Software-defined Networking Flow Research Articles

Hybrid Support Vector Machine for Predicting Accuracy of Conflict Flows in Software Defined Networks

Software Defined Networking (SDN) is an infrastructure platform for delivering simplified and compliant services with flexible services. These are the means of centralized maintenance and adaptive functions. SDN is affected by various contention flows and causes network performance issues. In this case, we need to provide efficient solutions to handle conflicting flows with better priority and actions. In this paper, we propose a DeepQ Residue method for analyzing normal and conflicting flow scenarios in the load balancing phase. During simulation, an open SDN network is generated using TensorFlow. We use a Hybrid Support Vector machine with an improved decision tree method to predict accuracy and performance. In this case, we analyze threads from 1000 to 100000 in increments of 10000 threads in each iteration. Here, we train a deep belief network with a decision-free feature for environmental simulation. Based on the simulation results, the accuracy of our proposed method reaches 97 %, and we compare the results with the results of various existing methods. Our proposed algorithm provides a high-performance SDN application with different conflicting load-balanced flows

The LOFT Attack: Overflowing SDN Flow Tables at a Low Rate

The emerging Software-Defined Networking (SDN) is being adopted by data centers and cloud service providers to enable flexible control. Meanwhile, the current SDN design brings new vulnerabilities. In this paper, we explore a stealthy attack that uses a minimum rate of attack packets to disrupt SDN data plane. To achieve this, we propose the LOFT attack that computes the lower bound of attack rate to overflow flow tables based on the inferred network configurations. Particularly, each attack packet always triggers or maintains consumption of one flow rule. LOFT can ensure the attack effect under various network configurations while reducing the possibility of being captured. We demonstrate its feasibility and effectiveness in a real SDN testbed consisting of commercial hardware switches. The experimental results show that LOFT incurs significant network performance degradation and potential network DoS at an attack rate of only tens of Kbps. To defeat the attack, we develop a data-to-control plane collaborative defense system named LOFTGuard, which is lightweight and transparent to SDN applications. Evaluations show that Guard effectively protects SDN against the attack and introduces a small overhead.

A novel combinatorial multi-armed bandit game to identify online the changing top-[formula omitted] flows in software-defined networks

Identifying the top-K flows that require much more bandwidth resources in a large-scale Software-Defined Network (SDN) is essential for many network management tasks, such as load balancing, anomaly detection, and traffic engineering. However, identifying such top-K flows is not trivial, not only because of the fluctuations in flow bandwidth requirements but also because of the combinatorial explosion of problem instance sizes. In this paper, we weaken the tradeoff between exploration and exploitation and innovatively define the online top-K flows identification problem as identifying the top-K arms in a Combinatorial Multi-Armed Bandit (CMAB) model. Then, we propose a general greedy selection mechanism with some identification strategies that focus on temporal variations in the rewards. Extensive simulation experiments based on real traffic data are conducted to evaluate the performance of different strategies. In addition, the results of numerical simulations demonstrate that our proposed greedy selection mechanism significantly outperforms existing counterparts on top-K arms identification.

Enhancing Network Performance Tomography in Software-Defined Cloud Network

For cloud network performance profiling, network tomography based on end-to-end measurement is often used in deducing the network performance for its efficiency. However, most tomography problems are under-constrained, which require additional assumptions or probing monitors planted among network switches, which are often unavailable in software-defined networking (SDN) environment. On the other hand, SDN-based flow mirroring could provide accurate flow information, but the cost of both gathering and analysing the packet traces is tremendous that it is impossible to cover the whole network. We propose ScoutFlow, a method combining SDN flow measurement and end-to-end performance tomography, to achieve accurate performance profiling for cloud network while keeping low monitoring overhead. We evaluate ScoutFlow in our campus data center cloud, and the experiment shows good scalability and accuracy.

An Intrusion Detection Algorithm for DDoS Attacks Based on DBN and Three-way Decisions

To solve the problems of few DDoS attack detection methods and low intrusion detection rate of existing methods in software defined network (SDN), an intrusion detection algorithm DBN-TWD based on deep belief network (DBN) and Three-way decisions was proposed. Firstly, DBN was used to extract features of SDN flow entries, then directly classifying data in the positive and negative domains, and the data in the boundary domain is reclassified by the K-nearest neighbor algorithm. Simulation results show that compared with other intrusion detection models, the detection rate of this method is higher, and the false alarm rate is lower.

