Edge Routers Research Articles

Distributed service function chaining in NFV-enabled networks: A game-theoretic learning approach

In network function virtualization (NFV), Service Function Chaining (SFC) provides an ordered sequence of virtual network functions (VNFs) and subsequent steering of traffic flows through them to cater to end-to-end services. This paper addresses the NP-hard problem of minimum cost SFC deployment to support customer services that access the carrier network’s NFV infrastructure (NFVI) through some edge routers. To determine the mappings of VNFs to physical servers, a challenging aspect would be the inter-server latencies that may fluctuate over time because of the sharing nature of cloud data centers. To construct the SFC, we come up with three different formulations, each corresponding to a different informational assumption about the link latencies: First, a centralized integer linear programming (ILP) formulation is given under the assumption of the non-causal availability of exact and instantaneous inter-server latencies. The solution to this ILP can serve as a lower bound to benchmark more scalable and realistic schemes. Next, we give a distributed game-theoretic formulation (with service broker agents as players) which only requires the statistical knowledge of link latency fluctuations. The game provably admits a pure Nash equilibrium (NE) and can be solved iteratively through the well-known best response dynamics (BRD) algorithm. Our main novelty lies in the third formulation in which each service broker has neither instantaneous nor statistical knowledge of the latencies. Instead, it relies on a game-theoretic learning algorithm to compose its VNF chain only based on its own history of adopted decisions and experienced delays on each logical link. We prove that the proposed learning algorithm asymptotically converges to NE and evaluate its performance through simulations in terms of convergence and the impact of network parameters.

2TierEdge-Defense: a cascaded defense framework with rule-based LSTM for NCIFA in NDN

ABSTRACT Non-Collusive Interest Flooding Attacks (NCIFA) disrupt Named Data Networks' (NDNs) seamless communication and content distribution through QoS degradation. This work proposes 2TierEdge-Defense: a framework based on Long Short Term Memory (LSTM) to detect NCIFA in NDN at the edge content routers. The framework has been evaluated on large-scale Rocketfuel topologies for AT&T Internet Service Provider. The 2TierEdge-Defense framework consists of attack detection and mitigation modules with detection at edge router and their interfaces. During offline training and evaluation, the 2TierEdge-Defense framework can detect NCIFA with 0.92 (F1-score) and 0.84 (F1-score) at edge routers and their interfaces, respectively, with cascaded F1-score of 0.9872. Upon detection, the mitigation strategy in the 2TierEdge-Defense framework can improve the QoS metrics as quickly as in 0.45 seconds with an overall F1 score as high as 0.9872. The 2TierEdge-Defense is evaluated for scalability topology scenarios to ensure better performance when deployed on NDN content routers with a cascaded miss rate of 0.1 and a false alarm rate of 0.07.

Adaptive quality of service for packet loss reduction using OpenFlow meters.

Quality of Service (QoS) is a mechanism used in computer networks to prioritize, classify, and treat packets differently based on certain criteria. This helps the switching devices to schedule and reorder packets if there is congestion in the network. Edge routers experience high traffic congestion as a result of traffic aggregation from the internal network devices. A router can have multiple QoS classes configured, and each class could experience traffic at various rates. However, when a QoS class is underperforming or needs more bandwidth, some bandwidth can be borrowed or leased out to another QoS class to ensure the link is utilized to maximum capacity and the highest throughput is achieved. This article proposes a bandwidth allocation and distribution algorithm that purely uses the flow statistics from the OpenFlow switches to allocate bandwidth to different QoS classes optimally based on their current requirement. The algorithm does not guarantee in advance that the packet loss will be minimized but does guarantee the initial minimum bandwidth allocation. It adjusts the flows' rates with the aim to increase their current throughput. The algorithm uses the Software Defined Networking (SDN) controller's flow monitoring component to query the flow statistics from the switch to first approximate the traffic flow rate and then calculate the optimal bandwidth values to assign to each QoS class. The proposed algorithms will be applied to certain switches in the path with the assumption that all the switches are OpenFlow compatible. The algorithm's performance was compared with the Adaptive Quality of Service (AQoS) algorithm over various traffic scenarios. The results show that the proposed algorithm achieves an average of 9% performance gain compared to the AQoS algorithm.

