Multiple Network Domains Research Articles

Time-Efficient RSA over Large-Scale Multi-Domain EON

The poor timeliness of routing has always been an urgent problem in practical operator networks, especially in situations with large-scale networks and multiple network domains. In this article, a pruning idea of routing integrated with Dijkstra’s shortest path searching is utilized to accelerate the process of routing in large-scale multi-domain elastic optical networks (EONs). The layered-graph approach is adopted in the spectrum allocation stage. To this end, an efficient heuristic algorithm is proposed, called “Branch-and-Bound based Routing and Layered Graph based Spectrum Allocation algorithm (BBR-LGSA)”, which is an integrated RSA algorithm. Notably, the significant reduction in algorithm time complexity is not only reflected in the pruning method used in the routing stage but also in the construction of auxiliary graphs during the spectrum allocation stage utilizing the Branch-and-Bound method. Simulation results show that the proposed BBR-LGSA significantly reduces the average running time by nearly 78% with higher spectrum utilization in large-scale multi-domain EONs, compared with benchmark algorithms. In addition, the impact of key parameters on performance comparisons of different algorithms is evaluated.

Multi-domain collaborative two-level DDoS detection via hybrid deep learning

In this paper, we investigate the problem of multiple network domains being threatened by Distributed Denial-of-Service (DDoS) attacks, in which a DDoS attack detection scheme is constructed based on the Software Defined Networks (SDN) hierarchical distributed control plane architecture. Specifically, we propose a two-level detection framework for collaborative DDoS attack detection in multi-domain scenarios. To detect the signs of DDoS attacks as early as possible on the attack path, a first-level coarse-grained anomaly detection method based on the Rényi entropy algorithm is proposed. The purpose is to calculate the feature entropy of normal and abnormal traffic in a simple statistical way within the local network domain, achieving rapid perception of network anomalies. Then, the root server aggregates all abnormal traffic data uploaded by each local network domain, and the DCNN-LSTM algorithm based on a hybrid deep learning model as the second-level detection method extracts the features of the suspicious traffic from both temporal and spatial dimensions to achieve fine-grained DDoS attack classification. Finally, theoretical analysis and experimental results indicate that the proposed two-level detection method in multi-domain scenarios is effective and feasible, while with high detection accuracy.

Can Routing Be Effectively Learned in Integrated Heterogeneous Networks?

With the advent of 5G and facing future 6G, various networks tend to be linked together to form an integrated heterogeneous network (Inte-HetNets). Inte-HetNets bring new challenges to routing due to the need of crossing multiple network domains. Traditional routing methods are formidable to effectively support routing in Inte-HetNets. Machine learning is regarded as an promising technology to achieve such a goal, which has attracted efforts of many researchers. However, the literature still lacks a review on current research advance. In this paper, we review existing intelligent routing schemes based on machine learning in Inte-HetNets. We first introduce mainstream machine learning methods applied into routing. Then, we provide a taxonomy of learning-empowered routing schemes in Inte- HetNets by classifying them into three types based on routing scenarios: routing in ad hoc networks, routing in fixed backbone networks, and routing across network domains. Subsequently, we propose a set of requirements on learning-empowered routing in Inte-HetNets and employ these requirements to review the current literature. Finally, we explore several open issues based on our review and indicate future research directions of intelligent routing in Inte-HetNets.

DI-NIDS: Domain invariant network intrusion detection system

The performance of machine learning based network intrusion detection systems (NIDSs) severely degrades when deployed on a network with significantly different feature distributions from the ones of the training dataset. In various applications, such as computer vision, domain adaptation techniques have been successful in mitigating the gap between the distributions of the training and test data. In the case of network intrusion detection however, the state-of-the-art domain adaptation approaches have had limited success. According to recent studies, as well as our own results, the performance of an NIDS considerably deteriorates when the ‘unseen’ test dataset does not follow the training dataset distribution. In order to enhance the generalisability of machine learning based network intrusion detection systems, we propose to extract domain invariant features using adversarial domain adaptation from multiple network domains, and then apply an unsupervised technique for recognising abnormalities, i.e., intrusions. More specifically, we train a domain adversarial neural network on labelled source domains, extract the domain invariant features, and train a One-Class SVM (OSVM) model to detect anomalies. At test time, we feedforward the unlabelled test data to the feature extractor network to project it into a domain invariant space, and then apply OSVM on the extracted features to achieve our final goal of detecting intrusions. Our extensive experiments on the NIDS benchmark datasets of NFv2-CIC-2018 and NFv2-UNSW-NB15 show that our proposed setup demonstrates superior cross-domain performance in comparison to the previous approaches.

