OpenFlow Switch Research Articles

A Multi-Layered Defence Strategy against DDoS Attacks in SDN/NFV-Based 5G Mobile Networks

Software-defined networking (SDN) and network functions virtualisation (NFV) are crucial technologies for integration in the fifth generation of cellular networks (5G). However, they also pose new security challenges, and a timely research subject is working on intrusion detection systems (IDSs) for 5G networks. Current IDSs suffer from several limitations, resulting in a waste of resources and some security threats. This work proposes a new three-layered solution that includes forwarding and data transport, management and control, and virtualisation layers, emphasising distributed controllers in the management and control layer. The proposed solution uses entropy detection to classify arriving packets as normal or suspicious and then forwards the suspicious packets to a centralised controller for further processing using a self-organising map (SOM). A dynamic OpenFlow switch relocation method is introduced based on deep reinforcement learning to address the unbalanced burden among controllers and the static allocation of OpenFlow switches. The proposed system is analysed using the Markov decision process, and a Double Deep Q-Network (DDQN) is used to train the system. The experimental results demonstrate the effectiveness of the proposed approach in mitigating DDoS attacks, efficiently balancing controller workloads, and reducing the duration of the balancing process in 5G networks.

An Effective Selection of Memory Technologies for TCAM to Improve the Search Operations: Demonstration of Memory Efficiency in SDN Recovery

Ternary Content-Addressable Memory (TCAM) is used for storing the flow tables in software-defined networking (SDN)-based OpenFlow switches. However, the TCAM can store only a certain number of flow tables (8000). Moreover, when the switch flow tables need to be updated due to the link failure in the SDN, further updates may be lost due to the flow tables limit of the TCAM space. Hence, to resolve this issue, other memories need to be used in conjunction with TCAM to enhance the memory operations of TCAM. When considering which flash memory technology is to be used in conjunction with TCAM, we need to balance several factors to ensure optimal performance, speed, endurance, reliability, integration complexity, and cost-effectiveness. Hence, it leads to a multi-criteria decision-making problem regarding the selection of other memory technologies such as 3D XPoint, Magnetoresistive RAM, Resistive RAM, and Ferroelectric RAM. In this paper, we use the analytical network process (ANP) method to select the suitable technology in conjunction with TCAM, considering the features of the memory technologies for Software-Defined Internet-of-Things (SD-IoT). We provide a comprehensive numerical model leveraging the ANP to rank the memory technologies regarding their weights. The highest weights identify the most suitable technology for TCAM. We perform simulations to show the effectiveness of the mathematical model utilizing the ANP. The results show that the suggested methodology reduces the recovery delay, improves the packets received ratio (PRR), decreases the jitter, and increases the throughput.

PENGARUH PENGGUNAAN VLAN PADA SOFTWARE DEFINED NETWORK BERBASIS RYU CONTROLLER

Software Defined Network (SDN) is a network architecture that separates the control plane and data plane in networking devices, which then makes the control plane independent and programmable. The control plane task is taken by the controller, where the controller can manage all the rules in all networking devices, one type of controller is the Ryu controller. VLAN is a network configuration that distributes several different segments to devices connected to the network that can improve network performance. This study aims to determine the performance of VLAN on Software Defined Network using Ryu Controller using a simulation method with 2 scenarios, namely linear topology 3 OpenFlow Switch 30 hosts and linear topology 3 OpenFlow Switch 60 hosts with traffic of 100, 200, 300, and 400 Mb. Testing is carried out using the rest_router app on the Ryu controller which can run static routing without VLAN and with VLAN so that the difference between using VLAN and not can be seen. The test results show that the linear topology of 3 switches, whether 30 hosts or 60 hosts, can work well. Based on the test of QoS parameters Throughput, Packet Loss, and Jitter, the overall of VLAN is less good than without VLAN, with values of 222.9 Mbps, 0%, 0.0000636 s, and 0.0000675 ms, respectively. However, as the number of hosts increases, VLAN is more reliable.