Simulation of 6LowPAN Protocol in public Lightning management

Public lighting is all the means used to illuminate public spaces, roads and residential areas. It contributes to user safety and accounts for nearly a third of electricity consumption worldwide. The lamp lighting system was on/off. That is to say, either the street lamps are 100% on without taking into account the observed traffic density (much, little or no traffic), or they are all off. Faced with budget restrictions and rising energy costs, more and more local authorities are looking for a solution to reduce their electricity consumption related to street lighting. We collected data in an RPL network of 10 nodes in random representation. A 6LoWPAN network of 30 nodes plus an additional node, representing the edge router is realized and simulated. The results obtained were presented, analysed and interpreted.

Edge-Assisted Intelligent Device Authentication in Cyber–Physical Systems

Cyber–physical system (CPS) provides a foundation for the Industrial Internet of Things (IIoT) that interconnects all types of devices. The integration of CPS with IIoT generates the large volumes of data forcing the development of artificial intelligence (AI) to extract information more precisely. Nevertheless, the increasing volume/variety of data traffic and the ever-growing number of IIoT devices bring great challenges for the host-centric communication model of the current Internet. In this work, we present a novel information-centric networking (ICN)-based system model in CPS, which enables processing data from IIoT devices closer to the edge as opposed to a content provider. Based on this ICN system model, we propose an edge-assisted authentication scheme in CPS, aiming to protect the system from unauthorized access and reduce workload for resource-constrained devices. The main features of our scheme include a delegation model of security operations and session handshake procedures through edge routers, addressing the rising challenges in managing and securing IIoT devices in the ICN. We formally prove the security of our scheme and conduct performance analysis to show its practicality.

A Snort-based secure edge router for smart home

Cybercrimes are rising rapidly with the increasing use of the internet of things (IoT)-based gadgets at home. For instance, the Mirai-BotNet infected and compromised many IoT-based devices and routers, creating a zombie network of robots that can be controlled remotely. There is a need for a cost-effective, secure router for a smart home. This paper investigates and proposes a Snort-based secure edge router for smart home (SERfSH), which is resilient to many cyberattacks. SERfSH automatically generates Snort content rules by combining the extracted string, location information, header information, and sequential pattern. The experimental setup of SERfSH consists of a Raspberry Pi 4 model, an ESP32 microcontroller, six IoT devices, and a malicious actor machine. The proposed SERfSH is tested for 15 attacks, and the results show that 14 attacks were detected and 12 attacks were mitigated.

RAPT: A Robust Attack Path Tracing Algorithm to Mitigate SYN-Flood DDoS Cyberattacks

In the recent past, Distributed Denial of Service (DDoS) attacks have become more abundant and present one of the most serious security threats. In a DDoS attack, the attacker controls a botnet of daemons residing in vulnerable hosts that send a significant amount of traffic to flood the victim or the network infrastructure. In this paper, a common type of DDoS attacks known as "TCP SYN-Flood" is studied. This type of attack uses spoofed Internet Protocol (IP) addresses for SYN packets by exploiting the weakness in Transmission Control Protocol (TCP) 3-Way handshake used by the TCP/IP suite of protocols, which make the web servers unreachable for legitimate users or even worse, it might lead to server crash. In this paper, a resilient, efficient, lightweight, and robust IP traceback algorithm is proposed using an IP tracing packet for each attack path. The proposed algorithm suggests that edge routers-where the attack starts from-observe the traffic pattern passing through, and if the observed traffic carries the signature of TCP SYN-Flood DDoS attack and a high percentage of it is destined to a particular web server(s), it starts the tracing process by generating an IP trace packet, which accompanies the attack path recording the routers' IP addresses on the path between the attacker/daemon and the victim, which can extract the path and react properly upon receiving it by discarding any SYN packets originating from that attacker/daemon. To our knowledge, this is the first research that efficiently traces these kinds of attacks while they are running. The proposed solution has low computation and message overhead, efficient detection and tracing time, and converges in near optimal time. The results are validated using extensive simulation runs.