A fuzzy-based fast routing algorithm with guaranteed latency-throughput over software defined networks

With the development of online communications over the Internet, the network is required to guarantee the Quality of Service (QoS) requirements for different traffic flows. High quality and fast communication can be provided by Software-Defined Networks (SDN). SDN is a promising architecture for efficient management of network resources by separating control logic from data planes. In order to ensure the QoS requirements of traffic flows in SDN, this paper proposes a Fuzzy-based fast and efficient Routing algorithm with guaranteed Latency-Throughput (FRLR). The FRLR develops the dynamic routing problem in SDN using a traffic flow classification mechanism based on a fuzzy system. The purpose of the fuzzy system is to efficiently distribute resource allocation to improve the handling of future requests. In addition, the FRLR classifies traffic flows based on latency to reduce computational complexity. Besides, FRLR can effectively direct traffic flows and reduce network energy consumption by identifying critical links and selecting appropriate paths. Simulations on standard topologies with different scenarios confirm the better performance of FRLR by guaranteeing QoS requirements. The FRLR classifies traffic flows efficiently and offers significant improvements in the scalability and throughput of the network. Also, FRLR has provided superior results compared to some state-of-the-art algorithms such as MDA, MDWCRA, FARP, ECMP, and QI-RM. Experimental results show that FRLR works on average between 7% and 24% better than other algorithms.

RMHIL: A Rule Matching Algorithm Based on Heterogeneous Integrated Learning in Software Defined Network.

To ensure the efficient operation of large-scale networks, the flow scheduling in the software defined network (SDN) requires the matching time and memory overhead of rule matching to be as low as possible. To meet the requirement, we solve the rule matching problem by integrating machine learning methods, including recurrent neural networks, reinforcement learning, and decision trees. We first describe the SDN rule matching problem and transform it into a heterogeneous integrated learning problem. Then, we design and implement an SDN flow forwarding rule matching algorithm based on heterogeneous integrated learning, referred to as RMHIL. Finally, we compare RMHIL with two existing algorithms, and the comparative experimental results show that RMHIL has advantages in matching time and memory overhead.

DPLBAnt: Improved load balancing technique based on detection and rerouting of elephant flows in software-defined networks

Traffic management in software-defined networks (SDNs) is critical for efficient bandwidth utilization and resource provisioning. Recent works on SDN load balancing (LB) have focused on identifying and rerouting elephant flows (EFs) for effective bandwidth usage. These techniques have some limitations, such as using source-to-destination hop count as the primary rerouting metric and not differentiating the types of flow that result in frequent resource conflicts when handling EF with long-lived bandwidth. Besides, current EF detection techniques use predefined bandwidth-use thresholds that cannot adapt to the ever-changing traffic condition. Also, detecting EF on switches results in high controller-switch bandwidth and high EF detection time. This study presents an ant colony optimization-based technique for rerouting EFs while considering load-balancing in the SDN links. This technique, called DPLBAnt, is formulated as a shortest-path problem in SDN that can alleviate the high controller-switch load. The proposed technique first detects EF by using a pair of classifiers on both SDN controller and switches. Most EF candidates are sifted on the switches, resulting in accurate and efficient detection of EF. Then, DPLBAnt obtains the global state of the SDN from which the most optimal paths for congested links are retrieved, and EF are redirected accordingly. The performance of the proposed DPLBAnt has been extensively simulated. Results indicate its superior performance over Equal-Cost Multi-Path (ECMP) and FlowSeer techniques in terms of average end-to-end delay (54% and 7.9% better), average network throughput (3.5× and 1.5× better), and average packet loss (18% and 10% better) respectively. The overall performance indicates that the proposed LB technique based on detection and rerouting of EFs can improve SDN’s overall performance.

