OpenFlow Switch Research Articles

Graph Modeling for OpenFlow Switch Monitoring

Graph Modeling for OpenFlow Switch Monitoring

Towards Secure Implementations Of SDN Based Firewall

Software-defined networking (SDN) is an emerging technology as a new paradigm for network architecture. It is a revolutionizing technology that facilitates effective management and programmability in a network. With the surge in popularity of SDN, security measures to protect enterprise networks are getting more critical. In SDN, security methods like firewalls must deal with unpredictable network environments. A firewall is an essential part of network security. It can restrict network data traffic flows according to predefined rules. This research paper analyzes the performance of SDN-based firewalls implemented on different network layers. Mininet simulation tool creates a topology using POX controller and open flow switch. Evaluate data flow by implementing and without a firewall using transmission control protocol (TCP) and user datagram protocol (UDP). To evaluate the performance of the proposed firewall, network parameters like bandwidth, roundtrip time, jitter, and packet loss must be analyzed. The outcome proved that the performance has improved whether either firewall was implemented or not. In the future, by using the Mininet simulation tool with other external controllers like RYU, Floodlight, NOX, etc., analyze the parameters mentioned above and make firewall rules for the application layer.

FPGA-Based Updatable Packet Classification Using TSS-Combined Bit-Selecting Tree

OpenFlow switches are being deployed in SDN to enable a wide spectrum of non-traditional applications. As a promising alternative to brutal force TCAMs, FPGA-based packet classification is being actively investigated. However, none of the existing FPGA designs can achieve high performance on both search and update for large-scale rule sets. To address this issue, we propose TcbTree, an FPGA-based algorithmic scheme for packet classification. Specifically, at the algorithmic side, i) a two-stage framework consisting of heterogeneous algorithms is proposed, where most rules can be mapped into several balanced trees without rule replications, ii) for the remaining few rules, a centralized TSS (Tuple Space Search) architecture together with a real-time feedback scheme is designed to enhance the efficiency of TSS search on FPGA, and iii) a tree dilution method is designed to equalize rule distribution in trees, so that the latency of tree search can be reduced. At the hardware side, i) an efficient data structure set is designed to convert tree traversal to addressing process, which breaks the constraints of limited tree depth and imbalanced node distribution, and ii) distinct from fully pipelined designs, multiple levels of parallelism are efficiently explored with multi-core, multi-search-engine and coarse-grained pipelines herein. Experimental results using ClassBench show that, with the implementation of TcbTree on FPGA, the average classification throughputs for 1k, 10k, 32k and 100k rule sets achieve 788.8 MPPS, 404.3 MPPS, 237 MPPS and 41.8 MPPS, respectively, and the update throughput for all benchmark rule sets is above 1 MUPS.

ClassBench-ng: Benchmarking Packet Classification Algorithms in the OpenFlow Era

Packet classification, i.e., the process of categorizing packets into flows, is a first-class citizen in any networking device. Every time a new packet has to be processed, one or more header fields need to be compared against a set of pre-installed rules. This is done for basic forwarding operations, to apply security policies, application-specific processing, or quality-of-service guarantees. A lot of research efforts have identified better lookup techniques, i.e., finding the best match between packet headers and rules, by capitalizing on the rule sets characteristics. Here, ClassBench has greatly served the community by enabling the generation of IPv4 rule sets. In this paper, we present a new tool, ClassBench-ng, that creates synthetic IPv4, IPv6, and OpenFlow rules. We start from an analysis of classification rules deployed in-the-wild and we use the findings to craft our solution. ClassBench-ng can generate a user-defined number of rules as well as an associated header trace matching them. Compared to state-of-the-art solutions, the rule set generation process is usually more accurate and it is able to produce rules matching a number of different use cases, i.e., from an IPv4 router to an OpenFlow switch, which is unique among current rule set generation tools.

ML-Based Delay Attack Detection and Isolation for Fault-Tolerant Software-Defined Industrial Networks.