Employing channel probing to derive end-of-life service margins for optical spectrum services

Optical spectrum as a service (OSaaS) spanning over multiple transparent optical network domains can significantly reduce the investment and operational costs of the end-to-end service. Based on the black-link approach, these services are empowered by reconfigurable transceivers and the emerging disaggregation trend in optical transport networks. This work investigates the accuracy aspects of the channel probing method used in generalized signal-to-noise ratio (GSNR)-based OSaaS characterization in terrestrial brownfield systems. OSaaS service margins to accommodate impacts from enabling neighboring channels and end-of-life channel loads are experimentally derived in a systematic lab study carried out in the Open Ireland testbed. The applicability of the lab-derived margins is then verified in the HEAnet production network using a 400 GHz wide OSaaS. Finally, the probing accuracy is tested by depleting the GSNR margin through power adjustments utilizing the same 400 GHz OSaaS in the HEAnet live network. A minimum of 0.92 dB and 1.46 dB of service margin allocation is recommended to accommodate the impacts of enabling neighboring channels and end-of-life channel loads. A further 0.6 dB of GSNR margin should be allocated to compensate for probing inaccuracies.

A method for capturing dynamic spectral coupling in resting fMRI reveals domain-specific patterns in schizophrenia.

Resting-state functional magnetic resonance imaging (rs-fMRI) is a powerful tool for assessing functional brain connectivity. Recent studies have focused on shorter-term connectivity and dynamics in the resting state. However, most of the prior work evaluates changes in time-series correlations. In this study, we propose a framework that focuses on time-resolved spectral coupling (assessed via the correlation between power spectra of the windowed time courses) among different brain circuits determined via independent component analysis (ICA). Motivated by earlier work suggesting significant spectral differences in people with schizophrenia, we developed an approach to evaluate time-resolved spectral coupling (trSC). To do this, we first calculated the correlation between the power spectra of windowed time-courses pairs of brain components. Then, we subgrouped each correlation map into four subgroups based on the connectivity strength utilizing quartiles and clustering techniques. Lastly, we examined clinical group differences by regression analysis for each averaged count and average cluster size matrices in each quartile. We evaluated the method by applying it to resting-state data collected from 151 (114 males, 37 females) people with schizophrenia (SZ) and 163 (117 males, 46 females) healthy controls (HC). Our proposed approach enables us to observe the change of connectivity strength within each quartile for different subgroups. People with schizophrenia showed highly modularized and significant differences in multiple network domains, whereas males and females showed less modular differences. Both cell count and average cluster size analysis for subgroups indicate a higher connectivity rate in the fourth quartile for the visual network in the control group. This indicates increased trSC in visual networks in the controls. In other words, this shows that the visual networks in people with schizophrenia have less mutually consistent spectra. It is also the case that the visual networks are less spectrally correlated on short timescales with networks of all other functional domains. The results of this study reveal significant differences in the degree to which spectral power profiles are coupled over time. Importantly, there are significant but distinct differences both between males and females and between people with schizophrenia and controls. We observed a more significant coupling rate in the visual network for the healthy controls and males in the upper quartile. Fluctuations over time are complex, and focusing on only time-resolved coupling among time-courses is likely to miss important information. Also, people with schizophrenia are known to have impairments in visual processing but the underlying reasons for the impairment are still unknown. Therefore, the trSC approach can be a useful tool to explore the reasons for the impairments.

