Multi-domain Software-defined Networks Research Articles

Bi-channel hybrid GAN attention based anomaly detection system for multi-domain SDN environment

Software-Defined Networking (SDN) is a strategy that leads the network via software by separating its control plane from the underlying forwarding plane. In support of a global digital network, multi-domain SDN architecture emerges as a viable solution. However, the complex and ever-evolving nature of network threats in a multi-domain environment presents a significant security challenge for controllers in detecting abnormalities. Moreover, multi-domain anomaly detection poses a daunting problem due to the need to process vast amounts of data from diverse domains. Deep learning models have gained popularity for extracting high-level feature representations from massive datasets. In this work, a novel deep neural network architecture, supervised learning based LD-BiHGA (Low Dimensional Bi-channel Hybrid GAN Attention) system is designed to learn class-specific features for accurate anomaly detection. Two asymmetric GANs are employed for learning the normal and abnormal network flows separately. Then, to extract more relevant features, a bi-channel attention mechanism is added. This is the first study to introduce an innovative hybrid architecture that merges bi-channel hybrid GANs with attention models for the purpose of anomaly detection in a multi-domain SDN environment that effectively handles real-time unbalanced data. The suggested architecture demonstrates its effectiveness on three benchmark datasets, achieving an average accuracy improvement of 7.225% on balanced datasets and 3.335% on imbalanced datasets compared to previous intrusion detection system (IDS) architectures in the literature.

SECURING CENTRALIZED SDN CONTROL WITH DISTRIBUTED BLOCKCHAIN TECHNOLOGY

Software Defined Networks (SDN) advocates segregation of network control logic, forwarding functions and management applications into different planes to achieve network programmability, automated and dynamic flow control in next generation networks. It promotes deployment of novel and augmented network management functions to have flexible, robust, scalable and cost-effective network deployments. All these features introduce new research challenges and require secure communication protocols among the segregated network planes. This manuscript focuses on the security issue of southbound interface which operates between the SDN control and data plane. We have highlighted the security threats associated with an unprotected southbound interface and the issues related with the existing TLS based security solution. A lightweight blockchain based decentralized security solution is proposed for southbound interface to secure the resources of logically centralized SDN controllers and distributed forwarding devices from opponents. The proposed mechanism can operate in multi-domain SDN deployment and can be used with wide range of network controllers and data plane devices. In addition to it, the proposed security solution is analyzed in terms of security features, communication and reauthentication overhead.

Distributed Multicast Traffic Engineering for Multi-Domain Software-Defined Networks

Previous research on SDN multicast traffic engineering mainly focused on intra-domain optimization. However, the main traffic on the Internet is inter-domain, and the selection of border nodes and sharing of network information between domains are usually distributed but ignored in previous works. In this article, we explore multi-domain online distributed multicast traffic engineering (MODMTE). To effectively solve MODMTE, we first prove that MODMTE is inapproximable within <inline-formula><tex-math notation="LaTeX">$|D_{\max }|$</tex-math></inline-formula> , which indicates that it is impossible to find any algorithm with a ratio better than <inline-formula><tex-math notation="LaTeX">$|D_{\max }|$</tex-math></inline-formula> for MODMTE, and <inline-formula><tex-math notation="LaTeX">$|D_{\max }|$</tex-math></inline-formula> is the maximum number of destinations for a multicast tree. Then, we design a <inline-formula><tex-math notation="LaTeX">$|D_{\max }|$</tex-math></inline-formula> -competitive distributed algorithm with the ideas of Domain Tree, Dual Candidate Forest Construction, and Forest Rerouting to achieve the tightest performance bound for MODMTE. Experiments on a real SDN with YouTube traffic manifest that the proposed distributed algorithm can reduce more than 30% of the total cost of bandwidth consumption and rule updates for multicast tree rerouting compared with the state-of-the-art algorithms.

