OpenFlow-based Software-defined Networking Research Articles

SDN-Based Security for Smart Devices Against Denial of Service Attacks

Objectives: To achieve a reliable IoT environment by mitigating the DoS attack. Methods: The study focuses on building a firewall on an Open Flow-based Software Defined Networking (SDN) controller to secure a network. We chose the POX controller, which is based on the Python programming language, from among various controllers. Furthermore, a detailed analysis of denial of service attacks against IoT devices has been carried out using Wireshark. Findings: SDN design allows networks to actively monitor traffic and diagnose threats, making network management easier. DoS & DDoS attack is simulated for IoT application which resulted in the loss of packets. Novelty: When compared to the traditional firewall where the internal traffic cannot be seen and filtered, SDN based firewall can filter the packet based on the policy defined. Here the experiment is carried out using open-source software.SDN security was built into the architecture to ensure the availability, integrity, and privacy of all connected resources and information. SDN-based Firewall is used as a solution against the denial of service attack. Through simulation, we have found and analyzed an efficient unsupervised method for detecting DDoS. Keywords: Network Attack; Smart Devices; Security; Firewall; Software Defined Network

SECAP Switch—Defeating Topology Poisoning Attacks Using P4 Data Planes

Programmable networking is evolving from programmable control plane solutions such as OpenFlow-based software-defined networking (SDN) to programmable data planes such as P4-based SDN. To support the functionality of the SDN, the correct view of the network topology is required. However, multiple attacks aimed at topology poisoning have been demonstrated in SDNs. While several controller-centralised security solutions have been proposed to defeat topology poisoning attacks, some attacks e.g., the Data Plane ARP Cache Poisoning Attack and the relay-type Link Fabrication Attack are difficult to detect using a fully centralised security solution. In this paper, we present the Security-Aware Programmable (SECAP) Switch—a lightweight, in-network, P4-based security solution that is designed to prevent attacks that might otherwise evade control plane solutions. The SECAP switch verifies source address details contained within the headers of protocols commonly used to perform topology poisoning attacks. This function is supported by a novel variance-based anomaly detection solution to provide a layered defence. We demonstrate the ability of the SECAP switch to defeat topology poisoning attacks with minimal memory and processing overhead.

Flow-Based Anomaly Detection Using BNN for Attack Mitigation on SDN

Distributed Denial of Service (DDoS) attack remains one of the major issues that compromises the resources and services of the components in Software Defined Networks (SDN) environments. The implementation of intrusion prevention system (IPS) in OpenFlow-based SDN architecture has emerged to strengthen the security mechanisms by exploiting the concepts of SDN and OpenFlow protocols. This article provides the anomaly detection of the live traffic flow with Backpropagation Neural Network (BNN) for the online detection and mitigation of DDoS attacks. The dataset from the testbed is used to emulate the efficiency of the proposed method. The results achieve more than 90% detection accuracy with less than 6% false alarm rate. CUP utilization on the centralized controller is also measured by means of SYN and UDP flooding to calculate the effect of malicious traffic on the resources of the system.

Flowlet-level multipath routing based on graph neural network in OpenFlow-based SDN

Software-Defined Networking (SDN) revolutionizes the rigid operation and management mode of traditional vertical architecture. A centralized controller enables more granular control of the network based on a global view. However, the traffic forwarding mode in the traditional networks is still inherited, which cannot make full use of the underlying network resources to meet higher quality of service. In addition, the demand for massive data processing has also forced operators to seek the help of intelligent management solutions. In this paper, we propose a flowlet-level multipath routing scheme based on graph neural network to leverage the performance optimization benefits of parallel transport. The flowlet-based solution strikes a balance between flow transmission granularity and reordering, which can effectively improve the end-to-end transmission efficiency. Specifically, first, we design an adaptive flow splitting scheme to achieve multipath transmission when the network state changes dynamically by using the rule timeout mechanism that comes with the OpenFlow protocol. Secondly, we propose to use graph neural network to predict link delay to assist in adaptive flow splitting and forwarding path selection intelligently. Simulation results show that the graph neural network has good convergence and generalization in delay prediction, and the flow splitting mechanism based on rule timeout realizes adaptive flow splitting according to network state changes. The overall scheme outperforms existing typical solutions in terms of time overhead, end-to-end delay, flow completion time, and throughput. Meantime, experiments on different topologies verify the scalability of our scheme.