Automating Optical Network Fault Management with Machine Learning

Effective fault management is essential for quality of service assurance in optical networks. Conventional fault management designs for optical networks mainly rely on threshold-based rules, which can hardly characterize the complex fault patterns therein. This article discusses the application of machine learning (ML) in actuating an automated optical network fault management architecture. The architecture is built on advanced optical performance monitoring (OPM) techniques and software-defined-networking-enabled programmable network control and management. With the viability of abundant OPM data, the architecture employs various ML models to automatically learn fault patterns and thereby realize data-driven cognitive fault management. We review the state of the art on fault detection, identification, and localization based on such an architecture, focusing specifically on soft failures. To overcome the applicability and scalability issues encountered by existing soft failure detection designs, we present a hybrid learning solution that combines the merits of supervised, unsupervised, and cooperative ML. In particular, we present a self-taught mechanism that self-learns fault patterns with unsupervised learning and then trains supervised learning classifiers with the learned patterns for online detection. We further introduce a broker-plane-aided federated learning framework to enable collaborative training of classifiers from multiple network domains while complying with domain privacy constraints. Performance evaluations show that the hybrid learning design can achieve high fault detection rates with negligible false alarms using less than 10 abnormal data samples (~ 0.1 percent of the scale of normal samples) for training.

End-to-end service provisioning based on extended segment routing in multi-domain optical networks of F5G

As the most important fabric of fixed networks, the optical network plays an important role in expanding network capacity and providing long distance communication. At present, the fixed network has entered a key era, i.e., the fifth-generation fixed network (F5G). As one of the main features of F5G, the full-fiber connection requires a tenfold to hundredfold increase in the number of connections, which means F5G will have tens of thousands of nodes and millions of connections. Large-scale networks are composed of multiple network domains connected to each other. The whole network can be subdivided according to network functional domain. To meet different service requirements, how to provision fast end-to-end service in a multi-domain scenario has become a key issue. In optical networks, lightpath establishment must precede service transmission. The latency of lightpath establishment includes lightpath establishment signaling latency and optical interleaving device configuration latency. The latter depends on equipment performance. Therefore, how to provision fast lightpath establishment signaling is a key problem. To reduce end-to-end service provisioning latency, we propose an extended-segment-routing-based fast service provisioning scheme for the first time, to our knowledge, which consists of two steps: signaling path acquisition and signaling provisioning. For the signaling path acquisition step, we propose an adaptive segment routing (ASR) algorithm that first performs service path calculation based on service requirements, then performs a label compression algorithm to obtain the signaling path represented by the minimum number of labels according to the service path. For the signaling provisioning step, we propose a fast-signaling provisioning (FSP) process that can realize fast signaling provisioning in both single-domain and multi-domain scenarios. The simulation results show that, (1) compared to the Dijkstra algorithm, the ASR algorithm achieves a lower blocking probability for service and a better label compression effect for reducing the number of labels representing the signaling path, and, (2) compared to the traditional distributed signaling provisioning process and centralized signaling provisioning process, the FSP process achieves lower end-to-end latency.

AI-Based Network-Aware Service Function Chain Migration in 5G and Beyond Networks

While the 5G network technology is maturing and the number of commercial deployments is growing, the focus of the networking community is shifting to services and service delivery. 5G networks are designed to be a common platform for very distinct services with different characteristics. Network Slicing has been developed to offer service isolation between the different network offerings. Cloud-native services that are composed of a set of inter-dependent micro-services are assigned into their respective slices that usually span multiple service areas, network domains, and multiple data centers. Due to mobility events caused by moving end-users, slices with their assigned resources and services need to be re-scoped and re-provisioned. This leads to slice mobility whereby a slice moves between service areas and whereby the inter-dependent service and resources must be migrated to reduce system overhead and to ensure low-communication latency by following end-user mobility patterns. Recent advances in computational hardware, Artificial Intelligence, and Machine Learning have attracted interest within the communication community to study and experiment self-managed network slices. However, migrating a service instance of a slice remains an open and challenging process, given the needed co-ordination between inter-cloud resources, the dynamics, and constraints of inter-data center networks. For this purpose, we introduce a Deep Reinforcement Learning based agent that is using two different algorithms to optimize bandwidth allocations as well as to adjust the network usage to minimize slice migration overhead. We show that this approach results in significantly improved Quality of Experience. To validate our approach, we evaluate the agent under different configurations and in real-world settings and present the results.