Machine Learning and Software Defined Network to secure communications in a swarm of drones

As drones become more and more frequent in industry and perhaps tomorrow in everyday life, the variety and sensitivity of their missions will increase. Securing the communication taking place with the drones and especially in the network of a swarm, is of primary importance to allow a safe integration of Unmanned Aerial Vehicles into air traffic.Drones are subject to a range of attacks, from GPS jamming to application bug exploits. Among these attacks, and irrespective to whether they have already been implemented or not, communication is one of the main contributors, both as a vector and as a target.In this article, we use previous work on security threats concerning drones to identify two main types of attack in a network of drones: intrusion from the outside and network usage from inside. We demonstrate the robustness of the Software Defined Network (SDN) architecture facing most common attacks from the outside. In addition, we propose a traffic injection detection technique and corresponding countermeasures based on SDN flow counters.Finally, we present an innovative machine learning solution based on Random Forest Classifier to address insider attacks, relying solely on flow creation events. We propose two specific features that characterizes the activity in the network. They allow detecting common network attacks such as denial of service, port scanning and brute force and are easily available to the controller.Detection performance of these abnormal behaviors are promising, both in terms of true positive and false negative, and in terms of detection delay. Detection of these common attacks will allow tightening of security in such wireless network by denying further access to the network by rogue nodes.

Design of software-defined network experimental teaching scheme based on virtualised Environment

Abstract Aiming to address the shortage of experimental resources, the high cost of large-scale deployment of hardware experimental environment and the difficulty for students to get started in the software-defined network (SDN) course, this article proposes an SDN experimental teaching scheme based on the virtualised environment, and gives a specific experimental scheme design. The scheme utilises virtualisation technology to build a SDN experimental environment quickly, uses a lightweight network simulation platform – that goes by the name of Mininet – to build the SDN network and uses open-source controller Floodlight for centralised control of the SDN network. The scheme is mainly divided into three phases: basic, improvement and synthesis. In the basic phase, experimental projects mainly include the study of SDN basic concepts and the use of relevant tools; in the improvement phase, experimental projects mainly include the use of SDN flow table, group table, etc; in the synthetic phase, we design two innovative experimental projects that use computational intelligence technology to achieve efficient load balancing and accurate malicious attack detection. The difficulty of each phase is increasing. The constantly evolving levels of difficulty allow the individual needs of students with different levels to be met, thereby improving the effect of SDN experimental teaching and cultivating innovative SDN talents.

Detection and Classification of Malicious Flows in Software-Defined Networks Using Data Mining Techniques.

The increasing availability of mobile devices and applications, the progress in virtualisation technologies, and advances in the development of cloud-based distributed data centres have significantly stimulated the growing interest in the use of software-defined networks (SDNs) for both wired and wireless applications. Standards-based software abstraction between the network control plane and the underlying data forwarding plane, including both physical and virtual devices, provides an opportunity to significantly increase network security. In this paper, to secure SDNs against intruders’ actions, we propose a comprehensive system that exploits the advantages of SDNs’ native features and implements data mining to detect and classify malicious flows in the SDN data plane. The architecture of the system and its mechanisms are described, with an emphasis on flow rule generation and flow classification. The concept was verified in the SDN testbed environment that reflects typical SDN flows. The experiments confirmed that the system can be successfully implemented in SDNs to mitigate threats caused by different malicious activities of intruders. The results show that our combination of data mining techniques provides better detection and classification of malicious flows than other solutions.

A QoS-guaranteed intelligent routing mechanism in software-defined networks

With the development of the Internet of Things (IoT), the network is required to guarantee the differential Quality of Service (QoS) requirements of the various data flows of various IoT services. Software-defined network (SDN) is envisioned as a promising technique to guarantee the QoS requirements of different services, through separating the control logic from data planes of networks. In order to guarantee the QoS requirements of data flows in SDNs, in this paper we investigate the problem of intelligent routing in SDNs, by leveraging a novel data flow classification method. Combining a variety of machine learning algorithms, a data flow classification method called MACCA2-RF&RF is proposed, in order to identify the data flow category and obtain the QoS requirements. The link parameter is newly designed considering multiple QoS requirements. According to the link parameter, the QoS-guaranteed path selection algorithm is then proposed, which can select QoS guaranteed routing path for different data flows with different QoS requirements. Aiming at the situation that the link is congested, local routing change algorithm is then proposed which only adjusts the links before and after the congested link instead of the entire path. Based on the above, a QoS-guaranteed intelligent routing mechanism called QI-RM in SDN is finally proposed in this paper to achieve QoS guarantee for data flows. The simulation results show that the MACCA2-RF&RF can classify data flows efficiently with an identification accuracy of 99.73%, and the QI-RM can guarantee the QoS requirements of data flows before and after link congestion.