Performance Evaluation of Topologies for Multi-Domain Software-Defined Networking

Software-defined networking (SDN) is widely used in multiple types of data center networks, and these distributed data center networks can be integrated into a multi-domain SDN by utilizing multiple controllers. However, the network topology of each control domain of SDN will affect the performance of the multi-domain network, so performance evaluation is required before the deployment of the multi-domain SDN. Besides, there is a high cost to build real multi-domain SDN networks with different topologies, so it is necessary to use simulation testing methods to evaluate the topological performance of the multi-domain SDN network. As there is a lack of existing methods to construct a multi-domain SDN simulation network for the tool to evaluate the topological performance automatically, this paper proposes an automated multi-domain SDN topology performance evaluation framework, which supports multiple types of SDN network topologies in cooperating to construct a multi-domain SDN network. The framework integrates existing single-domain SDN simulation tools with network performance testing tools to realize automated performance evaluation of multi-domain SDN network topologies. We designed and implemented a Mininet-based simulation tool that can connect multiple controllers and run user-specified topologies in multiple SDN control domains to build and test multi-domain SDN networks faster. Then, we used the tool to perform performance tests on various data center network topologies in single-domain and multi-domain SDN simulation environments. Test results show that Space Shuffle has the most stable performance in a single-domain environment, and Fat-tree has the best performance in a multi-domain environment. Also, this tool has the characteristics of simplicity and stability, which can meet the needs of multi-domain SDN topology performance evaluation.

QoS Support Path Selection for Inter-Domain Flows Using Effective Delay and Directed Acyclic Graph in Multi-Domain SDN

Currently, network applications, such as audio, video, and augmented reality, have different stringent service requirements. They require service provision through end-to-end connections via other networks with different operating environments or service conditions. Therefore, network operators require information on their own and other networks to provide end-to-end services traversing several networks while guaranteeing their quality of service (QoS) requirements. This study proposes an inter-domain flow decision method that satisfies QoS requirements using a directed acyclic graph (DAG) in multi-domain and hierarchical software defined networking (SDN) networks. There are multiple local networks with SDN controllers that are connected to the global SDN controller. The flow decision in the proposed method is based on the effective bandwidth theory of the martingale process. The effectiveness of the proposed method is demonstrated by comparing it with existing SDN-based path selection methods using the Riverbed Modeler (older, OPNET) and OpenDaylight SDN controllers.

A GRU-based traffic situation prediction method in multi-domain software defined network.

With the continuous development and improvement of Software-Defined Networking (SDN), large-scale networks are divided into multiple domains. Each domain, which is managed by a controller, forms multi-domain SDN architecture. In multi-domain SDN, the dynamics and complexity are more significant, bringing great challenges to network management. Comprehensively and accurately predicting traffic situation in multi-domain SDN can better maintain network stability. In this article, we propose a traffic situation prediction method based on the gated recurrent unit (GRU) network in multi-domain SDN. We first analyzed the relevant factors that affect data traffic and control traffic and transformed them into a time series of actual situation values. Then, to enhance the prediction performance of GRU, we used the salp swarm algorithm to optimize the hyperparameters of GRU automatically. Finally, we adopted hyperparameter optimized GRU to achieve traffic situation prediction in multi-domain SDN. The experimental results indicate that the proposed method outperforms other traditional machine learning algorithms in terms of prediction accuracy.

Multidomain SDN-Based Gateways and Border Gateway Protocol

The Internet consists of distributed and interconnected autonomous systems (ASs). The flexibility afforded by the Internet architecture ensures that timely changes to the network topology can occur without centralized control. The Border Gateway Protocol (BGP) is an Internet protocol that routes the Internet traffic and exchanges the information between AS. However, BGP version 4 (BGP-4) currently suffers from a limitation called “high convergence delay” while doing routing updates, which is a very common limitation, damaging the performance of contemporary IP networks. Software-defined networking (SDN) was conceived at the beginning of the 21st century, and over the intervening years, it has gained traction. This technology has significantly enhanced traffic control, management, and monitoring, particularly in data centres and enterprise networks. Challenges have been found including how to provide administrative control, security, management, and monitoring at domain boundaries while introducing the SDN paradigm. In multidomain SDN, BGP-4 is used to exchange the information and route the traffic between domains or diverse AS. In this review, an investigation is provided on using the SDN paradigm to enhance multidomain traffic management and control and to optimize BGP operation. A detailed insight is provided into the penetration of the SDN paradigm into modern networking architectures and how it may help in facilitating future research to improve BGP-4.

