Software Defined Networking Deployment Research Articles

Towards Effective Intrusion Detection in OpenFlow-Based SDN Architectures

This research article develops and assesses a thorough intrusion detection system (IDS) to investigate improvements in security inside Software-Defined Networking (SDN) environments. With an emphasis on packet-level analysis for the detection and mitigation of possible network intrusions, the study explores the integration of IDS features into SDN controllers. The suggested IDS is simulated and empirically assessed in a variety of network circumstances, such as traffic fluctuations, delay changes, and increased iperf scenarios, using a Mininet-based framework. The research advances our understanding of efficient intrusion detection techniques inside the SDN paradigm by providing insights into security issues and possible solutions for upcoming SDN deployments.

ML-based pre-deployment SDN performance prediction with neural network boosting regression

Software defined networking (SDN) has been proposed as an effective approach to improve network management efficiency and increase network intelligence in various networks. However, configuring and deploying suitable SDN functionalities is challenging. To overcome these obstacles in SDN network deployment, machine learning models have been introduced to monitor and predict the quality of service (QoS) in an SDN-enabled network. However, most existing studies are applicable only to deployed SDN networks with specific network topologies. In this study, a prediction-based SDN network configuration and deployment scheme is proposed for unseen network topologies before the actual deployment of SDN functionalities. In addition, a machine learning-based pre-deployment SDN performance prediction problem is formulated, and a neural network boosting regression model (i.e., NNBoost) is proposed as the solution. Numerical experiments demonstrate that NNBoost outperforms other machine learning algorithms, including deep learning methods, proposed in the literature, on datasets generated with both real-world and synthetic network topologies, compared with random forest (RF), AdaBoost, XGBoost, LightGBM, deep neural network (DNN) and long short-term memory (LSTM). It is found that NNBoost achieves lower root mean square error (RMSE), mean absolute error (MAE), and mean absolute percentage error (MAPE) results for the maximum and mean values for the Round-Trip Time (RTT), Switch-to-Controller (S2C) traffic, and Controller-to-Controller (C2C) traffic. It is also found that by adding extra training data samples generated with synthetic network topologies, NNBoost achieves a better prediction performance on the test data samples for real-world network topologies.

Controller placement problem during SDN deployment in the ISP/Telco networks: A survey

AbstractWith the successful implementation of Software‐Defined Networking (SDN) in data center networking, the way forward for its deployment in the ISP/Telco network is becoming prominent. Small and medium‐sized networks may easily adopt SDN. The research on SDN deployment and implementation for a large‐scale network is continuing. This paper properly presents the current research status of Controller Placement Problem (CPP) and Multi‐CPP (MCPP) over SDN with their specific challenges and provides a comprehensive review of the major performance metrics, that is, latency, and controller load balancing techniques. This survey highlights the use of network partitioning‐based CPP and clustering approaches and their benefits in the context of SDN deployment. Moreover, this paper highlights the importance of implementing SDN and SDN security issues into ISP/Telco networks. Finally, we provide some key areas of ongoing research and discuss the future research direction regarding the various SDN‐based Controller Placement (CP) issues in the next‐generation IP and advanced networking technologies.

An End-Host-Importance-Aware Secure Service-Enabled Hybrid SDN Deployment

Security is critical to networks, but TCP/IP-based legacy networks are difficult to advance new security functions due to the use of costly inflexible hardware devices and error-prone network configurations. Recent literature explores the paradigm of consolidating security services with the forwarding functionality using Software-defined Networking (SDN). Existing full SDN deployment, replacing all legacy network devices with SDN devices, is cost-prohibitive. Whereas the hybrid SDN that only upgrades partial legacy devices to SDN switches is considered practical. However, the challenge is to minimize threats and deployment expenses simultaneously under heterogeneous end-host businesses that have various importance. In this paper, we study the challenge and propose the (EASON) problem. We mathematically formulate the EASON problem as an integer programming problem, prove its non-polynomial time complexity, and propose a heuristic algorithm called BonSéc. We conduct rigorous simulations on real-world topologies and traces. Experimental results show that BonSéc achieves comparable security and cost performances to the optimal solution on small topologies. Meanwhile, it is scalable on larger topologies.