Analysis of the vulnerability estimation and neighbor value prediction in autonomous systems.

The security within autonomous systems (AS)s is one of the important measures to keep network users safe and stable from the various type of Distributed Denial of Service (DDoS) attacks. Similar to the other existing attack types Internet control message protocol (ICMP) based attacks are remained open challenge on the Internet environment. In this study, we have proposed a method to estimate the vulnerability of 600 AS provider edge (PE) routers by sending ICMP packets and predicted AS neighbor values using least square regression (LSR) approach. The results of our study show that 265 AS PE routers are vulnerable due to ICMP flood attack from the 600 ASs which were analyzed. Additionally, we have predicted that about 60% of total AS neighbors will be reduced in the next 3 years. Our results indicate that some ASs still did not deploy the firewall system in the boundary of their networks. Similarly, we also observed that the majority of ASs which expected to have less neighbor values in the next 3 years is due to change their routing paths to find adjacent paths.

Analysis of BGP4 Peering Establishment Time on IPv6 Connection over 6PE and 6VPE

Nowadays, because of the exhaustion of IPv4 address space, IPv6 is increasingly being used on enterprise networks. Usually, an enterprise uses an MPLS network from a Service Provider to interconnect their IPv4 network sites. Although MPLS Service Providers mostly built their MPLS backbone based on IPv4, their MPLS backbone have the capability to transport IPv6 traffic of their customers. Two methods can be used by the MPLS Service Provider to connect its customer IPv6 network, which is 6PE (IPv6 Provider Edge Routers) and 6VPE (IPv6 VPN Provider Edge Router). Enterprises generally use a BGP routing protocol to interconnect their networks, and they need to use the best method that suits their requirement from their MPLS Service Provider to transport their IPv6 traffic (including the BGP protocol). The MPLS Service Providers need to consider the advantages and disadvantages of both methods. This paper illustrates the analysis of BGP4 (current BGP version) IPv6 peering establishment time over 6PE and 6VPE methods. The MPLS Service Providers can use the analysis results of this study to determine the suited method to interconnect its customers' IPv6 networks.

An interest‐based access control scheme via edge verification in Named Data Networking

SummaryNamed Data Networking (NDN) is a disruptive future architecture, in which content delivery can be significantly improved through named routing and distributed caching. However, distributed caching also leads to serious access control problems. Once a content is disseminated to the network, any entity can fetch it regardless of owning the access permission or not. To protect the authorized content, current solutions are mainly designed based on data packet encryption, but redundant in‐network traffic is still a challenge due to illegal interest‐data exchange. Focus on this problem, an Interest‐Based Access Control scheme via Edge Verification (IBAC‐EV) is proposed in this paper. In IBAC‐EV, the producer authorizes the user to sign interest packet. By checking the signature, the edge router can forbid unsubscribed users to enter network through discarding interest packets. Simulation results show that IBAC‐EV can effectively reduce the in‐network traffic. Moreover, by using proxy signature algorithm, it simplifies the complexity of key management and alleviates the storage overhead on the edge router.

An Effective and Lightweight Countermeasure Scheme to Multiple Network Attacks in NDN