Routing Performance Evaluation of a Multi-Domain Hybrid SDN for Its Implementation in Carrier Grade ISP Networks

Legacy IPv4 networks are strenuous to manage and operate. Network operators are in need of minimizing the capital and operational expenditure of running network infrastructure. The implementation of software-defined networking (SDN) addresses those issues by minimizing the expenditures in the long run. Legacy networks need to integrate with the SDN networks for smooth migration towards the fully functional SDN environment. In this paper, we compare the network performance of the legacy network with the SDN network for IP routing in order to determine the feasibility of the SDN deployment in the Internet Service provider (ISP) network. The simulation of the network is performed in the Mininet test-bed and the network traffic is generated using a distributed Internet traffic generator. An open network operating system is used as a controller for the SDN network, in which the SDN-IP application is used for IP routing. Round trip time, bandwidth, and packet transmission rate from both SDN and legacy networks are first collected and then the comparison is made. We found that SDN-IP performs better in terms of bandwidth and latency as compared to legacy routing. The experimental analysis of interoperability between SDN and legacy networks shows that SDN implementation in a production level carrier-grade ISP network is viable and progressive.

TRAQR: Trust aware End-to-End QoS routing in multi-domain SDN using Blockchain

Recent advances in today’s Internet introduced huge demand for End-to-End Quality of Service (E2E QoS) assurances for delivering different types of traffic (video, live streaming, and telemedicine), originating from a wide spectrum of applications. Such applications stretch across multiple administrative domains and require fair and robust coordination for E2E QoS provisioning. While the selection of trusted domains is of paramount importance for the successful realization of E2E QoS, the issue of domain’s trust while finding E2E QoS paths has not been actively explored in the existing works. Trust awareness reduces the risk of violating QoS and improves the confidence of operating QoS across multiple domains. However, identifying trusted domains, finding the source of trust, and quantifying trust are the major challenges for enabling trust aware E2E QoS routing. Auditability of QoS implementation results at each domain forms a vital source for verifying QoS compliance and subsequently evaluating the trust of the domain. However, securely obtaining logs from the domains and identifying the accountability of domains for E2E QoS, without relying on a third party introduces significant difficulty when evaluating domain trust with respect to QoS compliance. This work proposes Trust aware E2E QoS Routing (TRAQR) framework for provisioning E2E QoS with trust and verifying the QoS compliance in Multi-Domain Software Defined Networks (MD-SDN). TRAQR efficiently leverages the tamper-proof and decentralized properties of Blockchain to store and exchange different kinds of trust information required to provision and verify E2E QoS compliance of the domains. This work developed a proof of concept implementation of the TRAQR in an MD-SDN environment emulated using Mininet, RYU SDN controller, Ethereum Blockchain and Smart Contracts to demonstrate the performance and benefits of TRAQR. Further, the simulations showed that the domain trust parameter introduced significant improvement in QoS compliance, even in the presence of untrusted domains.