Practical Labs for Teaching SDN Security

The rapid adoption of Software Defined Networking (SDN) in the industry has exposed certain security risks today some of which are unique to its paradigm. Security issues around the use-cases that expose these risks are fundamentally aligned with the networking and cybersecurity concepts that are taught at the graduate level in academia. In this paper, we present a number of lab activities on SDN security that are inspired from practical use-cases in SDN deployments. The goal of this effort is to help students give a shape to their thought process about the practical security implications of SDN deployments and gain valuable practical domain knowledge in securing an environment with such deployments.

A Research Review of OpenFlow for Datacenter Networking

OpenFlow is a network device management and monitoring protocol, as well as a switch specification, that has enabled research, experimentation and deployment of software-defined networks in general, and data center networks in particular. In this review, after describing the particularities of data center networks and OpenFlow technology, a collection of recent research papers integrating both topics is analyzed. The collection of proposals made by the authors whose research is reviewed is very broad. Most focus on traffic engineering, load balancing, congestion reduction and related topics, with the goal of optimizing data transfer by using all available resources. Other works focus on issues related to the multi-tenancy nature of these large networks, monitoring them, improving their security or modifying switch architecture specifically for data center networks. Overall, we have a panoramic view of the issues related to data center networking and the flexibility OpenFlow provides to help solve them.

LtRFT: Mitigate the Low-Rate Data Plane DDoS Attack With Learning-To-Rank Enabled Flow Tables

Software-Defined Networking (SDN) switches typically have limited ternary content addressable memory (TCAM) that caches the flow entries on the data plane. The scarcity and strong resource competitiveness of TCAM space put the flow tables at the risk of malicious Distributed Denial-of-Service (DDoS) attacks. In this paper, we propose LtRFT, a Learning-To-Rank (LtR) based scheme for mitigating the low-rate DDoS attacks targeted at flow tables. LtRFT consists of three modules: <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">monitor</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ranker</i> , and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">mitigator</i> . <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Monitor</i> manages the flow table status and sends alerts to other modules after detecting attacks. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Ranker</i> models the attack mitigation problem as a flow entry ranking task, and ranks malicious flows with a high eviction priority using a pairwise-based LtR algorithm. The <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">mitigator</i> frees up the flow table space by deleting malicious flow entries according to the flow entry ranking sequence generated by <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ranker</i> . We introduce LtR to network attack detection innovatively and use both classification and information retrieval metrics to describe and evaluate LtRFT. Extensive experiments were conducted to validate the effectiveness and robustness of LtRFT in detecting and mitigating the low-rate data plane DDoS attacks. LtRFT can detect malicious attack flows with an accuracy of over 96%, and can reduce the attack flow duration by 97.7% with an average extra latency of 0.5 seconds, which proves that LtRFT is practicable in SDN deployments.

Performance Evaluation of Topologies for Multi-Domain Software-Defined Networking

Software-defined networking (SDN) is widely used in multiple types of data center networks, and these distributed data center networks can be integrated into a multi-domain SDN by utilizing multiple controllers. However, the network topology of each control domain of SDN will affect the performance of the multi-domain network, so performance evaluation is required before the deployment of the multi-domain SDN. Besides, there is a high cost to build real multi-domain SDN networks with different topologies, so it is necessary to use simulation testing methods to evaluate the topological performance of the multi-domain SDN network. As there is a lack of existing methods to construct a multi-domain SDN simulation network for the tool to evaluate the topological performance automatically, this paper proposes an automated multi-domain SDN topology performance evaluation framework, which supports multiple types of SDN network topologies in cooperating to construct a multi-domain SDN network. The framework integrates existing single-domain SDN simulation tools with network performance testing tools to realize automated performance evaluation of multi-domain SDN network topologies. We designed and implemented a Mininet-based simulation tool that can connect multiple controllers and run user-specified topologies in multiple SDN control domains to build and test multi-domain SDN networks faster. Then, we used the tool to perform performance tests on various data center network topologies in single-domain and multi-domain SDN simulation environments. Test results show that Space Shuffle has the most stable performance in a single-domain environment, and Fat-tree has the best performance in a multi-domain environment. Also, this tool has the characteristics of simplicity and stability, which can meet the needs of multi-domain SDN topology performance evaluation.