In Named Data Networking, cache pollution, cache poisoning and interest flooding are three popular types of attacks that can drastically degrade the network performance. However, previous methods for mitigating these attacks are not sufficiently effective or efficient. Also, they cannot simultaneously handle the three attacks, or the case that core routers or edge routers are compromised. To handle these problems, we propose an effective and lightweight countermeasure scheme. It consists of token-based router monitoring policy (TRM), hierarchical consensus-based trust management (HCT), and popularity-based probabilistic caching and caching replacement policy (PPC). In TRM, each edge router monitors and evaluates each data requester’s probability of launching the cache pollution attack and each data provider’s probability of launching the cache poisoning attack, and accordingly assigns, rewards and penalizes tokens to them to control their data request and data provision activities. Thus, the interest flooding attack can also be mitigated by limiting the consumption of tokens. In HCT, each core router manages its directly connected edge routers using TRM, and the core routers trust each other through adopting the concept of consensus in Blockchain. Thus, the edge and core routers executing monitoring and evaluation are trustable. PPC uses probabilistic caching and caching replacement based on the popularity of received content to further mitigate the attacks and reduce caching and data verification overhead. Results from simulation experiments demonstrate that our proposed scheme has better performance, in terms of interest satisfaction ratio and average end-to-end delay than current mechanisms.

Quality of Service based resource allocation in D2D enabled 5G-CNs with network slicing

With the rapid new advancements in technology, there is an enormous increase in devices and their versatile need for services. Fifth-generation (5G) cellular networks (5G-CNs) with network slicing (NS) have emerged as a necessity for future mobile communication. The available network is partitioned logically into multiple virtual networks to provide an enormous range of users’ specific services. Efficient resource allocation methods are critical to delivering the customers with their required Quality of Service (QoS) priorities. In this work, we have investigated a QoS based resource allocation (RA) scheme considering two types of 5G slices with different service requirements; (1) enhanced Mobile Broadband (eMBB) slice that requires a very high data rate and (2) massive Machine Type Communication (mMTC) slice that requires extremely low latency. We investigated the device-to-device (D2D) enabled 5G-CN model with NS to assign resources to users based on their QoS needs while considering the cellular and D2D user’s data rate requirements. We have proposed a Distributed Algorithm (DA) with edge computation to solve the optimization problem, which is novel as edge routers will solve the problem locally using the augmented Lagrange method. They then send this information to the central server to find the global optimum solution utilizing a consensus algorithm. Simulation analysis proves that this scheme is efficient as it assigns resources based on their QoS requirements. This scheme is excellent in reducing the central load and computational time.

FASE: Fine-Grained Accountable and Space-Efficient Access Control for Multimedia Content With In-Network Caching

To reduce the duplicated traffic and improve the performance of distributing massive volumes of multimedia contents, in-network caching has been proposed recently. However, as in-network content caching can be directly utilized to respond users’ requests, multimedia content retrieval is beyond content providers’ control and makes it hard for them to implement access control and service accounting. In this paper, we propose a Fine-grained Accountable and Space-Efficient access control scheme, called FASE, for multimedia content distribution. FASE allows content providers to be fully offline while making the best of in-network caching. In FASE, the attribute-based encryption at multimedia content provider side and access policy based authentication at the edge router side jointly ensure secure fine-grained access control. Our scheme is efficient in both space and time. By designing one time chameleon signature (OTCS), users can keep anonymous during the authentication, and their privileges can be conveniently revoked when needed. Besides, secure service accounting is implemented by letting edge routers collect service credentials generated during users’ request process. Through formal security analysis, we prove the security of our scheme. Simulation results demonstrate that our scheme is efficient with acceptable overhead.

Analysis of BGP4 Peering Establishment Time on IPv6 Connection over 6PE and 6VPE

Nowadays, because of the exhaustion of IPv4 address space, IPv6 is increasingly being used on enterprise networks. Usually, an enterprise uses an MPLS network from a Service Provider to interconnect their IPv4 network sites. Although MPLS Service Providers mostly built their MPLS backbone based on IPv4, their MPLS backbone have the capability to transport IPv6 traffic of their customers. Two methods can be used by the MPLS Service Provider to connect its customer IPv6 network, which is 6PE (IPv6 Provider Edge Routers) and 6VPE (IPv6 VPN Provider Edge Router). Enterprises generally use a BGP routing protocol to interconnect their networks, and they need to use the best method that suits their requirement from their MPLS Service Provider to transport their IPv6 traffic (including the BGP protocol). The MPLS Service Providers need to consider the advantages and disadvantages of both methods. This paper illustrates the analysis of BGP4 (current BGP version) IPv6 peering establishment time over 6PE and 6VPE methods. The MPLS Service Providers can use the analysis results of this study to determine the suited method to interconnect its customers' IPv6 networks.