Secure and cost-effective controller deployment in multi-domain SDN with Baguette

Software-Defined Networking (SDN) is becoming prevalently in recent years. Practical SDN (e.g., production Software-defined Wide Area Network) deployments leverage multiple commercial controllers, which partitions the network into multiple domains, and each domain uses a dedicated controller. Commercial controllers are usually used for reliability and fully post-sales supports. However, using a single type of SDN controllers can compromise the whole network if the attacker can exploit its vulnerabilities. In this paper, we consider this security issue and present the Secure and Cost-effective Controller Deployment (SCCD) problem. The SCCD problem aims to replace a few controllers with different types of commercial SDN controllers, which satisfies the security requirement at a minimal cost. The complexity of the SCCD problem comes from common vulnerabilities shared among different types of SDN controllers and attack propagations among network domains. We prove the non-deterministic polynomial-time hardness (NP-hardness) of the problem and propose the Baguette algorithm to efficiently solve the problem. Baguette judiciously chooses and replaces controllers for critical domains with selected types of commercial SDN controllers. Simulation results show that Baguette can achieve comparable performance to the Optimal solution and can stably achieve up to 12.6x security enhancement compared with the single controller type deployment and reduce to 11.1% cost of the securest deployment.

Controller Backup and Replication for Reliable Multi-domain SDN

Software defined networking (SDN) is considered to be one of the most promising paradigms in the future. To solve the scalability and performance problem that a single and centralized controller suffers from, the distributed multi-controller architecture is adopted, thus forms multi-domain SDN. In a multi-domain SDN network, it is of great importance to ensure a reliable control plane. In this paper, we focus on the reliability problem of multi-domain SDN against controller failure from perspectives of backup controller deployment and controller replication. We firstly propose a placement algorithm for backup controllers, which considers both the reliability and the cost factors. Then a controller replication mechanism based on shared data storage is proposed to solve the inconsistency between the active and standby controllers. We also propose a shared data storage layout method that considers both reliability and performance. Besides, a fault recovery and repair process is designed based on the controller backup and shared data storage mechanism. Simulations show that our approach can recover and repair controller failure. Evaluation results also show that the proposed backup controller placement approach is more effective than other methods.

Multi-domain virtual network embedding with dynamic flow migration in software-defined networks

Software Defined Networking (SDN) decouples the control and data planes of a network, and employs a central controller to provide effective use of network resources and ease of service provision. Virtualization in SDN empowers the virtual SDN networks to share common physical network infrastructures, and, thus, make them capable for versatile service provisioning. In such setting, SDN hypervisor supports multiple virtual SDN network (vSDN) in which each vSDN has its own controller. To create virtual networks and achieving optimal sharing of physical network resources, virtual network embedding (VNE) algorithms are designed. Single domain VNE is a well-studied problem in NV literature. However, in most of the real life scenarios, VNs are provisioned across heterogeneous administrative domains belonging to different Infrastructure Providers (InPs).In this paper, we propose a VNE algorithm, namely vSDN-CLA, using Irregular Cellular Learning Automata (ICLA) for multi-domain SDN networks. We consider two aspects – optimal mapping of virtual nodes and links into multi-domain substrate network, and optimal placement of SDN controller with respect to throughput and end-to-end delay. We extend the vSDN-CLA by considering dynamic flow migration to achieve resource optimal routing. We evaluate the proposed schemes using Mininet. We observe that the proposed schemes outperform the existing benchmark schemes with respect to throughput, end-to-end delay, and virtual network request acceptance ratio under both the single and multi-domain environments.

Dynamic network service deployment across multiple SDN domains

AbstractThe integration of software defined networking (SDN) and network function virtualization (NFV) is a promising approach to support flexible service deployment and provisioning. In particular, NFV enables a network service to be represented as one network service function chain, which is composed of several virtual network functions in a specific order. However, with regard to service provisioning in multidomain SDN networks, virtual network functions are deployed in several different SDN domains due to limited resource capacity of each SDN domain. It results in the network service deployment complexity increase and causes additional operating cost. On the other hand, most current network service deployment proposals are limited to static user request scenarios. How to effectively deploy network service across multiple SDN domains to satisfy dynamic service demands of end users is a challenging problem. To address the aforementioned challenge, in this paper, we study the problem of dynamic network service deployment across multiple SDN domains. Specifically, we first design a novel service deployment framework to support dynamic deployment and optimization of virtual network function in multidomain SDN networks. Then, we formulate the problem as a multiobjective optimization problem with the target of jointly minimizing resource consumption cost and operating cost. Furthermore, we transform the multiobjective optimization problem into a single objective optimization model and present an efficient heuristic service deployment approach to solve it by leveraging Dijkstra algorithm. The simulation results demonstrate that the proposed service deployment method is efficient and outperforms comparison methods in terms of service rejection ratio, resource cost, and operating cost.