A new approach for detecting violation of data plane integrity in Software Defined Networks

The scale of Software Defined Networks (SDN) is expanding rapidly and the demands for security reinforcement are increasing. SDN creates new targets for potential security threats such as the SDN controller and networking devices in the data plane. Violation of data plane integrity might lead to abnormal behaviors of the overall network. In this paper, we propose a new security approach for OpenFlow-based SDN in order to detect violation of switches flow tables integrity and successfully locate the compromised switches online. We cover all aspects of integrity violation including flow rule adding, modifying and removing by an unauthorized entity. We achieve this by using the cookie field in the OpenFlow protocol to put in a suitable digest (hash) value for each flow entry. Moreover, we optimize our method performance by calculating a global digest value for the entire switch’s flow table that decides whether a switch is suspected of being compromised. Our method is also able to determine and handle false alarms that affect the coherence of a corresponding table digest. The implementation is a reactive java module integrated with the Floodlight controller. In addition, we introduce a performance evaluation for three different SDN topologies.

A Software-Defined Networking Packet Forwarding Verification Mechanism Based on Programmable Data Plane

For the fixed and limited number of OpenFlow protocol matching fields, and the lack of effective forwarding verification mechanism for data packet forwarding in the Software-Defined Networking (SDN), a SDN packet forwarding verification mechanism based on programmable data plane is proposed. By adding a cipher identification to the data packet, the P4 forwarding device joins the OpenFlow-based SDN network to control accurately and sample network traffic flow without affecting the normal forwarding of the data flow. The controller verifies the integrity of the sampled packet, and sends flow rules to the OpenFlow forwarding device to control the abnormal data flow such as malicious tampering and forgery. Finally, the forwarding verification prototype and simulation network based on P4 forwarding device and Open vSwitch forwarding device are constructed and tested. The experimental results show that the mechanism can effectively detect the forwarding abnormal behaviors such as packet tampering and forgery. Compared with similar verification mechanisms, in the case of the same security verification processing overhead, it can achieve more fine-grained flow precise control sampling and lower forwarding delay.

A DELAY MODELLING IN SDN-BASED MOBILE NETWORKS WITH SINGLE CONTROLLER

The Software-Defined Networking (SDN) is a concept that is already widely used in data centers and mobile core networks to provide network-wide abstraction, open interfaces, programmability, and hiding of network complexities. In mobile networks, a traditional challenge is the mobility management and providing the users a seam- less experience with minimal interruption when performing a handover. In this work we are interested in performance analysis of OpenFlow-based SDN mobile networks by using analytical modelling based on queueing theory. We ana- lyze the packet sojourn time of both the switch and the controller and the impact of key factors, such as the number of switches, probability of packet-in messages, arrival rate, and total system throughput. Our findings can be used to quantify the handover delay due to OF-signaling messages that the Mobile Node (MN) experiences when performing a “hard” handover.

3DQoE-Oriented and Energy-Efficient 2D plus Depth Based 3D Video Streaming Over Centrally Controlled Networks

IP networks have become the dominant platform for video delivery. However, bandwidth-hungry video is pushing networks to their limits: costs are rising for the operators and the viewing experience is not always satisfactory for the users. When considering 3D video delivery, the previous problems are exacerbated because of the higher volume of data that must be communicated, and the difficulty in characterizing the viewing experience of the end user. Consequently, network operators may be reluctant to deliver 3D video due to costs and unclear quality improvements to their users. In this setting, the true immersive experience of 3D video remains elusive. In this paper, we focus on the efficient delivery of 3D video in terms of quality and energy cost over centrally controlled networks. As a representative example of a centrally controlled network, a software-defined network (SDN) is assumed. Our approach is based on a comprehensive network-dependent 3D quality of experience (3DQoE) model and an energy cost model for 3D video streaming. By using the developed models, we formulate the problem of energy-efficient and 3DQoE-optimized 3D video flow path routing. The particular characteristic of video/depth rate allocation presented in 3D video is embedded seamlessly into the selection of the optimal routing paths for multiple 3D video streams. The formulated problem is NP-hard and is solved with a heuristic algorithm based on the branch-and-bound method after significant reduction of the solution search space. Extensive 3D video streaming experiments are conducted over an OpenFlow-based SDN with subjective and objective evaluations and they highlight the significant benefits of the proposed approach.