More Is Not Always Better: An Analytical Study of Controller Synchronizations in Distributed SDN

Distributed software-defined networks (SDN), consisting of multiple inter-connected network domains, each managed by one SDN controller, is an emerging networking architecture that offers balanced centralized control and distributed operations. In such networking paradigm, most existing works focus on designing sophisticated controller-synchronization strategies to improve joint controller-decision-making for inter-domain routing. However, there is still a lack of fundamental understanding of how the performance of distributed SDN is related to network attributes, thus impossible to justify the necessity of complicated strategies. In this regard, we analyse and quantify how the performance enhancement of distributed SDN architectures is influenced by inter-domain synchronization levels, in terms of the resulting number of abstracted routing clusters, and network structural properties. Based on a generic network model incorporating link preference for path constructions, we establish analytical lower bounds for quantifying the routing performance under any arbitrarily given network synchronization status. The significance of these performance bounds is that they can be used to quantify the contribution of controller synchronization levels in improving the network performance under different network parameters, which therefore serves as a fundamental guidance for future SDN performance analysis and protocol designs.

End-to-End Quantum Secured Inter-Domain 5G Service Orchestration Over Dynamically Switched Flex-Grid Optical Networks Enabled by a q-ROADM

Dynamic and flexible optical networking enabled by NFV and SDN are the key technology enablers for supporting the dynamicity and bandwidth requirements of emerging 5G network services. To achieve the objective of 5G, Network Services (NSes) must be often deployed transparently over multiple administrative and technological domains. Such case often presents security risks since a typical NS may comprise a chain of network functions, each executed in different remote locations, and tampering within the network infrastructure may compromise their communication. To avoid such threats, QKD has been identified and proposed as a future-proof method immune to any algorithmic cryptanalysis based on quantum-physics mechanisms. The maturity of QKD has enabled the R&D of quantum networks coexisting with optical networks using telecom equipment. This makes the QKD a suitable candidate for the security of distributed and virtualised network services. In this paper, for the first time, we propose a dynamic quantum-secured optical network for supporting network services that are dynamically created by chaining VNF over multiple network domains. This work includes a new quantum-ROADM, extensions to SDN-enabled optical control plane, and extensions to NFV orchestration to achieve quantum-aware, on-demand chaining of VNFs. The experimental results verify the capability of routing quantum and classical data channels both individually and dynamically over shared fibre links. Moreover, quantum secured chaining of VNFs in 5G networks is experimentally demonstrated via interconnecting four autonomous 5G islands simultaneously through the q-ROADM with eight optical channels using the 5GUK Exchange orchestration platform. The experimental scenarios and results confirm the benefit of the proposed data plane architecture and control/management plane framework.

5G network slicing strategies for a smart factory

Factories become increasingly dependent on network connectivity. The next generation of mobile communications, 5G, will enable better flexibility and service quality through network slicing. Network slicing is a means of creating logically separated use case specific virtual networks over the same physical network. However, there is a lack of techno-economic research related to the management of network slices. Network slice management needs to take into account the multiple network domains, business actors and value networks involved in a vertical such as smart factories. The key for network slices to succeed where other resource reservation and quality of service technologies have previously failed is with well-defined feasible management models and strategies. In this paper, we focus on network slice management, possible strategies and implications for a smart factory. We study a state-of-the-art electronics assembly factory in Finland to find existing need for network slicing and missing capabilities to support smart factory use cases. Next, we define use case specific network slices and develop a network slice management model based on 5G specifications. The model allows for distribution of network functions between business actors over multiple network domains. The value network analysis method is utilized to develop alternative configurations that constitute the network slicing strategies facilitated by the model. Factory managers can decide on the most feasible strategy based on traditional factors such as make or buy, security, and level of automation. The strategies also differ in their technical applicability to different use cases. A feasibility study reveals the strategic differences from factory, local network operator and large mobile network operator perspectives.

How Advantageous Is It? An Analytical Study of Controller-Assisted Path Construction in Distributed SDN

Distributed software-defined networks (SDN), consisting of multiple inter-connected network domains, each managed by one SDN controller, is an emerging networking architecture that offers balanced centralized control and distributed operations. Under such a networking paradigm, most existing works focus on designing sophisticated controller-synchronization strategies to improve joint controller-decision-making for inter-domain routing. However, there is still a lack of fundamental understanding of how the performance of distributed SDN is related to network attributes, thus it is impossible to justify the necessity of complicated strategies. In this regard, we analyze and quantify the performance enhancement of distributed SDN architectures, which is influenced by intra-/inter-domain synchronization levels and network structural properties. Based on a generic network model, we establish analytical methods for performance estimation under four canonical inter-domain synchronization scenarios. Specifically, we first derive an asymptotic expression to quantify how dominating structural and synchronization-related parameters affect the performance metric. We then provide performance analytics for an important family of networks, where all links are of equal preference for path constructions. Finally, we establish fine-grained performance metric expressions for networks with dynamically adjusted link preferences. Our theoretical results reveal how network performance is related to synchronization levels and intra-/inter-domain connections, the accuracy of which is confirmed by simulations based on both real and synthetic networks. To the best of our knowledge, this is the first work quantifying the performance of distributed SDN in terms of network structural properties and synchronization levels.