Traditional security mechanisms find difficulties in dealing with intelligent assaults in cyber-physical systems (CPSs) despite modern information and communication technologies. Furthermore, resource consumption in software-defined networks (SDNs) in industrial organizations is usually on a larger scale, and the present routing algorithms fail to address this issue. In this paper, we present a real-time delay attack detection and isolation scheme for fault-tolerant software-defined industrial networks. The primary goal of the delay attack is to lower the resilience of our previously proposed scheme, SDN-resilience manager (SDN-RM). The attacker compromises the OpenFlow switch and launches an attack by delaying the link layer discovery protocol (LLDP) packets. As a result, the performance of SDN-RM is degraded and the success rate decreases significantly. In this work, we developed a machine learning (ML)-based attack detection and isolation mechanism, which extends our previous work, SDN-RM. Predicting and labeling malicious switches in an SDN-enabled network is a challenge that can be successfully addressed by integrating ML with network resilience solutions. Therefore, we propose a delay-based attack detection and isolation scheme (DA-DIS), which avoids malicious switches from entering the routes by combining an ML mechanism along with a route-handoff mechanism. DA-DIS increases network resilience by increasing success rate and network throughput.

Monitoring OpenFlow Virtual Networks via Coordinated Switch-Based Traffic Mirroring

As network virtualization becomes ubiquitous, legacy hardware-based traffic monitoring systems are no longer viable for dynamic traffic inspection at arbitrary locations in virtual networks. In this paper, we present the design and evaluation of Open Virtual Tap (OVT), a software-defined solution to replace hardware taps for traffic monitoring in OpenFlow virtual networks by utilizing mirroring capabilities of OpenFlow switches. The key idea behind OVT is the joint configuration of all switches in the substrate physical network in order to efficiently mirror flows from all virtual networks. We show that such a design avoids inefficiencies that result from existing software-based traffic mirroring solutions in which each virtual network configures its own switches independently of other virtual networks. We evaluate OVT using model-driven simulations as well as Mininet experiments with realistic applications for intrusion detection and video telephony analysis. Specifically, in our experiments, we observe that OVT can achieve up to 20% improvement in flow coverage compared to existing traffic mirroring approaches.

DoSMit: A Novel Way for the Mitigation of Denial of Service Attacks in Software Defined Networking

Abstract: Software Defined Networking (SDN) is a rapidly evolving technology in the field of networking. It allows the computer networks to be managed via software instead of hardware devices. It gives the benefit of simplicity in management and easiness to apply new features in the network. Thus scalability, performance and maintainability become more sophisticated compared to the legacy hardware driven networks. But the SDN has more chances of being attacked by hackers, thus compromising the entire network. One common such threat is Denial of Service (DoS). Apart from such attacks in the legacy networks, the DoS attacks can be aimed at the SDN controller, Openflow switch and the controller-switch link by exhausting their resources. This paper proposes a novel and simple method to detect and mitigate such attacks through a Heavy Packet-in Flow Mitigation feature. Also it introduces an add-on feature ARP Flood Rule to reduce the number of ARP packets during the network initial boot up time. With both the features enabled, the network can reduce the packet-in flows to the controller and rescue the controller from overwhelming with huge packet-in message processing.

A robust tuned classifier-based distributed denial of service attacks detection for quality of service enhancement in software-defined network

In today’s world, Software-Defined Networking (SDN) plays a significant role in the advancement of next-generation network architecture that offers vast control to the network operators. However, the control layer is vulnerable to Distributed Denial of Service (DDoS) attacks where DDoS is one of the most powerful and devastating cyber-attacks. Thus, the development of a DDoS attack detection mechanism is very essential since these kinds of attacks have a direct impact on the overall performance of the SDN. In this paper, a new robust Tuned support vector machine-based DDoS attack detection methodology has been proposed to categorize the benign traffic from DDoS attack traffic on the SDN. Primarily, the network is created with controller and OpenFlow switch and the communication can be carried out through secure channels among different benign users and also attackers. Afterward, the multi-characteristic values are extracted by the effective extraction strategy which consists of the six-tuple characteristic values matrix. Finally, the tuned classifier has been implemented with the aid of optimization algorithm for differentiating the abnormal traffic and the normal traffic. The performance results manifest that the proposed detection framework achieves a higher accuracy of 98% and precision of 99% when compared with existing classifiers.

