize the system cost up to 11 ∼ 40% depending on service demand and network size.

A Blockchain-Based Consensus Slicing Mechanism for Distributed SDN Control Plane

In large-scale distributed Software Defined Networks (SDNs), a logically centralized network view is required in the physically distributed control plane to provide correct application decisions. Distributed SDN controllers communicate through east-west interfaces to achieve consistency of the global network view and coordination of control decisions. The consistency of the global network view requires synchronization of various network states in multiple controllers in SDN. Different network states differ in update rate, data size, application access method, etc. These factors affect the consensus protocol and synchronization strategy used for state synchronization. Therefore, we propose a consensus slicing mechanism that dynamically adjusts the synchronization strategy according to application requirements, minimizing consistency differences among controllers and reducing synchronization overhead. Then, we use a storage approach combining blockchain with distributed databases to store synchronized state information, improving the efficiency and anti-tamper ability of state information. Simulation experiments validate the effectiveness of the proposed approach.

A Comprehensive Survey of In-Band Control in SDN: Challenges and Opportunities

Software-Defined Networking (SDN) is a thriving networking architecture that has gained popularity in recent years, particularly as an enabling technology to foster paradigms like edge computing. SDN separates the control and data planes, which are later on synchronised via a control protocol such as OpenFlow. In-band control is a type of SDN control plane deployment in which the control and data planes share the same physical network. It poses several challenges, such as security vulnerabilities, network congestion, or data loss. Nevertheless, despite these challenges, in-band control also presents significant opportunities, including improved network flexibility and programmability, reduced costs, and increased reliability. Benefiting from the previous advantages, diverse in-band control designs exist in the literature, with the objective of improving the operation of SDN networks. This paper surveys the different approaches that have been proposed so far towards the advance in in-band SDN control, based on four main categories: automatic routing, fast failure recovery, network bootstrapping, and distributed control. Across these categories, detailed summary tables and comparisons are presented, followed by a discussion on current trends a challenges in the field. Our conclusion is that the use of in-band control in SDN networks is expected to drive innovation and growth in the networking industry, but efforts for holistic and full-fledged proposals are still needed.

SECURING CENTRALIZED SDN CONTROL WITH DISTRIBUTED BLOCKCHAIN TECHNOLOGY

Software Defined Networks (SDN) advocates segregation of network control logic, forwarding functions and management applications into different planes to achieve network programmability, automated and dynamic flow control in next generation networks. It promotes deployment of novel and augmented network management functions to have flexible, robust, scalable and cost-effective network deployments. All these features introduce new research challenges and require secure communication protocols among the segregated network planes. This manuscript focuses on the security issue of southbound interface which operates between the SDN control and data plane. We have highlighted the security threats associated with an unprotected southbound interface and the issues related with the existing TLS based security solution. A lightweight blockchain based decentralized security solution is proposed for southbound interface to secure the resources of logically centralized SDN controllers and distributed forwarding devices from opponents. The proposed mechanism can operate in multi-domain SDN deployment and can be used with wide range of network controllers and data plane devices. In addition to it, the proposed security solution is analyzed in terms of security features, communication and reauthentication overhead.

Multi-Agent Deep Q-Network Based Dynamic Controller Placement for Node Variable Software-Defined Mobile Edge-Cloud Computing Networks

Software-defined networks (SDN) can use the control plane to manage heterogeneous devices efficiently, improve network resource utilization, and optimize Mobile Edge-Cloud Computing Networks (MECCN) network performance through decisions based on global information. However, network traffic in MECCNs can change over time and affect the performance of the SDN control plane. Moreover, the MECCN network may need to temporarily add network access points when the network load is excessive, and it is difficult for the control plane to form effective management of temporary nodes. This paper investigates the dynamic controller placement problem (CPP) in SDN-enabled Mobile Edge-Cloud Computing Networks (SD-MECCN) to enable the control plane to continuously and efficiently serve the network under changing network load and network access points. We consider the deployment of a two-layer structure with a control plane and construct the CPP based on this control plane. Subsequently, we solve this problem based on multi-agent DQN (MADQN), in which multiple agents cooperate to solve CPP and adjust the number of controllers according to the network load. The experimental results show that the proposed dynamic controller deployment algorithm based on MADQN for node-variable networks in this paper can achieve better performance in terms of delay, load difference, and control reliability than the Louvain-based algorithm, single-agent DQN-based algorithm, and MADQN- (without node-variable networks consideration) based algorithm.

From Control to Chaos: The Dynamic SDN Control Plane

Software-defined networking (SDN) has revolutionized the way networks are designed and managed, with the control plane being a critical component. The SDN control plane is responsible for managing and orchestrating network traffic flows, but its traditional static approach can be limiting in dynamic and complex network environments. This abstract explores the concept of a dynamic SDN control plane, which can adapt and respond to changing network conditions, leading to better network performance and efficiency. The dynamic control plane involves the use of machine learning algorithms, artificial intelligence, and network analytics to constantly monitor and adjust network policies in real-time. The dynamic SDN control plane empowers networks to move from a state of control to chaos, enabling greater flexibility, agility, and resilience in network management. This abstract provides insights into the potential benefits of a dynamic SDN control plane and highlights the challenges and opportunities in implementing this approach.