Effect of Conflicting Flows on TCP and UDP Data Transfer Rates in OpenFlow Switch for Software-Defined Networks (SDN)

Software-defined networking (SDN) is a framework that enhances scalability and agility in network simplicity and control. It is characterized by logical centralization, improving control, and data planes. Nevertheless, additional investigation is needed to fully understand the influence of flow conflict on the transfer rate variable. The present research aims to analyze the impact of flow conflict on the efficacy of the two protocols, the transmission control protocol (TCP) and the user datagram protocol (UDP), respectively, by utilizing throughput as a measure of efficiency. The measurements are verified through SDN OpenFlow networking modeling using MININET. The findings reveal a significant average alteration in transfer rate for TCP and UDP when SDN conflict rules are present, ultimately impacting network and operational efficiency.

Research on the control strategies of data flow transmission paths for MPTCP-based communication networks.

The performance of multipath transmission control protocol (MPTCP) subflow through the enhancement mechanism of the MPTCP communication is improved. When dealing with multiple MPTCP subflows occupying the same transmission path, critical issues such as selection and optimization of multipath, and efficient scheduling of available multiple tracks are effectively addressed by incorporating the technology called software defined network (SDN) that is constructed based on four key parameters, namely, network transmission bandwidth, transmission paths, path capacity, and network latency. Besides, critical equipment such as the network physical device layer and SDN controller are integrated with the four parameters. So, the network model defines the transmission control process and data information. Considering the predetermined total network bandwidth capacity to select multiple paths, the adequate bandwidth capacity is determined by defining the data transfer rate between MPTCP terminals and MPTCP servers. However, the processing latency of the OpenFlow switch and the SDN controller is excluded. The effective network transmission paths are calculated through two rounds of path selection algorithms. Moreover, according to the demand capacity of the data transmission and the supply capacity of the required occupied network resource, a supply and demand strategy is formulated by considering the bandwidth capacity of the total network and invalid network latency factors. Then, the available network transmission path from the valid network transmission path is calculated. The shortest path calculation problem, which is the calculation and sorting of the shortest path, is transformed into a clustering, Inter-Cluster Average Classification (ICA), problem. The instruction of the OpenFlow communication flow is designed to schedule MPTCP subflows. Thus, various validation objectives, including the network model, effective network latency, effective transmission paths, supply-demand strategies, ineffective transmission paths, shortest feasible paths, and communication rules are addressed by the proposed method whose reliability, stability, and data transmission performance are validated through comparative analysis with other conventional algorithms. Found that the network latency is around 20 s, the network transmission rate is approximately 10Mbps, the network bandwidth capacity reaches around 25Mbps, the network resource utilization rate is about 75%, and the network swallowing volume is approximately 3M/s.

A trust-aware openflow switching framework for software defined networks (SDN)

Software Defined Networks (SDN) and Network Function Virtualisation (NFV) are prime driving technologies behind 5G and Beyond 5G (B5G) communications. The network control intelligence segregation in the SDN infrastructure enables dynamic network features (such as dynamic end-to-end management of security and quality of service (QoS)) offering significantly improved network performance. Even if one assumes that the centralised SDN controller can be security hardened and hence can be trusted, a fundamental challenge in such networks is that the data plane and switching devices are susceptible to cyberattacks. A malicious adversary can compromise them during run-time making them unreliable for secure and trusted communications. Furthermore, the controller communicating with OpenFlow switching devices is unable to accurately assess the state of the switching devices, which serves as the communication base for NFVs in 5G networks. Vulnerable switching devices can put the whole 5G network infrastructure at risk. Hence, there is a clear need for the controller and the management layer to determine the trustworthiness of the switching devices at run-time. The current trend is for many such devices to deploy trusted computing functionality such as Trusted Platform Module (TPM) or Software Guard Extension (SGx) to achieve local as well as remote attestation. In this paper, we present a dynamic trust management framework for evaluating the trustworthiness of the OpenFlow switching devices deployed in the SDN based networks. We formulate device properties that need to be assessed to determine the trust status of the device. We develop a trust enhanced security architecture which can be used to evaluate the trustworthiness of devices and determine their deployment in the provision of network services. The proposed framework uses subjective logic based techniques to derive trust levels of the switching devices at run-time, which are then used by the architecture to make trust enhanced decisions on the provision of network services. A prototype implementation of the proposed architecture is described, which demonstrates how the trustworthiness of the OpenFlow devices are assessed at run-time. The paper concludes with the performance and security analysis of the implemented trust enhanced architecture services.