Detection of malicious consumer interest packet with dynamic threshold values.

As a promising next-generation network architecture, named data networking (NDN) supports name-based routing and in-network caching to retrieve content in an efficient, fast, and reliable manner. Most of the studies on NDN have proposed innovative and efficient caching mechanisms and retrieval of content via efficient routing. However, very few studies have targeted addressing the vulnerabilities in NDN architecture, which a malicious node can exploit to perform a content poisoning attack (CPA). This potentially results in polluting the in-network caches, the routing of content, and consequently isolates the legitimate content in the network. In the past, several efforts have been made to propose the mitigation strategies for the content poisoning attack, but to the best of our knowledge, no specific work has been done to address an emerging attack-surface in NDN, which we call an interest flooding attack. Handling this attack-surface can potentially make content poisoning attack mitigation schemes more effective, secure, and robust. Hence, in this article, we propose the addition of a security mechanism in the CPA mitigation scheme that is, Name-Key Based Forwarding and Multipath Forwarding Based Inband Probe, in which we block the malicious face of compromised consumers by monitoring the Cache-Miss Ratio values and the Queue Capacity at the Edge Routers. The malicious face is blocked when the cache-miss ratio hits the threshold value, which is adjusted dynamically through monitoring the cache-miss ratio and queue capacity values. The experimental results show that we are successful in mitigating the vulnerability of the CPA mitigation scheme by detecting and blocking the flooding interface, at the cost of very little verification overhead at the NDN Routers.

IoT Enabled Clustering of Traffic Data - A Review

The administration of the traffic control system is a great concern in the metropolitan cities. The traffic control system has become much busier in recent years, traffic congestion is one of the reasons for these key challenges in smart cities. Traditional traffic management systems are not suitable for solving the problem, the mechanism of the congestion control mechanism is needed. This is how there is an intelligent control system. This research document proposes an intelligent system of traffic control based on IOT. This improves the high degree of scalability, replacing the previous traffic signage system with traffic signal control data in real time. To solve these safety protocol concerns, we implement IOT systems based on privacy with intelligence, which analyze the traffic data in real time for the control of traffic signals. We approach the man's data security attack in the center (MITM). And here, the algorithm of the support vector machine (SVM) will be used here for the classification of data on the edge and will be implemented by RASPBERRY PI3 and Scikit to implement the collection of raw traffic data. The sensors are used to distinguish positive or bad data from. The traffic data pattern of the terminal devices based on IOT. The edge router and the fog router will also be used to store traffic information in the cloud and to decide the level of traffic.

Context Information Aggregation Mechanism Based on Bloom Filters (CIA-BF) for High Performance Monitoring Applications of Internet of Things

Internet of Things (IoT) has become a popular technology in recent years. Different IoT applications such as traffic control, environment monitoring, etc. contain many sensor devices, routers, actuators, edge routers, and Base Stations (BS) which communicate with each other and send millions of data packets that need to be delivered to their destination nodes successfully to ensure the High-performance communication networks. IoT devices connect to the Internet using wired or wireless communication channels where most of the devices are wearable, which means people slowly move from one point to another or fast-moving using vehicles. How to ensure high performance of IoT data networks is an important research challenge while considering the limitation of some IoT devices that may have limited power resources or limited coverage areas. Many Kinds of research focus on how to customize routing protocols to be efficient for IoT devices. The traditional routing mechanisms utilized specific IP addresses to identify users while in IoT it is more beneficial to identify a group of users (things) based on any contexts, status, or values of their resources such as the level of their batteries (e.g., low, medium or high). While IoT devices have different characteristics, a multicasting mechanism to send one message to various groups of devices will not be efficient in IoT communication networks since the aggregation of packets is very difficult. Thus, it is useful to propose a mechanism that able to filter data packets that need to be sent to a specific group of devices. In this paper, we propose efficient context-aware addressing mechanism, which is based on bloom filters to increase the performance of IoT communication networks. A routing architecture is built based on bloom filters which store routing information. In our works, we reduce the size of routing information using a proposed aggregation mechanism which is based on connecting each group of IoT devices with an edge router which is hierarchically connected to an upper router after operating its bloom filter. Our simulation results show a significant improvement in the IoT performance metrics such as packets transmission delay, jitter the throughput, packets dropping ratio, and the energy consumption in comparison with well-known routing protocols of IoT such as Destination Sequenced Distance Vector routing protocol (DSDV), and Ad hoc On-demand Distance Vector routing protocol (AODV).

