SDN Network Research Articles

A Survey of AI Methods for Detection of DDoS Attacks on Networks

This survey explores various artificial intelligence (AI) methods for detecting Distributed Denial of Service (DDoS) attacks on networks. It classifies these approaches into machine learning, deep learning, and other AI-based techniques, providing a comprehensive overview of current advancements in the field. Numerous research studies in the field of machine learning have evaluated DDoS attack detection performance using various datasets and techniques. Some noteworthy results are the supremacy of the J48 algorithm in SDN networks and the efficacy of the AdaBoost and Gradient Boost classifiers. In other investigations, Random Forest, Support Vector Machine, and Naive Bayes also showed excellent accuracy rates, up to 99.7%. To improve DDoS detection, deep learning techniques introduced autoencoders, hybrid models, and recurrent neural networks. These models achieved accuracy rates as high as 99.99%, frequently outperforming more conventional machine learning techniques. Enhanced detection rates were achieved by the utilization of a varied dataset in conjunction with deep-stacked autoencoders. Artificial intelligence methods such as Fuzzy Logic, Artificial Bee Colony, Ant Colony Optimization, and Whale Optimization Algorithm were used to identify DDoS assaults. These methods demonstrated high accuracy rates, efficient detection of various attack types, and improvements in reducing false positives; the integration of these techniques into intrusion detection systems offers a strong defense against dynamic DDoS threats. The overall survey highlights the effectiveness of AI techniques in DDoS attack detection across various methodologies.

Retraction Note: Cognitive linear discriminant regression computing technique for HTTP video services in SDN networks

Retraction Note: Cognitive linear discriminant regression computing technique for HTTP video services in SDN networks

Detection and mitigation of DDoS attacks based on multi-dimensional characteristics in SDN

Due to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network.

Analisis Performa Jaringan Software Defined Networking dengan Algoritma Random Early Detection

In the management of SDN networks, the main challenges faced are traffic congestion and network overload. One of the solutions that has been implemented is the Random Early Detection (RED) algorithm. This research aims to analyze the performance of SDN networks with the implementation of the RED algorithm compared to SDN networks without the use of the RED algorithm. The results of the study show that the use of the RED algorithm (Random Early Detection) in SDN networks has a significant impact on Quality of Service (QoS) parameters, such as packet loss, throughput, and average delay. In high load conditions, there is a controlled increase in packet loss with RED as the number of hosts increases. The average packet loss with RED is 1.57% for 4 hosts, whereas without RED, it is only 1.4%. RED also has a positive impact on throughput, with an average throughput of 243.8 kbps for 4 hosts with RED, while without RED, it only reaches 124.3 kbps. Furthermore, the use of RED reduces the average delay in packet delivery. The average delay with RED is 3.8 ms for 4 hosts, whereas without RED, it reaches 5.92 ms.

DDoS Protection System for SDN Network Based on Multi Controller and Load Balancer

DDoS attacks on SDN networks can create a single point of failure that has the potential to disrupt the overall network performance. In a single controller scheme, there is a potential risk of experiencing buffer overload, leading to traffic congestion as switches must wait for responses from the controller before forwarding network packets. To address this challenge, this research implements security measures using a multi-controller and load balancer approach, aiming to enhance SDN network resilience against DDoS attacks. The system operates by distributing the workload from the main controller to a backup controller through a load balancer when indications of a DDoS attack are detected. These attack indications are determined based on the miss rate value of unique forwarding requests exceeding a specific threshold. The results of this approach have proven effective in improving the reliability, responsiveness, and quality of SDN network traffic during DDoS attacks. The testing parameters involved in this research include controller response time and network traffic quality, comprising latency, bandwidth, throughput, and jitter. Based on the test results, the multi-controller and load balancer-based approach successfully enhanced network quality and controller responsiveness by 66.51% compared to the longer single controller scenario, specifically 202.49% during DDoS attacks. In terms of controller responsiveness, there is a very slight increase of around 0.01% in latency between the two. While Multi Controller demonstrated a remarkable 43.21% increase in throughput compared to Single Controller, this improvement in throughput is accompanied by a significant 204% increase in jitter.