FlowMan: QoS-Aware Dynamic Data Flow Management in Software-Defined Networks

In this paper, we study the problem of data flow management in the presence of heterogeneous flows — elephant and mice flows — in software-defined networks (SDNs). Most of the researchers considered the homogeneous flows in SDN in the existing literature. The optimal data flow management in the presence of heterogeneous flows is NP-hard. Hence, we propose a game theory-based heterogeneous data flow management scheme, named FlowMan. In FlowMan, initially, we use a generalized Nash bargaining game to obtain a sub-optimal problem, which is NP-complete in nature. By solving it, we get the Pareto optimal solution for data-rate associated with each switch. Thereafter, we use a heuristic method to decide the flow-association with the switches, distributedly, which, in turn, helps to get a Pareto optimal solution. Extensive simulation results depict that FlowMan is capable of ensuring quality-of-service (QoS) for data flow management in the presence of heterogeneous flows. In particular, FlowMan is capable of reducing network delay by 77.8–98.7%, while ensuring 24.6–47.8% increase in network throughput, compared to the existing schemes such as FlowStat and CURE. Additionally, FlowMan ensures that per-flow delay is reduced by 27.7% with balanced load distribution among the SDN switches.

On the fine-grained fingerprinting threat to software-defined networks

Software-defined networking (SDN) is an emerging networking technology, which has attracted wide attention from academia and industry, playing a key role in enabling techniques of the 5th generation wireless systems (5G). The fundamental characteristic of SDN is that it decouples the control plane from the data plane, which can provide flexibility and programmability for 5G. Unfortunately, the separation of the two planes becomes a potential attack surface as well, which enables adversaries to fingerprint and attack the SDNs. Existing work showed the possibility of fingerprinting an SDN with time-based features. However, they are coarse-grained. This paper proposes a fine-grained fingerprinting approach that reveals the much more severe threats to SDN security and explores the mitigation strategies. By analyzing network packets, the approach can dig out sensitive and control-related information, i.e., match fields of SDN flow rules. The match fields of flow rules can be used to infer the type of an SDN controller and the security policy of an SDN network. With sensitive configuration information, adversaries can launch more targeted and destructive attacks against an SDN. We implement our approach in both simulated and physical environments with different kinds of SDN controllers to verify the effectiveness of our concept. Experimental results demonstrate the feasibility to obtain fine-grained and highly sensitive information in SDN, and hence reveal the high risk of information disclosure in SDN and severe threats of attacks against SDN. To mitigate the fine-grained fingerprinting threat we have revealed, we explore a lightweight countermeasure trying to hide the sensitive time-based features of SDN networks. Implementation and evaluation demonstrate that our countermeasure can play a role in mitigating the risk of SDN control information leakage with only minor overheads.

Secure Collecting, Optimizing, and Deploying of Firewall Rules in Software-Defined Networks

Firewalls are a fundamental element of network security systems with the ability to block network data traffic flows according to pre-defined rules. Software-defined networking (SDN) technology, which can provide flexibility, elasticity, and programmability for network management, has been applied to network security systems. We propose a software-defined firewall cyber-security system, which securely gathers the firewall rules of the host/network-based firewalls through the SDN control plane, converts the collected firewall rules in the form of SDN flow rules, and deploys them on OpenFlow (OF)-enabled switches. Furthermore, we formulate an optimization problem to find appropriate OF-enabled switches to which the SDN flow rules are to be sent. The proposed firewall system makes the traffic flows that are destined to be dropped by a firewall be dropped in advance at the OF-enabled switch with the corresponding SDN flow rules. The SDN-based testbed experiments demonstrate that the proposed firewall system reduces the aggregate network traffic volume and the resource utilization of end-hosts in the network.

RuleTailor: Optimizing Flow Table Updates in OpenFlow Switches With Rule Transformations

Software-defined networking (SDN) provides flexible network control, which has enabled new, more complex network control mechanisms. These approaches impose high demands on flow updates in OpenFlow switches. Existing SDN controllers and firmware have been optimized for high-speed network updates, but specific switch implementations differ in their behavior. Previous optimization schemes for updates ignore the diversity of instruction types and switch behavior. In this paper, we present RuleTailor , an efficient, measurement-based optimization framework for SDN flow updates, to overcome these limitations. In contrast to other measurement-based optimization frameworks, RuleTailor uses new techniques, such as instruction type transformation, pseudo deletion, and match field distance, which can work in both the control plane and the data plane. Our evaluation shows that RuleTailor achieves a performance of fewer than 12 milliseconds per update in a content-addressable flow table with 1k entries, outperforming the state-of-the-art measurement-based framework, Tango, by a factor of 10.