Real-Time IoV Task Offloading through Dynamic Assignment of SDN Controllers: Algorithmic Approaches and Performance Evaluation

Task offloading in Internet of Vehicles (IoV) is very crucial. The widespread use of IoT applications frequently interacts with the cloud, thereby increasing the load on centralized cloud controllers. Centralized network management in cloud infrastructure is not feasible for the latest IoT trends. Decentralized and decoupled network management in Software Defined Networks (SDN) can enhance IoV services. SDN and IoV coupling can better handle task offloading in ubiquitous and dynamic IoV environments. However, appropriate SDN controller assignment and allotment strategies play a prominent role in IoV communication. In this study, we developed algorithms for SDN controller assignment and allotment namely 1) Next Fit Allotment and Assignment of SDN Controller in IoV (NFAAC), 2) Dynamic Bin Packing Allotment and Assignment of SDN Controller in IoV (DBPAAC), and 3) Dynamic Focused and Bidding Allotment and Assignment algorithm of SDN Controller in IoV (DFBAAC). These algorithms were simulated using open-flow switch controllers. The controllers were modeled as Road Side Units (RSU) that can allocate bandwidth and resource requirements to vehicles on the road. Our results show that our proposed algorithm works efficiently for SDN controller assignment and allocation, outperforming the existing work by a significant improvement of 13.5%. The working of the proposed algorithms are verified, tested, and analytically presented in this study.

Software defined networking agent demonstration to enable configuration and management of XGS-PON architectures

This paper describes the design and implementation of an OpenFlow software defined network (SDN) agent that manages and configures 10-gigabit-capable symmetric passive optical network (XGS-PON) architectures. Acting as an OpenFlow switch, the SDN agent communicates with an SDN controller using OpenFlow, while holding direct communication with the optical line terminal (OLT) through the chipset manufacturer-specific application programming interface, eliminating the need for emulating SDN layers in hardware devices. The proposal was evaluated through experiments conducted on a White Box XGS-PON OLT using the Open Network Operating System. The results demonstrate that the proposal facilitates a real-time SDN configuration of various Internet services, successfully fulfilling different quality of service requirements. Due to its ease of deployment, low complexity, smooth learning curve, scalability, and flexibility in integrating services, the proposal has significant potential. As a result, it offers a rapid SDN solution for configuring and testing new functionalities with minimal programming changes required in specific layers of the developed SDN agent.

Comparison of three common software-defined network controllers

<p>The software-defined network (SDN) controller adds and removes the contents of the flow table through secure channels to determine how packets are processed and how the flow table is managed. The controller pays attention to network intelligence and becomes the middle part, where the network manages the transfer data of the aircraft delivered via the OpenFlow (OF) switch. To this end, the controller provides an interface for managing, controlling, and managing this switch flow table. Run tests to calculate controller throughput and latency levels and test using the cbance tool, which can test transmission control protocol (TCP) and user datagram protocol (UDP) protocols. The tests are run by forcing the controller to run at maximum without any additional settings (default settings) in order to use the correct information about the controller’s capabilities. Because of this need, you need to test the performance of your controller. In this study, the tests were run on three popular controllers. Test results show that flowed controllers are more stable than open network operating dystem (ONOS) and open daylight (ODL) controllers in managing switch and host loads.</p>

Hypertext transfer protocol performance analysis in traditional and software defined networks during Slowloris attack