HybCon: A Scalable SDN-Based Distributed Cloud Architecture for 5G Networks

In a time where data traffic is booming, Software-defined Networking (SDN) is becoming the most plausible solution to cope with the conventional networks shortcomings. The separation of the control (software) and the data (hardware) planes makes of SDN a technology-enabled to a multitude of new and promising applications and use cases for 5G network technology. Yet, initial SDN deployments considered having a single controller for the entire network. However, this arrangement is deemed to be counterproductive in large-scale and ultra-reliable networks based SDN as the controller might become the systems bottleneck. To address this issue, several multi-controller architectures were proposed. They are of three types: flat, hierarchical or hybrid. For theses architectures to be potent for 5G core networks, efficient path computation and flow tables update mechanisms are needed. In this paper, we propose HybCon, a hybrid SDN-based distributed Cloud architecture having the control plane distributed over different controller types (i.e., Fog, Edge, SDN). When a path computation request is received, HybCon involves some/all of the controllers and uses a multi-priority queueing model along with node parallelism to expedite the path computation and to cut down the synchronization overhead.

On Efficient Service Function Chaining in Hybrid Software Defined Networks

To minimize operating expenses (OPEX) and enhance flexibility for network service provisioning, network function virtualization (NFV) is used to chain an ordered sequence of virtualized network functions (VNFs), also known as service function chain (SFC), which can be placed on commodity servers. As a highly complementary to NFV, software-defined networking (SDN) can offer an agile way of VNF orchestration with the capability of fine-granularity network control over flows. However, one-step migration to SDN is impossible in ISP networks. Thus, in this paper we resort to hybrid SDN to implement SFC provisioning. By jointly optimizing SDN deployment that largely determines capital expenditures (CAPEX) and VNF placement that decides OPEX, we manage to make a tradeoff between CAPEX and OPEX, and to find out an appropriate SDN deployment rate for network operator. We first formulate the problem as an integer linear programming (ILP) model <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\boldsymbol {P}$ </tex-math></inline-formula> , then, reformulate it with column generation technique and decomposition theory to develop a distributed approximation algorithm CGPD which obtains a tight upper bound of optimal solution to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\boldsymbol {P}$ </tex-math></inline-formula> . In order to better decrease CAPEX, a dynamic programming-based heuristic EOES giving importance to effective resource sharing is further designed based on a hidden Markov model. The simulation results indicate that, the difference between <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\boldsymbol {P}$ </tex-math></inline-formula> and CGPD is marginal. CGPD outperforms EOES in terms of total cost, average delay and bandwidth utilization, and EOES on the other hand demands 20% SDN deployment rate which is half of that of CGPD.

Feedback ARMA Models versus Bayesian Models towards Securing OpenFlow Controllers for SDNs

In software-defined networking (SDN), the control layers are moved away from the forwarding switching layers. SDN gives more programmability and flexibility to the controllers. OpenFlow is a protocol that gives access to the forwarding plane of a network switch or router over the SDN network. OpenFlow uses a centralized control of network switches and routers in and SDN environment. Security is of major importance for SDN deployment. Transport layer security (TLS) is used to implement security for OpenFlow. This paper proposed a new technique to improve the security of the OpenFlow controller through modifying the TLS implementation. The proposed model is referred to as the secured feedback model using autoregressive moving average (ARMA) for SDN networks (SFBARMASDN). SFBARMASDN depended on computing the feedback for incoming packets based on ARMA models. Filtering techniques based on ARMA techniques were used to filter the packets and detect malicious packets that needed to be dropped. SFBARMASDN was compared to two reference models. One reference model was Bayesian-based and the other reference model was the standard OpenFlow.