Synergizing enterprise resource management with technology through driving innovation and growth in business models

A human resources management plan is presently recognised as one of the most important components of a corporate technique. This is due to the fact that its major purpose is to interact with people, who are the most precious asset that an organisation has. It is impossible for an organisation to achieve its objectives without the participation of individuals. An organisation may effectively plan as well as manage individual processes to support the organization’s objectives and adapt nimbly to any change if it has well-prepared HR techniques and an action plan for its execution. This investigation puts up a fresh way for the board of directors of a private firm to increase their assets and advance their growth by using cloud programming that is characterised by networks. The small company resource has been improved by strengthening human resource management techniques, and the cloud SDN network is used for job scheduling using Q-convolutional reinforcement recurrent learning. The proposed technique attained Quadratic normalized square error of 60%, existing SDN attained 55%, HRM attained 58% for Synthetic dataset; for Human resources dataset propsed technique attained Quadratic normalized square error of 62%, existing SDN attained 56%, HRM attained 59% ; proposed technique attained Quadratic normalized square error of 64%, existing SDN attained 58%, HRM attained 59% for SyriaTel dataset.

Improved Exploration Strategy for Q-Learning Based Multipath Routing in SDN Networks

Improved Exploration Strategy for Q-Learning Based Multipath Routing in SDN Networks

Securing SDN Networks: Employing LSTM and Linear SVM Models for Enhanced Network Security with VPN Integration

Securing SDN Networks: Employing LSTM and Linear SVM Models for Enhanced Network Security with VPN Integration

An NFV-Based Framework for Autonomous Deployment of New Protocols in SDN Networks

An NFV-Based Framework for Autonomous Deployment of New Protocols in SDN Networks

Deep learning-based user location estimation in SDN networks

Deep learning-based user location estimation in SDN networks

Optimizing Software-Defined Networks with Fuzzy Logic-Based Enhancement of Openflow Protocol

Today, humans have a strong need to control their devices from a distance so that they can control the world more than before and explore it for various purposes such as how the universe came into being, discovering the way of creation, observing the events in Global situation and so on. Communication with remote devices can be possible in various ways. SDN networks provide a possibility to exchange information between heterogeneous nodes. Considering that in SDN networks, the nodes are very expensive and these nodes themselves are performing many tasks and various vital tasks; Therefore, the cost of each byte of memory occupied on these nodes is very expensive and must be managed in such a way that they have the highest efficiency. Therefore, to solve this problem, it is very necessary and costly to carry out large projects. In the proposed method of this research, by improving the OpenFlow protocol in software-based networks, it is tried to avoid the cooperation of nodes in the directional distribution (not dissemination) of a small data, from the accumulation of extra information in the nodes' memories. Finally, after the simulation, it was observed that the improvement rate of the proposed method has improved by 0.38%, 0.05%, and 0.04%, respectively, compared to RD, FLCFP, and LEACH2013 methods. The improvement rate of the proposed method compared to RD, FLCFP, and LEACH2013 methods was 0.65%, 0.059%, and 0.331%, respectively.

Network Architecture and Security Assessment in Industry 4.0 for Smart Manufacturing

Abstract In this paper, we propose a centralized SDN network architecture under a smart factory for the problems under the traditional industrial IoT architecture and carry out the security analysis of industrial IoT to improve the performance of the smart factory network. Briefly describing the industrial SDN network architecture, combined with the design of a blockchain system for smart factories, the hash algorithm and asymmetric encryption algorithm are introduced to anonymize and protect the data. For traditional SDN, propose a blockchain-based SDN and analyze the probability of state transfer between SDNs. In order to solve the security problem at the SDN control level, the blockchain-based distributed SDN control model is proposed, and the PBFT consensus algorithm is introduced to realize the blockchain consensus-based multi-controller decision-making model. Add the MD5 algorithm and compare its performance with the SHA256 algorithm. Set up Adder modules with different bit widths and CSA Tree modules with different bases to calculate the encryption time of the RSA algorithm for various combinations. Set up simulation experiments to compare different malicious nodes and the average trust value of the consensus mechanism proposed in this paper for abnormal nodes in an SDN multi-controller. From the results, it can be seen that the computational speed of the RSA system is the fastest for the system implemented by Montgomery’s algorithm in base 16 and bit width 32 bits, and the time to complete the encryption process of 1024 bits once is only 0.97 ms. However, when the number of nodes is controlled in [0~5000], the rejection rate of abnormal nodes by the PBFT consensus algorithm in this paper basically maintains at about 92%. The consensus node designed and proposed in this paper is able to reject error nodes effectively and effectively secure the SDN smart factory network architecture.