Intelligent defense using pretense against targeted attacks in cloud platforms

Cloud-hosted services are being increasingly used in online businesses in e.g., retail, healthcare, manufacturing, entertainment due to benefits such as scalability and reliability. These benefits are fueled by innovations in orchestration of cloud platforms that make them programmable as Software Defined everything Infrastructures (SDxI). At the same time, sophisticated targeted attacks such as Distributed Denial-of-Service (DDoS) and Advanced Persistent Threats (APTs) are growing on an unprecedented scale threatening the availability of online businesses. In this paper, we present a novel defense system called Dolus to mitigate the impact of targeted attacks launched against high-value services hosted in SDxI-based cloud platforms. Our Dolus system is able to initiate a ‘pretense’ in a scalable and collaborative manner to deter the attacker based on threat intelligence obtained from attack feature analysis. Using foundations from pretense theory in child play, Dolus takes advantage of elastic capacity provisioning via ‘quarantine virtual machines’ and SDxI policy co-ordination across multiple network domains to deceive the attacker by creating a false sense of success. We evaluate the efficacy of Dolus using a GENI Cloud testbed and demonstrate its real-time capabilities to: (a) detect DDoS and APT attacks and redirect attack traffic to quarantine resources to engage the attacker under pretense, (b) coordinate SDxI policies to possibly block attacks closer to the attack source(s).

Privacy-Preserving DDoS Attack Detection Using Cross-Domain Traffic in Software Defined Networks

Existing distributed denial-of-service attack detection in software defined networks (SDNs) typically perform detection in a single domain. In reality, abnormal traffic usually affects multiple network domains. Thus, a cross-domain attack detection has been proposed to improve detection performance. However, when participating in detection, the domain of each SDN needs to provide a large amount of real traffic data, from which private information may be leaked. Existing multiparty privacy protection schemes often achieve privacy guarantees by sacrificing accuracy or increasing the time cost. Achieving both high accuracy and reasonable time consumption is a challenging task. In this paper, we propose Predis, which is a privacy-preserving cross-domain attack detection scheme for SDNs. Predis combines perturbation encryption and data encryption to protect privacy and employs a computationally simple and efficient algorithm k-Nearest Neighbors (kNN) as its detection algorithm. We also improve kNN to achieve better efficiency. Via theoretical analysis and extensive simulations, we demonstrate that Predis is capable of achieving efficient and accurate attack detection while securing sensitive information of each domain.

SDN orchestration for dynamic end-to-end control of data center multi-domain optical networking

New and emerging use cases, such as the interconnection of geographically distributed data centers (DCs), are drawing attention to the requirement for dynamic end-to-end service provisioning, spanning multiple and heterogeneous optical network domains. This heterogeneity is, not only due to the diverse data transmission and switching technologies, but also due to the different options of control plane techniques. In light of this, the problem of heterogeneous control plane interworking needs to be solved, and in particular, the solution must address the specific issues of multi-domain networks, such as limited domain topology visibility, given the scalability and confidentiality constraints. In this article, some of the recent activities regarding the Software-Defined Networking (SDN) orchestration are reviewed to address such a multi-domain control plane interworking problem. Specifically, three different models, including the single SDN controller model, multiple SDN controllers in mesh, and multiple SDN controllers in a hierarchical setting, are presented for the DC interconnection network with multiple SDN/ OpenFlow domains or multiple OpenFlow/ Generalized Multi-Protocol Label Switching (GMPLS) heterogeneous domains. In addition, two concrete implementations of the orchestration architectures are detailed, showing the overall feasibility and procedures of SDN orchestration for the end-to-end service provisioning in multi-domain data center optical networks.