A Policy-Based Security Architecture for Software-Defined Networks

As networks expand in size and complexity, they pose greater administrative and management challenges. Software-defined networks (SDNs) offer a promising approach to meeting some of these challenges. In this paper, we propose a policy-driven security architecture for securing end-to-end services across multiple SDN domains. We develop a language-based approach to design security policies that are relevant for securing SDN services and communications. We describe the policy language and its use in specifying security policies to control the flow of information in a multi-domain SDN. We demonstrate the specification of fine-grained security policies based on a variety of attributes, such as parameters associated with users and devices/switches, context information, such as location and routing information, and services accessed in SDN as well as security attributes associated with the switches and controllers in different domains. An important feature of our architecture is its ability to specify path- and flow-based security policies that are significant for securing end-to-end services in SDNs. We describe the design and the implementation of our proposed policy-based security architecture and demonstrate its use in scenarios involving both intra- and inter-domain communications with multiple SDN controllers. We analyze the performance characteristics of our architecture as well as discuss how our architecture is able to counteract various security attacks. The dynamic security policy-based approach and the distribution of corresponding security capabilities intelligently as a service layer that enables flow-based security enforcement and protection of multitude of network devices against attacks are important contributions of this paper.

Bandwidth Update Impact in Multi-Domain Software Defined Networking

The rapid growth of data transmission over digital networks, especially of delay sensitive traffic, has meant that research into improved networking has increased. Network domain boundaries are key points in the network where service provisioning, flow control, and management occur between organizations. This paper presents a flexible automated approach that utilizes Software Defined Networking (SDN) to carry out provisioning, control and management functions at domain boundaries. We propose a multi-domain SDN provisioning framework and a domain boundary bandwidth update algorithm to improve link performance between domains. Simulations were carried out using data captured from a carrier to enterprise network link. The simulation results show that the proposed algorithm provides improved service fulfillment, lower packet loss probability and higher benefit-to-cost ratio compared to other approaches.

Implementation experience in multi-domain SDN: Challenges, consolidation and future directions

Network architectures compliant with the Software Defined Networking (SDN) design paradigm, are expected to provide extreme flexibility for service orientation and allow for efficient use of network resources of cloud systems. Nevertheless, radical reconsidering and removal of boundaries set out when studying multi-domain communications are required, in order to unleash the hidden potential of SDN and provide a “holistic” network view. Although many domain-specific efforts have been proposed in the literature and indeed they gain a lot of industrial attention, real multi-domain SDN implementations over converged wireless-optical networks are just starting to disclose.In this work we present an open end-to-end multi-domain SDN system, while focusing on the necessary abstractions and virtualization techniques to integrate virtual wireless and optical resources. With the proposed system, called CONTENT, we shed light in the field of wireless-optical network virtualization from an end-to-end perspective. We present the architecture and the integrated testbed that realize the envisioned system. Evaluation results are provided and implementation experience is reported using the integrated solution. The way SDN methodologies and techniques can be used to support NFV concepts in end-to-end fashion are also presented.

Hierarchical Distributed Topology Discovery Protocol for Multi-Domain SDN Networks

This letter presents a hierarchical distributed topology discovery protocol on the use of hierarchical path computation elements (PCEs) for orchestrating multi-domain software-defined networking. The challenge of this protocol is how child PCEs can maintain an abstract inter-domain topology while preserving intra-domain confidential information in a hierarchical PCE-based orchestration architecture. The experimental results show that the proposed protocol evenly distributes path computation burden among all child PCEs compared with the hierarchical PCE approach. The proposed protocol considerably reduces the provisioning delay compared with the distributed approach while preserving confidential intra-domain information.