Hybrid SDN Networks: A Multi-parameter Server Load Balancing Scheme

Software-defined networking (SDN) provides many benefits, including traffic programmability, agility, and network automation. However, budget constraints burdened with technical (e.g., scalability, fault tolerance, security issues) and, sometimes, business challenges (user acceptance and confidence of network operators) make providers indecisive for full SDN deployment. Therefore, incremental deployment of SDN functionality through the placement of a limited set of SDN devices among traditional devices represents a rational and efficient environment that can offer customers modern and more data-intensive services. A unique challenge is the flexible distribution of loads on the servers that serve these services in network environments. The research in this paper focuses on developing a new load balancing scheme utilizing a hybrid SDN environment built with a minimal set of SDN devices (controller and one switch). We propose a novel load balancing scheme to monitor current server load indicators and apply multi-parameter metrics for scheduling connections to balance the load on the servers as efficiently as possible. The base of the new load balancing scheme is continuous monitoring of server load indicators and implementations of multi-parameter metrics (CPU load, I/O Read, I/O Write, Link Upload, Link Download) for scheduling connections. The testing performed on servers aims to balance the server’s load as efficiently as possible. The obtained results have shown that this mechanism achieves better results than existing load balancing schemes in traditional and SDN networks. Moreover, a proposed load balancing scheme can be used with various services and applied in any client-server environment.

Optimisation Methods for the Controller Placement Problem in SDN: A Survey

Software-defined networking (SDN) has emerged in response to increasing requirements for new networks and expansion of Internet coverage. Modern needs exceed the limitations of traditional networks, for which, to simplify management, SDN is proposed as a promising paradigm that separates the control and data planes, allowing for the programming of network configuration. SDN deployment and applications are directly affected by the controller position. Single or multiple controllers are used in SDN architecture to enable programmable, flexible, and scalable configurations. Multiple controllers are essential in the current SDN, and various solutions have been recently developed to improve scalability and placement selection. In this study, the Controller Placement Problem (CPP) is explored using objective optimisation with proposed algorithms. An overview of SDN issues and the controller role is provided through its three-plane architecture with a focus on scalability and reliability. In addition, a comprehensive problem review is discussed on the basis of a well-known compendium of available solutions. Finally, relevant open problems and future research challenges are identified.

Dynamic Routing and Failure Recovery Approaches for Efficient Resource Utilization in OpenFlow-SDN: A Survey

Software Defined Networks (SDN) is a new network paradigm that emerged to offer better network management through the separation of network control logic and data forwarding element. This separation speed up network innovation without the need to rely on the vendor-proprietary interface for network element configuration to forward packets. However, SDN is flow driven network, for each arrived flow, a feasible path is computed to forward the flow to its destination. Afterward, the SDN control logic process the corresponding routing and instruct the set of data forwarding elements to install them on their Flowtable to guide the routing process. Unfortunately, the network changes more frequently in dynamic large-scale networks and the Flowtable is a constraint with limited space. These challenges require the SDN controller to compute paths more often which may also need a large number of flow routing rules placement. In addition, the frequency of communication link failures increases lately. The successful deployment of SDN heavily depends on how it satisfies the reliability requirement with uninterrupted services. Several studies were conducted to compute the optimal path for data forward to meet their Quality of Service demand. Other studies focus on reducing the frequency of link failure. Some studies were conducted to manage the constraint Flowtable resources. This survey focuses on Routing rules placement, unoptimized routing, link, and switch load balancing, failure detection, and recovery. The paper extensively discusses each issue and analyzes the weakness of the current solutions. Finally, it highlights potential challenges that need future research attention.