Delay modeling for virtualization-based Co-simulation of IEC 61850 substations

Increasing digitization in station automation enables new applications for intelligent functionalities in substations of electrical power systems. The use of IEC 61850 as a uniform communication standard is an important requirement in this context, but also changes the vulnerability to cyber-attacks. Real-time cyber-physical co-simulation platforms are necessary to investigate cyber security threats and countermeasures in digital substations. Essential to the real-time capability and validity of the co-simulation is the compliance with requirements of IEC 61850 – especially the arising transfer times between the substation components. We present here a queue-based delay model for the used Software-Defined-Network architecture to derive a maximum permissible size of the virtual network. This model can capture various influences during the information exchange between OpenFlow-based switches and a centrally hosted controller. The dependency of the transfer time on the number of switches, considered data rates and handover probabilities between controller and switch limits the network size of the virtualization. We present here the adaption of well-known queueing delay models to our IEC 61850 substation use case and their usage in presented co-simulation approach, by taking the network topology, estimated network traffic and simplifications for single-controller architecture with uniformed Open-Flow Switches into account. In this context, the presented architecture of the co-simulation has a structurally limited area of validity, which is introduced and described here analytically. The work also complements already existing delay models by an input prioritization of packet-in events. We can approximate a theoretical limit of 16 sampled values streams in the current setup of co-simulation in a simple and completely interconnected star topology, which will have to highest impact on the transfer time delay.

A comprehensive survey on software‐defined networking for smart communities

SummaryThe need to provide services closer to the end‐user proximity leads to the exchange of a large volume of data generated from the smart devices deployed at different geo‐distributed sites. The massive amount of data generated from the smart devices need to be transmitted, analyzed, and processed. This requires seamless data exchanges among geo‐separated nodes, which results in a considerable burden on the underlying network infrastructure and can degrade the performance of any implemented solution. Therefore, a dynamic, agile, and programmable network management paradigm is required. To handle the challenges mentioned above, software‐defined networking (SDN) gained much attention from academia, researchers, and industrial sectors. Shifting the computational load from forwarding devices to a logically centralized controller is a dream of every network operator who wants to have complete control and global visibility of the network. Also, the concept of network functions virtualization (NFV) in SDN controller is required to increase resource utilization efficiency. Thus, in this paper, a comprehensive survey on SDN for various smart applications is presented. This survey covers the infrastructural details of SDN hardware and OpenFlow switches, controllers, simulation tools, programming languages, open issues, and challenges in SDN implementation with advanced technologies such as 5G and microservices. In addition, the challenges on the control plane and data plane are highlighted in detail, such as fault tolerance, routing, scheduling of flows, and energy consumption on OpenFlow switches. Finally, various open issues and challenges future scope of SDN are discussed and analyzed in the proposal.

SDN Framework for Mitigating Time-Based Delay Attack

Due to recent cyberattacks on the Cyber-Physical Systems, the traditional security schemes face difficulties in dealing with such attacks as the attackers nowadays have adopted many intelligent mechanisms involving advanced information and communication technologies to launch attacks. This recent type of attack provides a significant impact on the resiliency of the software-defined networks. In this paper, we present a real-time delay attack on fault-resilient software-defined networks. The main objective of the time delay attack is to reduce the resiliency in the SDN-RM by adding a delay in the LLDP packets in the OpenFlow Switch. This addition of delay causes degradation in the network performance resulting in a low success rate in the SDN-RM mechanisms. In this paper, we present a machine learning-based detection system for detecting the attacks. The integration of machine learning techniques with network resilience solutions can effectively address the issue of predicting and classifying the LLDP packets that are delayed at a particular switch. Another issue is the detection of the malicious switch at the controller side which results in the improvement of the resiliency in SDN-RM. We propose a machine learning solution to detect the anomalies that are present in the topology and can be detected at the controller side. We use machine learning models such as k-nearest neighbors, support vector machines (SVM), Random Forest, and decision trees to detect the poisonous switches. The delay-based time attack detection system (DTA-DS) helps the controller to take a reactive decision to improve resilience by detecting poisonous network switches. With the help of the preventive approach, we achieve high-fault resiliency in fault resilient-based software-defined networks.