Research on SDN Flow Secure Access Control

In order to ensure the Software Defined Network (SDN) flow security access, this paper puts forward a SDN terminal access control system through the deep study on the terminal security access solution in the existing SDN. This system combines the traditional terminal access control technology with the new SDN network and mainly implements some functions such as user’s identity authentication, terminal security status assessment, user’s service authorization, QoS control, and so on. Simultaneously, the system security is analyzed in detail. The network simulation in Mininet is carried out in combination with the RYU controller secondary developed so as to complete the experiment of access control function and communication delay performance. The results show that the security access control system of SDN flow has flexible access control security strategies and then can detect the threats from the insecure terminal access in SDN. This can not only realize the identity authentication of users but also ensure the security of access terminal, and thus realizing the access authorization of terminals in different safe states.

Brew: A Security Policy Analysis Framework for Distributed SDN-Based Cloud Environments

The ease of programmability in Software-Defined Networking (SDN) makes it a great platform implementation of various initiatives that involve application deployment, dynamic topology changes, and decentralized network management in a multi-tenant data center environment. However, implementing security solutions in such an environment is fraught with policy conflicts and consistency issues with the hardness of this problem being affected by the distribution scheme for the SDN controllers. In this paper we present Brew, a security policy analysis framework implemented on an OpenDaylight SDN controller, that has comprehensive conflict detection and resolution modules to ensure that no two flow rules in a distributed SDN-based cloud environment have conflicts at any layer; thereby assuring consistent conflict-free security policy implementation and preventing information leakage. We present techniques for global prioritization of flow rules in a decentralized environment, extend firewall rule conflict classification from a traditional environment to SDN flow rule conflicts by recognizing and classifying conflicts stemming from cross-layer conflicts and provide strategies for unassisted resolution of these conflicts. Alternately, if administrator input is desired to resolve conflicts, a novel visualization scheme is implemented to help the administrators view the conflicts graphically. We demonstrate the correctness, feasibility and scalability of our framework through a proof-of-concept prototype.

Congestion-Free Rerouting of Multiple Flows in Timed SDNs

Software-Defined Networks (SDNs) introduce great flexibilities in how packet routes can be defined and changed over time, and enable a more fine-grained and adaptive traffic engineering. The recently introduced support for more accurate synchronization in SDNs further improves the degree of control an operator can have over the packets’ forwarding paths, and also allows to avoid disruptions and inconsistencies during network updates, i.e., during the rerouting of flows. However, how to optimally exploit such technology algorithmically — to efficiently schedule the update of multiple flows in such timed SDNs — while accounting for possible interference and congestion, is not well-understood today. We, in this paper, initiate the study of the fundamental problem of how to reroute the updates of multiple network flows in a synchronized SDN in a congestion-free manner. We rigorously prove that the problem is NP-hard for flows of unit size and network links with unit delay. We also show that a greedy approach to update the network can delay the update significantly. Our main contribution is the first solution to this problem: Chronicle. Our approach is based on time-extended network construction and the resource dependency graph, which is implemented by Openflow 1.5 using the scheduled bundles feature . The evaluation results show that Chronicle can reduce the makespan by 63% and reduce the number of changed rules by 50% compared to state-of-the-art.

Visual Web-Oriented Environment of Dynamic Control of Data Flow in Campus of Software Defined Networks

Nowadays new innovative approaches based on the technology of software defined networks (SDN) are gaining popularity in the field of computer networks (CN). SDN provide a flexible approach to the processing and control of data flows in CN by separating the control plane and data plane, as well as centralizing the representation of the entire network. In this paper, we propose a software infrastructure and a visual web-oriented environment (SIVE) for dynamic control of data flows in campus SDN based on OpenFlow protocol. It was proposed to use the SIVE as an integrated segment of the campus network of Ryazan State Radio Engineering University. The aim of the work is the development of the SIVE architecture in the form of UML class diagram description, as well as the creation of software methods for organizing effective network interaction of various software systems in SDN based on OpenFlow protocol. A hardware-software test bench based on HP Aruba 2920-24G equipment was developed to confirm the efficiency and reliability of the proposed SIVE. The offered SIVE is the basis for the development of a large class of software systems and SDN components based on OpenFlow protocol.