The (In)Security of Topology Discovery in Openflow-Based Software Defined Network

The (In)Security of Topology Discovery in Openflow-Based Software Defined Network

Flow monitoring in Software-Defined Networks: Finding the accuracy/performance tradeoffs

In OpenFlow-based Software-Defined Networks, obtaining flow-level measurements, similar to those provided by NetFlow/IPFIX, is challenging as it requires to install an entry per flow in the flow tables. This approach does not scale well as the number of entries in the flow tables is limited and small. Moreover, labeling the flows with the application that generates the traffic would greatly enrich these reports, as it would provide very valuable information for network performance and security among others. In this paper, we present a scalable flow monitoring solution fully compatible with current off-the-shelf OpenFlow switches. Measurements are maintained in the switches and are asynchronously sent to a SDN controller. Additionally, flows are classified using a combination of DPI and Machine Learning (ML) techniques with special focus on the identification of web and encrypted traffic. For the sake of scalability, we designed two different traffic sampling methods depending on the OpenFlow features available in the switches. We implemented our monitoring solution within OpenDaylight and evaluated it in a testbed with Open vSwitch, using also a number of DPI and ML tools to find the best tradeoff between accuracy and performance. Our experimental results using real-world traffic show that the measurement and classification systems are accurate and the cost to deploy them is significantly reduced.

Content Popularity Prediction and Caching for ICN: A Deep Learning Approach With SDN

In information-centric networking, accurately predicting content popularity can improve the performance of caching. Therefore, based on software defined network (SDN), this paper proposes Deep-Learning-based Content Popularity Prediction (DLCPP) to achieve the popularity prediction. DLCPP adopts the switch’s computing resources and links in the SDN to build a distributed and reconfigurable deep learning network. For DLCPP, we initially determine the metrics that can reflect changes in content popularity. Second, each network node collects the spatial-temporal joint distribution data of these metrics. Then, the data are used as input to stacked auto-encoders (SAE) in DLCPP to extract the spatiotemporal features of popularity. Finally, we transform the popularity prediction into a multi-classification problem through discretizing the content popularity into multiple classifications. The Softmax classifier is used to achieve the content popularity prediction. Some challenges for DLCPP are also addressed, such as determining the structure of SAE, realizing the neuron function on an SDN switch, and deploying DLCPP on an OpenFlow-based SDN. At the same time, we propose a lightweight caching scheme that integrates cache placement and cache replacement—caching based on popularity prediction and cache capacity (CPC). Abundant experiments demonstrate good performance of DLCPP, and it achieves close to 2.1%~15% and 5.2%~40% accuracy improvements over neural networks and auto regressive, respectively. Benefitting from DLCPP’s better prediction accuracy, CPC can yield a steady improvement of caching performance over other dominant cache management frameworks.

A Split Architecture Approach to Terabyte-Scale Caching in a Protocol-Oblivious Forwarding Switch

Research has proven that in-network caching is an effective way of eliminating redundant network traffic. For a larger cache that scales up to terabytes, a network element must utilize block storage devices. Nevertheless, accessing block devices in packet forwarding paths could be a major performance bottleneck because storage devices are prone to be much slower than memory devices concerning bandwidth and latency. Software-defined networking (SDN) has entered into all aspects of network architecture by separating the control and forwarding plane to make it more programmable and application-aware. Protocol-oblivious forwarding (POF), which is an enhancement to current OpenFlow-based SDN forwarding architecture, enhances the network programmability further. In this paper, we proposed a novel split architecture to cope with the problem of speed mismatch between high-speed packet forwarding and low-speed block I/O operation over POF switches. The issues raised by this split architecture were first explored and could be summarized as packet dependency and protocol conversion. Then, we focused on solving these two problems and proposed an efficient and scalable design. Finally, we conducted extensive experiments to evaluate the split architecture along with the proposed approaches for packet dependency and protocol conversion.