Analyzing Traffic Identification Methods for Resource Management in SDN

The article is devoted to the analysis of traffic classification methods in SDN network. The review of analytical approaches of traffic identification to identify the solutions used in them, as well as assessing their applicability in the SDN network. Types of machine learning are considered and input parameters are analyzed. The methods of intelligent analysis covered in the scientific articles are systematized according to the following criteria: traffic identification parameters, neural network model, identification accuracy. Based on the analysis of the review results, the conclusion is made about the possibility of applying the considered solutions, as well as the need to form a scheme of SDN network with a module of artificial intelligence elements for load balancing.

Traffic prediction in SDN for explainable QoS using deep learning approach

The radical increase of multimedia applications such as voice over Internet protocol (VOIP), image processing, and video-based applications require better quality of service (QoS). Therefore, traffic Predicting and explaining the prediction models is essential. However, elephant flows from those applications still needs to be improved to satisfy Internet users. Elephant flows lead to network congestion, resulting in packet loss, delay and inadequate QoS delivery. Recently, deep learning models become a good alternative for real-time traffic management. This research aims to design a traffic predicting model that can identify elephant flows to prevent network congestion in advance. Thus, we are motivated to develop elephant flow prediction models and explain those models explicitly for network administrators’ use in the SDN network. H2O, Deep Autoencoder, and autoML predicting algorithms, including XGBoost, GBM and GDF, were employed to develop the proposed model. The performance of Elephant flow prediction models scored 99.97%, 99.99%, and 100% in validation accuracy of under construction error of 0.0003952, 0.001697, and 0.00000408 using XGBoost, GBM, and GDF algorithms respectively. The models were also explicitly explained using Explainable Artificial Intelligence. Accordingly, packet size and byte size attributes need much attention to detect elephant flows.

Modeling Distributed and Configurable Hierarchical Blockchain over SDN and Fog-Based Networks for Large-Scale Internet of Things

Modeling Distributed and Configurable Hierarchical Blockchain over SDN and Fog-Based Networks for Large-Scale Internet of Things

A novel DDoS detection and mitigation technique using hybrid machine learning model and redirect illegitimate traffic in SDN network

A novel DDoS detection and mitigation technique using hybrid machine learning model and redirect illegitimate traffic in SDN network

Countering crossfire DDoS attacks through moving target defense in SDN networks using OpenFlow traffic modification

AbstractSoftware‐Defined Networking (SDN) is an evolving networking technique due to its flexibility and programmability. OpenFlow is the primary protocol behind SDN. Moving Target Defense (MTD) is an emerging security technique to counter attacks by dynamically changing the attack surface. SDN‐based MTD security solutions are gaining popularity due to the centralized control and monitoring capabilities of the SDN control plane. Crossfire is a type of indirect Distributed Denial of Service (DDoS) attack intending to impact the neighbors of the actual target. Crossfire DDoS attacks are gaining momentum in recent times. In this paper, a mechanism for the protection of crossfire DDoS attacks is proposed by exploiting OpenFlow‐based traffic modifications. We employed the Moving Target Defense scheme to redirect the traffic from the actual host to the shadow host to counter the crossfire DDoS attack and from the default domain name system port to another predefined port. Traffic redirection helps in diverting the attacker to shadow host and thus getting the incorrect network path and subsequently crossfire attack was unable to be executed properly. The proposed scheme utilized the ONOS cluster with Mininet. The results showed successful traffic redirection for countering the Crossfire DDoS attacks at a low computational cost.