Routing Performance Evaluation of a Multi-Domain Hybrid SDN for Its Implementation in Carrier Grade ISP Networks

Legacy IPv4 networks are strenuous to manage and operate. Network operators are in need of minimizing the capital and operational expenditure of running network infrastructure. The implementation of software-defined networking (SDN) addresses those issues by minimizing the expenditures in the long run. Legacy networks need to integrate with the SDN networks for smooth migration towards the fully functional SDN environment. In this paper, we compare the network performance of the legacy network with the SDN network for IP routing in order to determine the feasibility of the SDN deployment in the Internet Service provider (ISP) network. The simulation of the network is performed in the Mininet test-bed and the network traffic is generated using a distributed Internet traffic generator. An open network operating system is used as a controller for the SDN network, in which the SDN-IP application is used for IP routing. Round trip time, bandwidth, and packet transmission rate from both SDN and legacy networks are first collected and then the comparison is made. We found that SDN-IP performs better in terms of bandwidth and latency as compared to legacy routing. The experimental analysis of interoperability between SDN and legacy networks shows that SDN implementation in a production level carrier-grade ISP network is viable and progressive.

Leveraging a cloud‐based testbed and software‐defined networking for cybersecurity and networking education

AbstractNowadays, real‐world learning modules become vital components in computer science and engineering in general and cybersecurity in particular. However, as student enrollments have been dramatically increasing, it becomes more challenging for a university/college to keep up with the quality of education that offers hands‐on experiment training for students thoroughly. These challenges include the difficulty of providing sufficient computing resources and keep them upgraded for the increasing number of students. In order for higher education institutions to conquer such challenges, some educators introduce an alternative solution. Namely, they develop and deploy virtual lab experiments on the clouds such as Amazon AWS and the Global Environment for Network Innovations (GENI), where students can remotely access virtual resources for lab experiments. Besides, Software‐Defined Networks (SDN) are an emerging networking technology to enhance the security and performance of networked communications with simple management. In this article, we present our efforts to develop learning modules via an efficient deployment of SDN on GENI for computer networking and security education. Specifically, we first give our design methodology of the proposed learning modules, and then detail the implementations of the learning modules by starting from user account creation on the GENI testbed to advanced experimental GENI‐enabled SDN labs. It is worth pointing out that in order to accommodate students with different backgrounds and knowledge levels, we consider the varying difficulty levels of learning modules in our design. Finally, student assessment over these pedagogical efforts is discussed to demonstrate the efficiency of the proposed learning modules.

An efficient approach to robust controller placement for link failures in Software-Defined Networks

In Software-Defined Networks (SDN), one of the critical research challenges for large-scale deployment of SDN is controller placement problem (CPP). However, link failures are critical security issues in networks and greatly impact SDN’s robustness. The CPP for link failures is still challenging today. To this end, we study the CPP for multi-link failures (CPP-MLF). Firstly, we investigate the real link data of today’s networks to analyze the characteristics of link failures and formalize the link failure rate. Next, we formulate minimizing the number of controllers and worst-case delay as the optimization objectives of CPP-MLF and develop a heuristic algorithm based on improved NSGA-II to solve CPP-MLF efficiently. Specifically, we improve the non-dominated set and crowding distance for the NSGA-II by dynamic competition mechanism and even distribution operator, respectively, thereby quickly obtaining the Pareto-optimal solutions of CPP-MLF. Afterwards, we introduce controller load variance to evaluate them to make a satisfactory decision on controller placement. We conduct simulations with real network topologies, and the results show that the proposed heuristic algorithm performs well on the number of controllers, worst-case delay and robustness, while producing acceptable runtime overheads.