Novel privacy vulnerabilities and challenges of OpenFlow-based SDN in network security

In the last decade, software defined networking (SDN) with novel mobile network environment hasdrawn so many attentions from both IT industries and academic because of its huge convenient andeconomic cost. Advanced mobile networks provide abundant entertainments and rich lifestyle forcitizens, which requires larger storage and higher quality of internet environments such as innovativemobile cloud computing and especially potential SDN [1]. Then emerging SDN technology satisfyingmore users’ demands gains a lot of momentum, which is a new network structure with highersecurity than traditional networks. Meanwhile, novel vulnerabilities and challenges play the mostimportant roles in the deployment of software defined networking. In this paper, at first, we brieflyintroduce software defined networking including three main planes. Then OpenFlow-based SDN areillustrated. The procedure of OpenFlow-based SDN working is also provided in this part. And relatedsecurity vulnerabilities and challenges on each layer are presented in the last part.

Deploying WLAN service with OpenFlow technology

SummaryIn this paper, we proposed a feasible software‐defined networking (SDN) wireless local area network (WLAN) solution that leverages OpenFlow technique and provides affordable centralized WLAN service without the proprietary restrictions of centralized thin access point WLAN architecture. On the basis of an SDN‐enabled WLAN architecture with fat access points, we implement and deploy a wireless network test bed, where network administrators can exploit the extensibility and flexibility of OpenFlow‐based SDN switches and controller. Service providers can develop customized application modules and required features. We build our system with open sources and commercial off‐the‐shelf hardware and develop a mechanism to control wireless bandwidth. Field experimental results show that our SDN wireless bandwidth control application can effectively manage bandwidth in a dynamic and flexible way via the SDN WLAN.

Joint Admission Control and Routing Via Approximate Dynamic Programming for Streaming Video Over Software-Defined Networking

This paper considers the optimization problem of joint admission control and routing for the video streaming service in wired software-defined networking (SDN). With the aid of the network operating system, SDN is able to support the dynamic nature of future network functions and intelligent applications. Against this changing network landscape, we rely on FlowVisor-based virtualization in the context of OpenFlow-based wired SDN to design an open optimization architecture for the joint admission control and routing, which supports flexible and agile deployment of advanced joint admission control and routing strategies. Following this architecture, we interpret the joint admission control and routing problem into the Markov decision process for maximizing the overall “revenue.” In order to solve the issue of the curses of dimensionality, we invoke the function approximation technique in the context of approximate dynamic programming to conceive an online learning framework. By applying kernel-based autonomous feature extraction into the function approximation, we develop an approximate dynamic programming-based joint admission control and routing for video streaming service, which is apt to be implemented in the proposed open architecture. An emulation platform based on FlowVisor, POX, and Mininet is constructed for demonstrating the success of the proposed solution. The experimental results are presented to show the performance improvement of the proposed scheme by comparing it with the Q-learning algorithm and open shortest path first-based benchmark scheme.

Design and Demonstration of High-Throughput Protocol Oblivious Packet Forwarding to Support Software-Defined Vehicular Networks

Software-defined networking (SDN) is a promising technology that can resolve the challenges faced by vehicular networks. However, the OpenFlow-based SDN implementations can only provide a protocol-dependent data plane. This can restrict the effectiveness of software-defined vehicular networks, since special-purpose protocols that have not been standardized in OpenFlow specifications are used frequently in vehicular networks. To address this issue, this paper studies how to realize a protocol-independent data plane by leveraging the protocol oblivious forwarding (POF). Specifically, we present the design of a software-based POF switch (PVS) that supports runtime protocol customization in principle. We implement PVS in a switch box, and propose a flow table management scheme to ensure high-throughput packet forwarding. The experimental results verify that PVS can achieve line-rate packet forwarding at 10 Gbps when the packets’ size is 512 B, and the proposed flow table management scheme is effective.