Defending SDN against packet injection attacks using deep learning

The (logically) centralized architecture of software-defined networks makes them an easy target for packet injection attacks. In these attacks, the attacker injects malicious packets into the SDN network to affect the services and performance of the SDN controller and overflows the capacity of the SDN switches. Such attacks have been shown to ultimately stop the network functioning in real-time, leading to network breakdowns. There have been significant works on detecting and defending against similar DoS attacks in non-SDN networks, but detection and protection techniques for SDN against packet injection attacks are still in their infancy. Furthermore, many of the proposed solutions have been shown to be easily bypassed by simple modifications to the attacking packets or by altering the attacking profile. In this paper, we develop novel Graph Convolutional Neural Network models and algorithms for grouping network nodes/users into security classes by learning from network data. We start with two simple classes — nodes that engage in suspicious packet injection attacks and nodes that are not. From these classes, we then partition the network into separate segments with different security policies using distributed Ryu controllers in an SDN network. We show in experiments on an emulated SDN that our detection solution outperforms alternative approaches with above 99% detection accuracy for various types (both old and new) of injection attacks. More importantly, our mitigation solution maintains continuous functions of non-compromised nodes while isolating compromised/suspicious nodes in real-time. All code and data are publicly available for the reproducibility of our results.

An intelligent fuzzy-based system for handover decision in 5G-IoT networks considering network slicing and SDN technologies

By enabling 5G technology, IoT networks can improve the performance of connected IoT devices. However, handover, ping-pong effect and load balancing are critical issues because of massive and unplaned deployment of small cells. The handover operation in 5G wireless networks is complicated because there are many radio access techniques and technologies. Therefore, the mobility management is required to provide QoS for various applications. In this paper, we present a fuzzy-based system for handover decision in 5G wireless networks considering different network slicing parameters. We implement two Fuzzy-based Handover Decision Models (FHDM): FHDM1 and FHDM2. We evaluate the proposed models by simulations. For FHDM1, Slice Delay (SD), Slice Bandwidth (SB), and Slice Load (SL) are three input parameters and Handover Decision (HD) is the output parameter. For FHDM2, Slice Reliability (SR) is a new considered parameter, so it has four input parameters and the output parameter is HD the same as FHDM1. We found from simulation results that the considered parameters have different effects on HD. For both models, the HD value increases as SD and SL values increase while HD value is decreasing when SB and SR values increase. The results of the simulation indicate that although FHDM2 is more complex than FHDM1, it performs better HD since considers four input parameters. From the simulation results of FHDM2, when we changed SD value form 10% to 90%, we found that the HD value is increased by 50% when SR is 50% and SL is 90%. This indicates that when a user is connecting with the present slice that has bad QoS, it should handover to another slice with better QoS.

Software Defined Networking Architecture for Energy Transaction in Smart Microgrid Systems

A decentralized power distribution network consisting of smart microgrids introduces opportunities to trade with energy called transactive energy. However, research studies in the existing literature suggest that several standardized information models for TE do not meet the network architecture’s reliability, flexibility, and security requirements. This limitation is mainly due to the static nature of traditional IP infrastructure. To achieve these requirements in the network architecture, this study investigates the optimized application of software-defined network architecture for transactive energy in smart microgrid systems. Through literature research, unique design approaches in an SDN architecture are identified that improve the reliability, flexibility, and security of the SDN architecture. These design approaches include a decentralized controller network layout, redundant link configuration, a mesh network topology, and data encryption. The proposed solution uniquely combines these design approaches into a single optimized SDN solution for TESMS. To validate the improvements of the findings from the literature research, each design approach is simulated in this study using Mininet SDN emulator and AnyLogic system simulation software. The proposed solution is then applied to a use-case scenario that shows the improvements required for TESMS. The use-case scenario shows significant improvement in the data path uptime. An improvement of 0.27% is achieved, which equates to a 2 h per month increase in the data path uptime. The results of the simulation show that the proposed SDN architecture improves the reliability and flexibility of a traditional SDN network. Furthermore, enabling encryption between the nodes improves the security of the SDN architecture.