Extended indirect controller-legacy switch forwarding for link discovery in hybrid multi-controller SDN

Though widely perceived as a promising network architecture, Software Defined Networks (SDN) have inherent deployment issues, particularly in terms of a full SDN deployment paving the path for Hybrid Software Defined Networks (hSDN) and subsequently Multi-Controller h-SDN (MC-hSDN) to address limited scalability of the former. Networks allocate resources to applications based on their requirements which are taken care of by the controller. Existing link discovery protocols such as Link Layer Discovery Protocol (LLDP) and Broadcast Domain Discovery Protocol (BDDP) are able to detect links only for OpenFlow switch (OFS) in direct and indirect manners while Indirect Controller Legacy Forwarding (ICLF) scheme detects all links in h-SDN only for a single-controller environment, thus rendering link detection in MC-hSDN incomplete. This paper proposes a novel Extended ICLF (E-ICLF) scheme to fetch the topology in a multi-controller environment. A solitary PACKET_OUT (Pout) is emanated from every domain controller which circulates across the domain’s as nodes appending information which gets dispatched to the initiating controller. Experiments performed with Mininet indicate ports detection improvement and PACKET_ IN (Pin) message exchange reduction by an average of about (0.8%–44.8%) and (56.8%–93.2%) respectively with a fewer overhead of forwarded messages and convergence time to build the topology.

Adaptive Machine Learning Based Distributed Denial-of-Services Attacks Detection and Mitigation System for SDN-Enabled IoT.

The development of smart network infrastructure of the Internet of Things (IoT) faces the immense threat of sophisticated Distributed Denial-of-Services (DDoS) security attacks. The existing network security solutions of enterprise networks are significantly expensive and unscalable for IoT. The integration of recently developed Software Defined Networking (SDN) reduces a significant amount of computational overhead for IoT network devices and enables additional security measurements. At the prelude stage of SDN-enabled IoT network infrastructure, the sampling based security approach currently results in low accuracy and low DDoS attack detection. In this paper, we propose an Adaptive Machine Learning based SDN-enabled Distributed Denial-of-Services attacks Detection and Mitigation (AMLSDM) framework. The proposed AMLSDM framework develops an SDN-enabled security mechanism for IoT devices with the support of an adaptive machine learning classification model to achieve the successful detection and mitigation of DDoS attacks. The proposed framework utilizes machine learning algorithms in an adaptive multilayered feed-forwarding scheme to successfully detect the DDoS attacks by examining the static features of the inspected network traffic. In the proposed adaptive multilayered feed-forwarding framework, the first layer utilizes Support Vector Machine (SVM), Naive Bayes (NB), Random Forest (RF), k-Nearest Neighbor (kNN), and Logistic Regression (LR) classifiers to build a model for detecting DDoS attacks from the training and testing environment-specific datasets. The output of the first layer passes to an Ensemble Voting (EV) algorithm, which accumulates the performance of the first layer classifiers. In the third layer, the adaptive frameworks measures the real-time live network traffic to detect the DDoS attacks in the network traffic. The proposed framework utilizes a remote SDN controller to mitigate the detected DDoS attacks over Open Flow (OF) switches and reconfigures the network resources for legitimate network hosts. The experimental results show the better performance of the proposed framework as compared to existing state-of-the art solutions in terms of higher accuracy of DDoS detection and low false alarm rate.