<p>The extensive use of the internet has resulted in novel technologies and protocol improvisation. Hypertext transfer protocol/1.1 (HTTP/1.1) is widely adapted on the internet. However, HTTP/2 is found to be more efficient over transport control protocol (TCP). The HTTP/2 protocol can withstand the payload overhead when compared to HTTP/1.1 by multiplexing multiple requests. However, both the protocols are highly susceptible to application-level denial of service (DoS) attacks. In this research, a slow-rate DoS attack called Slowloris is detected over Apache2 servers enabled with both versions of HTTP in traditional networks and software defined networks (SDN). Server metrics such as server connection time to the webpage, latency in receiving a response from the server, page load time, response-response gap, and inter-packet arrival time at the server are monitored to analyze attack activity. A Monte Carlo simulation is used to estimate threshold values for server connection time and latency for attack detection. This work is implemented in a lab environment using virtual machines, Ryu controller, zodiac FX OpenFlow switch and Apache2 servers. This study also highlights SDN's security benefits over traditional networks.</p>

An intelligent system to detect slow denial of service attacks in software-defined networks

<span lang="EN-US">Slow denial of service attack (DoS) is a tricky issue in software-defined network (SDN) as it uses less bandwidth to attack a server. In this paper, a slow-rate DoS attack called Slowloris is detected and mitigated on Apache2 and Nginx servers using a methodology called an intelligent system for slow DoS detection using machine learning (ISSDM) in SDN. Data generation module of ISSDM generates dataset with response time, the number of connections, timeout, and pattern match as features. Data are generated in a real environment using Apache2, Nginx server, Zodiac FX OpenFlow switch and Ryu controller. Monte Carlo simulation is used to estimate threshold values for attack classification. Further, ISSDM performs header inspection using regular expressions to mark flows as legitimate or attacked during data generation. The proposed feature selection module of ISSDM, called blended statistical and information gain (BSIG), selects those features that contribute best to classification. These features are used for classification by various machine learning and deep learning models. Results are compared with feature selection methods like Chi-square, T-test, and information gain.</span>

MEASURING THE PERFORMANCE OF THE OPENFLOW CONTROLLER IN THE EXPERIMENTAL SAMPLE OF THE NETWORK

The OpenFlow protocol is the main technology formed among the first concepts of software-defined systems. This technology makes it possible to develop external software shells necessary for increasing the functionality of switching, routing and information processing processes, not depending on modern equipment and firmware versions and formed separately by an external controller. One of the main tasks of the work that needs to be done is to study changes in packet delays on the FloodLight controller, which does not have a flow table of the OpenFlow switch. In addition, it is necessary to find out the packet loss in the experimental network sample in the Mininet virtual environment. The study was conducted using some modern tools and technologies, and an analysis of the domain and requirements was previously carried out. Based on the results obtained experimentally, some conclusions were drawn and some recommendations on the use of the OpenFlow protocol in early stages of development for small networks were made.

Leveraging Software-Defined Networking for a QoS-Aware Mobility Architecture for Named Data Networking

The internet’s future architecture, known as Named Data Networking (NDN), is a creative way to offer content-based services. NDN is more appropriate for content distribution because of its special characteristics, such as naming conventions for packets and methods for in-network caching. Mobility is one of the main study areas for this innovative internet architecture. The software-defined networking (SDN) method, which is employed to provide mobility management in NDN, is one of the feasible strategies. Decoupling the network control plane from the data plane creates an improved programmable platform and makes it possible for outside applications to specify how a network behaves. The SDN is a straightforward and scalable network due to its key characteristics, including programmability, flexibility, and decentralized control. To address the problem of consumer mobility, we proposed an efficient SDPCACM (software-defined proactive caching architecture for consumer mobility) in NDN that extends the SDN model to allow mobility control for the NDN architecture (NDNA), through which the MC (mobile consumer) receives the data proactively after handover while the MC is moving. When an MC is watching a real-time video in a state of mobility and changing their position from one attachment point to another, the controllers in the SDN preserve the network layout and topology as well as link metrics to transfer updated routes with the occurrence of the handoff or handover scenario, and through the proactive caching mechanism, the previous access router proactively sends the desired packets to the new connected routers. Furthermore, the intra-domain and inter-domain handover processing situations in the SDPCACM for NDNA are described here in detail. Moreover, we conduct a simulation of the proposed SDPCACM for NDN that offers an illustrative methodology and parameter configuration for virtual machines (VMs), OpenFlow switches, and an ODL controller. The simulation result demonstrates that the proposed scheme has significant improvements in terms of CPU usage, reduced delay time, jitter, throughput, and packet loss ratio.