SDN Orchestration of OpenFlow and GMPLS Flexi-Grid Networks With a Stateful Hierarchical PCE [Invited

New and emerging use cases, such as the interconnection of geographically remote data centers, are drawing attention to the need for provisioning end-to-end connectivity services spanning multiple and heterogeneous network domains. This heterogeneity is due not only to the data transmission and switching technology (the so-called data plane) but also to the deployed control plane, which may be used within each domain to automate the setup and recovery of such services, dynamically. The choice of a control plane is affected by factors such as availability, maturity, operator’s preference, and the ability to satisfy a list of functional requirements. Given the current developments around OpenFlow and software-defined networking (SDN) along with the need to account for existing deployments based on GMPLS, the problem of heterogeneous control plane interworking needs to be solved. The retained solution must equally address the specific issues of multidomain networks, such as limited domain topology visibility, given the scalability and confidentiality constraints that characterize them. In this setting, we propose a functional and protocol architecture for such interworking, based on the key concepts of network abstraction and overarching control, implemented in terms of a hierarchical stateful path computation element (PCE), which provides the orchestration and coordination layer. In the proposed architecture, the PCEP and BGP-LS protocols are extended to support OpenFlow addresses and datapath identifiers, unifying both GMPLS and OpenFlow domains. The solution is deployed in an experimental testbed and validated. Although the main scope of the approach is the interworking of OpenFlow and GMPLS, the same approach can be directly applied to a wide range of multidomain scenarios, with either homogeneous or heterogeneous control technologies.

TECHNOLOGY OF FEDERATED IDENTITY AND SECURE LOGGINGS IN CLOUD COMPUTING

Federated services are becoming widely implemented at many sites in multiple domain networks for cloud computing across many industry segments. New technology is required not only for federated authentication, but also for services operating distributed attributes, which are both static and dynamic. In addition to the technology, the sites that provide services across multiple domain networks are required to store every log as audit trails. This paper focuses on SAML and ID-WSF, which are the technology and the architecture for identity management and secure web services, discusses deployments and problems in the real world, then proposes a fast and safe technology that extends the ID-WSF for services and logs. To verify the effectiveness of the proposed technology and architecture, the latencies of SAML SSO that exchange SOAP messages are measured and considered in a cloud computing environment.

A framework for inter-domain routing in virtual coordinate based mobile networks

Routing is considered to be one the most challenging problems in mobile ad hoc networks. It has been shown that the use of virtual coordinates or identifiers for efficient routing and data management has several advantages compared to classical topology control techniques based on pre-defined addresses or geographical coordinates. However, these advantages only hold for single domain networks with limited mobility. In a previous paper, we discussed the challenges arising from using virtual coordinates for routing (to a particular destination ID or to indexed data or resources) in mobile networks in multi-domain network scenarios. We developed a solution by managing data with a distributed hash table scheme. Based on our virtual cord protocol, we then implemented inter-domain routing using appropriate indirections. That approach, however, was still limited in finding efficient routes over multiple transit networks. In this paper, we extend that work by defining a framework for optimized inter-domain routing. In particular, we investigate the use of ant colony optimization for optimizing routes between multiple network domains. We show how distributed routing tables can be created and maintained and we outline a heuristic for finding candidate routes. Simulation experiments confirm the efficiency of the selected routes both on a intra and on a inter-domain level.

Hierarchical virtual network mapping algorithm for large-scale network virtualisation

Virtual network(VN) mapping deals with the allocation of network resources from the shared physical substrate to individual VNs is one of the key challenges for the application of realising network virtualisation. Whereas a variety of state-of-the-art algorithms have attempted to address this issue from different aspects, the challenge still remains for mapping VNs across multiple network domains which only maintain partial information of the overall substrate network. A novel hierarchical algorithm to address this issue by formulating such VN mapping problem as a hierarchical linear programme model has been presented. Through the use of the primal decomposition and subgradient optimisation technique, in conjunction with the proposed hierarchical algorithm, the substrate network resource can be appropriately allocated to the VN instances with enhanced scalability, because of the parallelism in individual domains. In addition, the algorithm could find the best trade-off between the number of optimisation iterations (computation time) and cost by selecting an appropriate number of iterations. The proposed method has been assessed through a collection of numerical simulation experiments for a range of network scenarios and the result shows that nearly optimal performance as well as improved VN mapping request acceptance ratio and revenue can be achieved.