An intelligent method for reducing the overhead of analysing big data flows in Openflow switch

Software-defined networks have been developed to allow the entire network to be managed as a programmable entity. As a well-known protocol in this field, OpenFlow installs new packet forwarding rules of the distinct packets of Big Data flows (known as flow entries) in the flow tables of network switches in order to implement the desired management policies. Despite the high speed, flow tables have limited capacity to store the information of Big Data flows. As a result of inefficient policy for replacing the entries of the flow table, lack of flow entries corresponding to the incoming packets in the flow table of the switch will increase the references to the controller for forwarding this packet as well as the amount of delay in packet forwarding. The underlying idea of the proposed method is to make use of the popularity of traffic flows in the table to select the intended flow for the replacement. For replacement of flow table entries, a novel and intelligent method is proposed in this research which uses a reference history of flows to assign an importance degree to each table entry. Comparison of the simulation results confirms the superiority of the method for reducing the controller's overflow.

Effectively Handling Network Congestion and Load Balancing in Software-Defined Networking

The concept of Software-Defined Networking (SDN) evolves to overcome the drawbacks of the traditional networks with Internet Protocol (I.P.) packets sending and packets handling. The SDN structure is one of the critical advantages of efficiently separating the data plane from the control plane to manage the network configurations and network management. Whenever there are multiple sending devices inside the SDN network, the OpenFlow switches are programmed to handle the limited number of requests for their interface. When the recommendations are exceeded from the specific threshold, the load on the switches also increases. This research article introduces a new approach named LBoBS to handle load balancing by adding the load balancing server to the SDN network. Besides, it is used to maximize SDN’s reliability and efficiency. It also works in coordination with the controller to effectively handle the load balancing policies. The load balancing server is implemented to manage the switches load effectively. Results are evaluated on the NS-3 simulator for packet delivery, bandwidth utilization, latency control, and packet decision ratios on the OpenFlow switches. It has been found that the proposed method improved SDN’s load balancing by 70% compared to the previous state-of-the-art methods.

Intelligent Transmission Control for Efficient Operations in SDN

Although the Software-Defined Network (SDN) is a well-controlled and efficient network but the complexity of open flow switches in SDN causes multiple issues. Many solutions have been proposed so far for the prevention of errors and mistakes in it but yet, there is still no smooth transmission of pockets from source to destination specifically when irregular movements follow the destination host in SDN, the errors include packet loss, data compromise etc. The accuracy of packets received at their desired destination is possible if networks for pockets and hosts are monitored instead of analysis of network snapshot statistically for the state, as these approaches with open flow switches, discover bugs after their occurrence. This article proposes a design to achieve the said objective by defining the Intelligent Transmission Control Layer (ITCL) layer. It monitors all the connections of end hosts at their specific locations and performs necessary settlements when the connection state changes for one or multiple hosts. The layer informs the controller regarding any state change at one period and controller collects information of end nodes reported via ITCL. Then, updates flow tables accordingly to accommodate a location-change scenario with a route-change policy. ICTL is organized on prototype-based implementation using the popular POX platform. In this paper, it has been discovered that ITCL produces efficient performance in the trafficking of packets and controlling different states of SDN for errors and packet loss.

Overhead Reduction Technique for Software-Defined Network Based Intrusion Detection Systems

In Software-Defined Networks, the Intrusion Detection System is receiving growing attention, due to the expansion of the internet and cloud storage. This system is vital for institutions that use cloud services and have many users. Although the Intrusion Detection System offers several security features, its performance is lagging behind in large enterprise’s networks. Existing approaches are based on centralised processing and use many features to implement a protection system. Therefore, system overload and poor performance occur at the controller and OpenFlow switches. As a result, the current solutions create issues that must be considered, especially when they are implemented on large networks. Furthermore, enhancements in security applications improve the reliability of networks. Following a literature review of the existing Intrusion Detection Systems, this paper presents a new model that offers decentralised processing and exchanges data over a trusted, independent channel, in order to solve issues relating to system overload and poor performance. Our model utilises an appropriate feature selection method to reduce the number of extracted features and minimise the data transmitted over the channels. Additionally, the Naive Bayes algorithm has been employed for flow classification purposes, since it is a fast classifier. We successfully implemented our framework, using the Mininet emulator, which provides a suitable networking environment. Evaluations indicates that our proposed system can detect various attacks with an accuracy of 98.46% and nominal decreasing rates of 1.5% in throughput and 0.7% in latency analyses, when the model is implemented in wide range networks.