RETRACTED ARTICLE: Detecting distributed denial of service (DDoS) in SD-IoT environment with enhanced firefly algorithm and convolution neural network

The Internet of Things (IoT) devices have become part of today’s human life and the amplified use of smart phones as well as number of IoT devices in everyday life has made network security more important. These IoT devices are less secure and often abandoned making them a easy target of DDoS attacks which caused by extreme network packet flow threaten vital network services. The DoS is a single-server attack in which the DDoS is a multi-server attack and IoT devices are managed through Software-defined networks (SDN). This research is proposed to improve the Firefly method in optimizing the Convolution neural network (CNN) for detecting DDoS attacks in Software Defined-IoT (SD-IoT). The suggested SD-IoT framework has been structured into three layers, namely application layer, control layer and user infrastructure layer. The SDN-IoT architecture layer model, Security apps identify DDoS attack in Application layer C-DAD attack detection. The second layer manages the SD-IoT network with the SDNWISE controller and the IoT controller. The infrastructure layer contains SOFS (Sensor Open Flow Switch) and IoT devices. However, this proposal has considered each firefly as a single hyperparameter and by updating the position of firefly periodically results in the reduction of the search iteration. Hence, the proposed model is evaluated by Root mean square and used for measuring the training accuracy of the proposed model. DDoS attacks use a backtracking technique to pinpoint the source, which increases response time. Four CNN models by varying layers and parameters has implemented to improve DDoS detection yielded results with 98% accuracy.

Flow-based intrusion detection on software-defined networks: a multivariate time series anomaly detection approach

In this study, we present and implement the SAnDet (SDN anomaly detector) architecture, an anomaly-based intrusion detection system designed to take advantage of the capabilities offered by software-defined networking (SDN) architecture, as a controller application. The SAnDet system is composed of three modules: statistics collection, anomaly detection, and anomaly prevention. In particular, we utilize replicator neural networks (RNN), which is a specialized variant of the autoencoder, and the LSTM-based encoder–decoder (EncDecAD) method, which is a special type of long short-term memory (LSTM) network that has demonstrated a strong performance on data series particularly, to identify unknown attacks using flow features collected from OpenFlow switches. In our experiments, we utilize flow-based features extracted from network traffic data containing various types of attacks as input to our models in the form of time series. We evaluate the performance of our methods using the accuracy and area under the receiver operating characteristic curve (AUC) metrics. Our experimental results demonstrate that EncDecAD outperforms RNN and that our approach offers several benefits over previously conducted research.

Awareness and Impact of GST among Small Business Owners: A Study with Special Reference to Mysuru City, Karnataka

The transferring of the information from the source port to the destination port plays a vital role in our day to day life. The data which is confidential should be send in a platform where the exact data without any loss is received. The insufficient poor quality of data can have a negative impact on real time data processing. The data transmission path should be selected in such a way that the entire data should be received for the usage without any loss in the network link. The data should be received with the accuracy and with less delay. In this way a technology called Software Defined Networking (SDN) plays an important role in managing and controlling the various network conditions. In this way, an approach is being designed in this paper where SDN technology is being used to transfer the data with an appropriate path in order to receive the exact data. It is an application based approach so that the patient medical data is being send using SDN technology. Key Words: SDN technology, OpenFlow switch, Dijsktra’s Algorithm, Hyper Text Transfer Protocol

DDoS ATTACK DETECTION METHODS BASED ON DEEP LEARNING IN HEALTHCARE

Software-defined network (SDN) is a new network structure, which has the characteristics of centralized management and programmable, and is widely used in the field of Internet of things. Distributed denial of service (DDoS) attack is one of the most threatening attacks in SDN network. How to effectively detect DDoS attacks has become a research hotspot in the field of SDN security management. Aiming at the above problems, this paper proposes a DDoS attack detection method based on Deep belief network (DBN) in SDN network architecture. By extracting the characteristics of OpenFlow switch flow table entries, DBN algorithm is trained to detect whether there are DDoS attacks. The experimental results show that the method is better than the other algorithms in accuracy, precision and recall.