Hierarchical Domain-Based Multicontroller Deployment Strategy in SDN-Enabled Space–Air–Ground Integrated Network

The space–air–ground integrated network (SAGIN) is considered to be a significant framework for realizing the vision of “6G intelligent connection of all things.” A typical SAGIN consists of three parts: a space-based network composed of various orbiting satellites, an air-based network composed of aircraft, and a traditional ground-based network. Considering the cost of satellite launch, the network needs to be flexible and controllable. In order to ensure that the ground can handle satellite anomalies in real time by program, it is necessary to introduce in-orbit programmable networks, such as the software-defined network (SDN). In the network management architecture, if the controller plane in the SDN adopts the flat management scheme, the expansion of the control plane is limited due to the low efficiency of data synchronization among controllers. Compared with controller deployments on terrestrial networks, multicontroller deployments in the SAGIN face the following problems: the dynamic change of the satellite network topology, the large-scale network nodes, the increase or decrease in the number of aerial vehicles, and the unbalanced distribution of ground users. Therefore, it is of great significance to study how to optimize the deployment of multiple controllers in the SDN-enabled SAGIN. This article introduces an SDN into the SAGIN and designs a hierarchical domain-based SDN-enabled SAGIN architecture. A multicontroller deployment strategy for the hierarchical domain-based SDN-enabled SAGIN is proposed. First, we divide the SDN control plane into two layers, i.e., the primary controller layer is deployed on the ground network and the secondary on the space-based network. The SDN data plane is composed of space-based, air-based, and ground-based networks. Second, considering the average network delay and the controller load, a multiobjective optimization model is constructed. To determine the number of controllers and the relative positions of switch nodes and controllers, the clustering algorithm based on <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> -means is adopted to initially divide the data plane. Finally, to improve the global search ability of the algorithm, a multiobjective optimization algorithm based on a genetic algorithm is adopted. The simulation results show that the proposed strategy is effective in reducing the average network delay and improving the controller load balance. Compared to other algorithms, the average network delay is reduced by 13.3% and the controller load is improved by 10.33%.

A Quantification Method for the Heterogeneity of Mimic Control Plane in SDN

SDN (Software-Defined Networking) renders network management more centralized and flexible. However, its control plane is vulnerable to attacks. By introducing dynamic heterogeneous redundancy, the amimic control plane is built to effectively solve the problems of single control points of failure, unknown backdoor vulnerabilities and static configuration. Heterogeneity is an important indicator for evaluating the security of a system. Generally speaking, the greater the heterogeneity, the higher the security. Currently, there is little research evaluating the security of the mimic control plane in SDN by quantifying the heterogeneity. To this end, this paper proposes two methods for measuring the heterogeneity, based on the biological population diversity assessment method. Firstly, the heterogeneity quantification method, i.e., method 1, is based on system complexity and difference. On this basis, another heterogeneous quantification method, i.e., method 2, is established using high order symbiosis of the vulnerabilities. The experimental results show that, compared to the known methods, the heterogeneous quantification method 1 considers more comprehensive factors and is closer to reality. The heterogeneity quantification method 2 is more instructive to quantify the security of the mimic control plane.

DeepAir: Deep Reinforcement Learning for Adaptive Intrusion Response in Software-Defined Networks

In this paper, we propose an adaptive intrusion response solution based on deep reinforcement learning, namely DeepAir, to effectively defend against cyber-attacks in Software-Defined Networks (SDN). Specifically, we first study an intrusion response system (IRS) that operates at the SDN control plane. Next, we propose a dynamic intrusion response solution to maximize the attack defense performance while minimizing the negative impact on benign traffic forwarding and the policy deployment cost in the SDN data plane. Then, we model the intrusion response system based on a Markov decision process (MDP) approach and formulate the related optimization problem. Afterward, we develop a Double Deep <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${Q}$ </tex-math></inline-formula> -Network based intrusion response control algorithm to assist the intrusion response system to quickly obtain the optimal intrusion response policy. In our case study, we consider denial-of-service (DoS) attacks—the performance evaluation results demonstrate that DeepAir can effectively prevent malicious packets from arriving at the victim in all considered DoS attack scenarios, i.e., approximately 85% of attack packets are dropped. Moreover, by applying the optimal intrusion response policy, DeepAir can significantly reduce the ratio of Quality-of-Service violated traffic flows compared to a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${Q}$ </tex-math></inline-formula> -learning based approach (by 70%), and to two existing solutions, i.e., GATE (by 75%) and GTAC-IRS (by 80%), respectively.

Scalable and Flexible Traffic Steering for Service Function Chains

Network Function Virtualization (NFV) has inspired numerous orchestration algorithms to decide Virtualized Network Function (VNF) placement and routing paths for service requests with Service Function Chain (SFC) demands. With different optimization goals, these algorithms may select various routing paths for request flows. Nevertheless, existing traffic steering solutions either fail to fully support NFV Orchestrator (NFVO) in path selection, or result in low scalability in the underlay Software Defined Network (SDN). In this paper, we propose STAR to tackle both problems simultaneously. STAR divides the entire routing path for SFC request into several path segments, then performs Output-Port-based, Default-Path-based or RSP-ID-based traffic steering on each path segment. With the idea of path division and these traffic steering mechanisms, STAR achieves flexible traffic steering along any paths selected by NFVO and enables different Rendered Service Paths (RSPs) with the same path segments to share the same forwarding rules. In this way, STAR ensures the correct enforcement of path selection decisions from NFVO and significantly reduces forwarding rule consumption and control overhead. We evaluate STAR with the experiments on a real testbed and large-scale simulations. The results show that our framework is scalable in the SDN data plane and control plane (e.g., reducing rules in hardware switches by more than 70% compared with NSH-based solutions) while retaining the flexibility of steering traffic along any SFC routing paths to provide full support for path decision enforcement (e.g., achieving the highest path decision enforcement ratio in 11 of the 12 cases) with acceptable overhead.