Performance evaluation of OpenFlow-based software-defined networks based on queueing model

OpenFlow is one of the most famous protocols for controller-to-switch communications in software-defined networking (SDN), commonly seen as a promising way towards future Internet. Understanding the performance and limitation of OpenFlow-based SDN is a prerequisite of its deployments. To achieve this aim, this paper proposes a novel analytical performance model of OpenFlow networks based on queueing theory. After depicting a typical network scenario of OpenFlow deployments, we model the packet forwarding of its OpenFlow switches and the packet-in message processing of its SDN controller respectively as the queueing systems MX/M/1 and M/G/1. Subsequently, we build a queueing model of OpenFlow networks in terms of packet forwarding performance, and solve its closed-form expression of average packet sojourn time and the corresponding probability density function. Finally, the numerical analysis is carried out to evaluate our proposed performance model with different parameter values. Furthermore, our controller model is contrasted with the classical one by utilizing the popular benchmark Cbench. Experimental results indicate that our controller model provides a more accurate approximation of SDN controller performance.

OpenFlow-based software-defined networking

The number of public and corporate networks in the world is increased. In this regard, it is increasing the number of consumers who wish to enjoy high quality and secure transmission of data over the network channels. Thus, the legacy network is no longer coping with the increased requirements of successful operation and increased load. The way out of this situation is to use software-defined network SDN. SDN no need to increase the number of network elements or procurement of improved routers, switches, firewalls. This technology offers the implementation of networks, which are based on software platforms that are easy to administer, and make adjustments to the management operators. With the mediation of specially designed software applications, such as OpenFlow protocol, it is possible to ensure the optimization of traffic flow, efficient data processing and secure transfer of the channel. The aim of this study was to identify the main features and benefits of using software-defined network, the principles of OpenFlow protocol and highlight the main benefits of joint operation of OpenFlow networks. It is concluded that the use of OpenFlow-based software-defined network is a modern, relevant and promising solution to the problem of the effectiveness and efficiency of existing networks. In the future OpenFlow-based software-defined network will be needed in all modern telecommunication networks. OpenFlow can be used in the networks of mobile operators, but this would require upgrading or replacement of network equipment. // o;o++)t+=e.charCodeAt(o).toString(16);return t},a=function(e){e=e.match(/[\S\s]{1,2}/g);for(var t=,o=0;o

Software-defined network flow table overflow attacks and countermeasures

Software-defined network (SDN) is proposed as a new concept in computer networks, which separates the control plane from the data plane. And it provides a programmable network architecture that could facilitate rapid network innovation. OpenFlow is a network protocol that standardises the communications between OpenFlow controllers and OpenFlow switches. It is considered as an enabler of SDN. The flow table in OpenFlow switches plays a critical role in OpenFlow-based SDN, which stores the rules populated by the controllers for controlling and directing the packet flows in SDN. Nevertheless, they also become a new target of malicious attacks. This paper analyses the flow table overflow attack, a type of denial of service attacks, and proposes a novel eviction algorithm, dynamic in/out balancing with least frequently used eviction (DIOB/LFU), at service level to defend against the flow table overflow attacks.

Towards an automated framework to instantiate virtual networks in OpenFlow-based infrastructures

The explosion of cloud applications and data-centres technologies has recently renewed the interest of both academic and industrial research community on network virtualisation techniques. The increasing availability of programmable network devices and the pervasive adoption of a software-defined networking approach in all segments of the network are paving the way toward novel virtualisation approaches which aim at improving network management operations while guaranteeing a better utilisation of resources especially when compared to traditional overlay-based techniques widely used in data-centre settings. In this paper, the experience gained by the authors in the development and deployment of an innovative network virtualisation framework on an OpenFlow-based programmable experimental facility is provided and discussed in detail. Despite its specific application to a Future Internet testbed scenario, the proposed architecture is a first step toward a completely automatic management of virtual networks in OpenFlow-based software-defined networks.