Multi-Domain SDN Survivability for Agricultural Wireless Sensor Networks.

Wireless sensor networks (WSNs) have been widely applied in agriculture field; meanwhile, the advent of multi-domain software-defined networks (SDNs) have improved the wireless resource utilization rate and strengthened network management. In recent times, multi-domain SDNs have been applied to agricultural sensor networks, namely multi-domain software-defined wireless sensor networks (SDWSNs). However, when the SDNs controlling agriculture networks suddenly become unavailable, whether intra-domain or inter-domain, sensor network communication is abnormal because of the loss of control. Moreover, there are controller and switch info-updating problems even if the controller becomes available again. To resolve these problems, this paper proposes a new approach based on an Open vSwitch extension for multi-domain SDWSNs, which can enhance agriculture network survivability and stability. We achieved this by designing a connection-state mechanism, a communication mechanism on both L2 and L3, and an info-updating mechanism based on Open vSwitch. The experimental results show that, whether it is agricultural inter-domain or intra-domain during the controller failure period, the sensor switches can enter failure recovery mode as soon as possible so that the sensor network keeps a stable throughput, a short failure recovery time below 300 ms, and low packet loss. Further, the domain can smoothly control the domain network again once the controller becomes available. This approach based on an Open vSwitch extension can enhance the survivability and stability of multi-domain SDWSNs in precision agriculture.

SDI: a multi-domain SDN mechanism for fine-grained inter-domain routing

Software-defined networking (SDN) scheme decouples network control plane and data plane, which can improve the flexibility of traffic management in networks. OpenFlow is a promising implementation instance of SDN scheme and has been applied to enterprise networks and data center networks in practice. However, it has less effort to spread SDN control scheme over the Internet to conquer the ossification of inter-domain routing. In this paper, we further innovate to the SDN inter-domain routing inspired by the OpenFlow protocol. We apply SDN flow-based routing control to inter-domain routing and propose a fine-granularity inter-domain routing mechanism, named SDI (Software Defined Inter-domain routing). It enables inter-domain routing to support the flexible routing policy by matching multiple fields of IP packet header. We also propose a method to reduce redundant flow entries for inter-domain settings. And, we implement a prototype and deploy it on a multi-domain testbed.

Routing centralization across domains via SDN: A model and emulation framework for BGP evolution

The Border Gateway Protocol (BGP) was designed almost three decades ago and has many limitations relating to its fully distributed nature, policy enforcement capabilities, scalability, security and complexity. For example, the control plane can take several minutes to converge after a routing change; this may be unacceptable for real-time network services. Despite many research proposals for incremental improvements and clean-slate redesigns of how inter-domain routing should work, BGP is likely one of the most ossified protocols of the Internet architecture and it has not retrofitted the proposed ideas. In this work, we propose a radical, incrementally deployable Internet routing paradigm in which the control plane of multiple networks is logically centralized. This follows the Software Defined Networking (SDN) paradigm, although at the inter-domain level involving multiple Autonomous Systems (AS). Multi-domain SDN centralization can be realized by outsourcing routing functions to an external contractor, which provides inter-domain routing services facilitated through a multi-AS network controller. The proposed model promises to become a vehicle for evolving BGP and uses the bird’s eye view over several networks to benefit aspects of inter-domain routing, such as convergence properties, policy conflict resolution, inter-domain troubleshooting, and collaborative security. In addition to the proposed paradigm, we introduce a publicly available emulation platform built on top of Mininet and the Quagga routing software, for experimenting on hybrid BGP–SDN AS-level networks. As a proof of concept, we focus specifically on exploiting multi-domain centralization to improve BGP’s slow convergence. We build and make publicly available a first multi-AS controller tailored to this use case and demonstrate experimentally that SDN centralization helps to linearly reduce BGP convergence times and churn rates with expanding SDN deployments.