Enhancing Software-Defined Networks with Intelligent Controllers to Improve First Packet Processing Period

Software-Defined Networking (SDN) has a detailed central model that separates the data plane from the control plane. The SDN controller is in charge of monitoring network security and controlling data flow. OpenFlow-enabled routers and switches work as packet-forwarding devices in the network system. At first, OpenFlow forwarding devices like routers and switches do not know how to handle the data packets transmitted by the host. This is because they do not have any security controls, policies, or information. These packets are sent to their destination. In this situation, the OpenFlow forwarding device sends the first data packet of a host to the SDN controller, which checks the control packets for the data packet and creates flow entries in the switch flow table to act on the following categories of data packets coming from the host. These activities at the SDN controller and switch levels are time-intensive, and the first data packet from the host always takes a longer time to reach its destination. In this article, we suggest an SDN controller with instant flow entries (SDN-CIFE) to reduce the amount of time it takes for the host to transmit its first data packet. Before traffic comes from the host, our method adds the necessary flow entries to the flow table of the OpenFlow switch. The technique was made in Python and tested on a Mininet network emulator using the RYU controller. The results of the experiment show that the time it takes to process the first data packet is reduced by more than 83%.

Метод комплексного контроля передачи трафика в программно-конфигурируемых сетях

Modern requirements for traffic processing should possess the properties of mobility, speed, and simplification of network equipment administration. However, the existing classical Ethernet networks with Quality of Service failed to meet these requirements, which led to the emergence of software defined networks (SDN). In SDN, the main protocol is OpenFlow, which enables processing and managing heterogeneous traffic. This article aims to propose a methodology for eliminating the disadvantages inherent in the OpenFlow protocol. A method for complex control of traffic transmission in SDN was developed based on the algorithm of early diagnosis of real-time traffic losses during the transmission of heterogeneous traffic in the OpenFlow switch and the algorithm of real-time traffic transmission using a scheduler and a delivery control function in SDN. Moore digital automata of the proposed transmission algorithms were developed. A description of systems of canonical equations and output functions for digital automata was presented. Tables of transitions of digital automata were constructed, states of digital automata were encoded, and digital automata were synthesized based on D-triggers. The formalization of the developed method and algorithms of traffic transmission in SDN based on digital automata made it possible to design control automata and algorithms on FPGA of the Spartan 6 family and later familie.

Simulation and analysis models of hybrid software­configured devices

The analysis of the algorithm, based on which the simulation and analytical model of the hybrid software-configurable device is automatically synthesized, was carried out. The solution for modeling OpenFlow equipment was also considered, and an original OpenFlow switch model was developed, which is distinguished by the ability to manage delays based on the results of its mathematical model. The operation scheme of a hybrid switch that supports both traditional switching and OpenFlow switching has been developed. This scheme allows solving complex tasks in the physical infrastructure of virtualized networks. A module has been developed to create a realistic delay and limit the capacity and performance of the hybrid switch model, which can work according to the data obtained as a result of the experimental study. Additional traffic processing schemes have been developed for a more detailed implementation of the hybrid software-configurable equipment model. The basic model of the switch presented in the INET OMNeT++ framework is considered. The switch is represented by a set of modules interacting through the OMNeT transmission system. The most detailed modules of Ethernet interfaces are implemented, in particular, there are implementations of the input queue of the Tail-Drop type, output queues of the FIFO, RED, WRED, PQ, CBFQ types, as well as the implementation of the transmission delay on the line. The virtualization technology of network functions, which is built on the basis of software-configured networks, has been studied, and the most popular Linux-based solutions are used as a software-controlled Open vSwitch switch. The considered methods of forming a model of such a switch. Open vSwitch is architecturally different from both classical and OpenFlow real switches, as there are no dedicated packet refactoring units (except for network cards with hardware header processing and FPGAs), dedicated memory and processors for switching, Open vSwitch uses a kernel module (or module DPDK for direct transmission without the participation of the kernel) to transmit packets based on information from the OVSDB database or OpenFlow tables.