An approach for slow distributed denial of service attack detection and alleviation in software defined networks

Over the last few years, the need for programmable networks has captured the interest of industrialists and academicians. It has led to the development of a paradigm called software defined network (SDN). It separates the network intelligence into the control plane and forwarding logic into the data plane. This architecture gives scope to various security issues of which denial of service (DoS) is the most common and challenging to detect. This paper focuses on the detection and mitigation of a slow DoS attack called Slowloris on Apache2 server in SDN based networks. The proposed solution is called Slowloris detection and mitigation mechanism (SDMM). Mininet, an emulator, and SimpleHTTPServer are used for simulation and the same is implemented using Zodiac FX OpenFlow switch, Ryu controller and Apache2 server. SDMM algorithm detects and mitigates prolonged Slowloris attack in typical networks as well as in slow networks with low bandwidth and high delay in 240-280s with an accuracy of 100% and 98% respectively. It uses expectation of burst size as a key factor for detection.

An SDN-Based Solution for Horizontal Auto-Scaling and Load Balancing of Transparent VNF Clusters.

This paper studies the problem of the dynamic scaling and load balancing of transparent virtualized network functions (VNFs). It analyzes different particularities of this problem, such as loop avoidance when performing scaling-out actions, and bidirectional flow affinity. To address this problem, a software-defined networking (SDN)-based solution is implemented consisting of two SDN controllers and two OpenFlow switches (OFSs). In this approach, the SDN controllers run the solution logic (i.e., monitoring, scaling, and load-balancing modules). According to the SDN controllers instructions, the OFSs are responsible for redirecting traffic to and from the VNF clusters (i.e., load-balancing strategy). Several experiments were conducted to validate the feasibility of this proposed solution on a real testbed. Through connectivity tests, not only could end-to-end (E2E) traffic be successfully achieved through the VNF cluster, but the bidirectional flow affinity strategy was also found to perform well because it could simultaneously create flow rules in both switches. Moreover, the selected CPU-based load-balancing method guaranteed an average imbalance below 10% while ensuring that new incoming traffic was redirected to the least loaded instance without requiring packet modification. Additionally, the designed monitoring function was able to detect failures in the set of active members in near real-time and active new instances in less than a minute. Likewise, the proposed auto-scaling module had a quick response to traffic changes. Our solution showed that the use of SDN controllers along with OFS provides great flexibility to implement different load-balancing, scaling, and monitoring strategies.

Self-healing topology for DDoS attack identification & discovery protocol in software-defined networks

Software defined networking is an emerging network architecture that separates the control plane from the data plane of network devices and places the control plane on one or more control servers capable of managing the rules traffic forwarding of all communication devices under your domain. This article describes the architecture, different modules, and event sequences of the HyPASS for real-time protection from address-forged attacks with proactive host discovery and address validation. Such attacks cause the wastage of network bandwidth, processing power, and network resources available to the user. We performed the latency, throughput, and attack prevention tests using POX & RYU controllers on the Mininet network simulator with and without HyPASS. The system performance is analyzed for accuracy and efficiency in four different SDN scenarios categorized as fully OpenFlow enabled and Hybrid. The proposed system discovers all the live hosts in the network, updates Host Table at the handshaking between controller and OpenFlow switches. Experiments show that the system prevented all the address-forged attacks by validating the source address in different SDN environments. It achieves a 99.99% filtering accuracy level in a fully OpenFlow-enabled setup.