Software defined networking architecture, traffic management, security, and placement: A survey

Software-defined networking (SDN) is the potential deployment platform for the future Internet and enterprise networks. In SDN, the logical control (programs) and the forwarding logic (data) are separated. Therefore, it allows to configure the network parameters, routing policies effectively based on the requirements of the environment. The control plane (set of controllers) implements network functions such as, load balancing, energy-efficient routing, security. The data plane (set of switches) receives the forwarding logic from control plane and forwards the packets in the network. This in turn enhances the traffic management performance of the network, and strengthens the security perimeter. The researchers have worked on various directions towards the enhancement of network control functions, performance, and security. However, none of those talks about traffic management challenges in integration with security, energy efficiency and performance dependencies.This survey presents an extensive study, analysis and report of state-of-the-art works on effective traffic management including load balancing and energy-efficient routing, SDN control implementation and deployment architecture, controller security and optimal controller placement that affect traffic management. Moreover, this survey discusses a few unexplored problems in SDN such as scalable deployment, integration with legacy network, and future research road maps to these problems. This will help researchers understanding different theoretical, experimental, and applied research in SDN, challenges in these problems; developing effective solutions; and designing future research road maps.

Controller placement optimization for Software Defined Wide Area Networks (SDWAN)

Software Defined Networking (SDN) has emerged as a promising solution to revolutionize network deployment, operations and economic growth. This paradigm aims to address management and configuration complexities in legacy networks so as to reduce the total cost associated with deploying and running telecommunication infrastructures. At the heart of SDN is a controller which oversees orchestration of resources. An important problem that must be addressed during the initial design of an SDN-based network deployment is to find the optimal number of controllers and their locations, to achieve desired operational efficiency. This problem constitutes competing objectives such as latency, load balancing, and reliability. We apply Silhouette Analysis, Gap Statistics and the Partition Around Medoids (PAM) algorithms and, unlike previous work, we add a new method for solving the controller placement problem using an emulation orchestration platform. Our approach aims to optimize controller-to-node latency, alleviate control-plane signalling overhead and ensure control-plane resiliency. Our results for South African national research network (SANReN) reveal that deploying two controllers yields the lowest latency, reduces control-plane signalling overhead and guarantees control-plane resiliency. Our approach can be used by network operators as a guideline to start integrating SDN or plan a new SDN deployment, by helping them make quick automatic decisions regarding optimal controller placement.&#x0D;

Resiliency-Aware Deployment of SDN in Smart Grid SCADA: A Formal Synthesis Model

The supervisory control and data acquisition (SCADA) network in a smart grid requires to be reliable and efficient to transmit real-time data to the controller, especially when the system is under contingencies or cyberattacks. Introducing the features of software-defined networks (SDN) into a SCADA network helps in better management of communication and deployment of novel grid control operations. Unfortunately, it is impossible to transform the overall smart grid network to have only SDN-enabled devices overnight because of budget and logistics constraints, which raises the requirement of a systematic deployment methodology. In this article, we present a framework, named SDNSynth, that can design a hybrid network consisting of both legacy forwarding devices and programmable SDN-enabled switches. The design satisfies the resiliency requirements of the SCADA network, which are determined with respect to a set of pre-identified threat vectors. The resiliency-aware SDN deployment plan primarily includes the best placements of the SDN-enabled switches (replacing the legacy switches). The plan may include one or more links to be installed newly to provide flexible or alternate routing paths. We design and implement the SDNSynth framework that includes the modeling of the SCADA topology, SDN-based resiliency measures, resiliency threats, mitigation requirements, the deployment budget, and other constraints. It uses satisfiability modulo theories (SMT) for encoding the synthesis model and solving it. We demonstrate SDNSynth on a case study of an example small-scale network. We also evaluate SDNSynth on different synthetic SCADA systems and analyze how different parameters impact each other. We simulate the SDNSynth suggested networks in a Mininet environment, which demonstrate the effectiveness of the deployment strategy over traditional networks and randomly deployed SDN switches in terms of packet loss and recovery time during network congestions.