Efficient Resource Allocation Using Distributed Edge Computing in D2D Based 5G-HCN With Network Slicing

Fifth Generation (5G) cellular networks aim to overcome the pressing demands posed by dynamic Quality of Service (QoS) constraints, which have primarily remained unaddressed using conventional network infrastructure. Cellular networks of the future necessitate the formulation of efficient resource allocation schemes that readily meet throughput requirements. The idea of combining Device-to-Device (D2D), Mobile Edge Computing (MEC), and Network slicing (NS) can improve spectrum utilization with better performance and scalability. This work presents a spectrum efficiency optimization problem in D2D based 5G-Heterogeneous Cellular Network (5G-HCN) with NS. Owing to the shortage of resources, we propose an underlay model where macro-cell users (MUs), small-cell users (SUs), and D2D users (DUs) reuse the resources while considering the effects of interference. The goal is to maximize the average network spectrum efficiency (SE) and throughput without degrading the system performance. The problem at hand is naturally a non-convex mixed-integer non-linear programming (MINLP) problem that is intractable. Therefore, we have suggested a distributed resource allocation strategy with an edge computing (DRA-EC) approach to find the sub-optimal solution. In distributed augmented Lagrange method, each edge router located at BS will solve its problem locally, and the consensus algorithm will find the global solution using these local estimates. The central slice controller will cut the customized network slices according to the bandwidth requirements of each user type with optimized spectrum information. The simulation outcomes prove that our proposed method is near the central optimization scheme with low computational complexity. It is much better because it reduces the computational time and system overhead.

Integration of D2D, Network Slicing, and MEC in 5G Cellular Networks: Survey and Challenges

With the tremendous demand for connectivity anywhere and anytime, existing network architectures should be modified. To cope with the challenges that arise due to the increasing flood of devices/users and a diverse range of application requirements, new technologies and concepts must be integrated to enable their benefits. Service providers and business companies are looking for new areas of research to enhance overall system performance. This article gives a detailed survey about the recent 5G technologies, the solutions they provide, and the effect caused by their addition to current cellular networks. It is based on the three most important 5G concepts: Device to Device (D2D), Network Slicing (NS), and Mobile Edge Computing (MEC). This study proposes to design the future 5G networks by the integration of all three technologies. It is believed that spectrum efficiency, energy efficiency, and overall throughput will be greatly improved by using D2D. The system delay and computational load will be reduced as tasks will be handled by edge routers located at the base stations. Thus offloading the core network and the system capital expenses and operational expenses will be reduced significantly by slicing the network.

A Brief Survey of Future Computing Technologies in Cloud Environment

New network developments, such as the Internet of Things (IoT), autonomous communities, intelligent metering, virtual/enhanced technology, and driverless driving, are evolving with the exponential growth of inevitable wireless technologies and pervading networking technologies. The manufacturing and research societies have been providing a range of network computing paradigms in recent years, including fog computing, mobile edge computing, and dew computing. While utilizing various terminologies, their core idea is to expand cloud computing and shift the computing system from distant data centers to edge routers, base stations, and local servers nearer to customers, thus addressing the inefficiencies that cloud computing is facing and offering improved user interface and consistency. Throughout this article, thoroughly sum up and examine the paradigms of future cloud computing indicated in recent years.