P4 Switch Research Articles

Cross-layer detection and defence mechanism against DDoS and DRDoS attacks in software-defined networks using P4 switches

This paper presents a comprehensive system for detecting and defending against distributed denial-of-service (DDoS) and distributed reflective denial-of-service (DRDoS) flood attacks in software-defined networking (SDN) environments using Programming Protocol-Independent Packet Processors (P4). The proposed system introduces a hybrid intrusion statistical threshold algorithm (HISTA) that analyzes intrusion data statistics to identify potential malicious attacks. Upon detection, the system utilises P4 programmability to implement a custom defence mechanism on the P4 switch. A novel Uruk protocol header collaborates with HISTA for enhanced cross-layer attack detection and categorisation. The HISTA-Uruk mechanism selectively discards malicious packets while ensuring uninterrupted communication for legitimate packets, effectively preventing DDoS/DRDoS attacks. Extensive experiments validate the system’s ability to efficiently detect and thwart various DDoS, DRDoS, and internal attacks, demonstrating its effectiveness in identifying threats and restoring impacted network connections across diverse attack scenarios.

Prioritization and offloading in P4 switch integrated with NFV

Prioritization and offloading in P4 switch integrated with NFV

P4httpGuard: detection and prevention of slow-rate DDoS attacks using machine learning techniques in P4 switch

P4httpGuard: detection and prevention of slow-rate DDoS attacks using machine learning techniques in P4 switch

Collaborative Defense Against Hybrid Network Attacks by SDN Controllers and P4 Switches

Collaborative Defense Against Hybrid Network Attacks by SDN Controllers and P4 Switches

Empowering In-Network Classification in Programmable Switches by Binary Decision Tree and Knowledge Distillation

Given the high packet processing efficiency of programmable switches (e.g., P4 switches of Tbps), several works are proposed to offload the decision tree (DT) to P4 switches for in-network classification. Although the DT is suitable for the match-action paradigm in P4 switches, the range match rules used in the DT may not be supported across devices of different P4 standards. Additionally, emerging models including neural networks (NNs) and ensemble models, have shown their superior performance in networking tasks. But their sophisticated operations pose new challenges to the deployment of these models in switches. In this paper, we propose Mousikav2 to address these drawbacks successfully. First, we design a new tree model, i.e., the binary decision tree (BDT). Unlike the DT, our BDT consists of classification rules in the form of bits, which is a good fit for the standard ternary match supported by different hardware/software switches. Second, we introduce a teacher-student knowledge distillation architecture in Mousikav2, which enables the general transfer from other sophisticated models to the BDT. Through this transfer, sophisticated models are indirectly deployed in switches to avoid switch constraints. Finally, a lightweight P4 program is developed to perform classification tasks in switches with the BDT after knowledge distillation. Experiments on three networking tasks and three commodity switches show that Mousikav2 not only improves the classification accuracy by 3.27%, but also reduces the switch stage and memory usage by 2.00 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\times$</tex-math> </inline-formula> and 28.67%, respectively. Code is available at https://github.com/xgr19/Mousika.

P4toNFV: Offloading from P4 switches to NFV in programmable data planes

SummaryP4 combines the benefits of hardware‐based networking with the adaptability of software‐based network operations. However, when faced with intricate network functions, P4 switches reveal constraints in memory and processing primitives. To address these, we advocate offloading traffic demanding intricate processing from the programmable data plane to network function virtualization (NFV). By leveraging this approach, P4 switches handle the core data plane, ensuring maximum performance, whereas virtualized network functions (VNF) cater to the intricate processing. Central to our research is the optimization of this offloading process, specifically considering delay constraints. We developed an analytical model that examines a P4 switch overseen by an SDN controller, integrating an offloading capability to NFV. The principal objective was to determine an offloading rate that minimizes packet processing delay. To this end, we employed a Bounded method, an advancement from Brent's method, to determine this optimal rate. The findings indicate that offloading approximately 66% of packets to the VNF achieves the lowest total delay, registering at 0.1505 s. This strategy of optimal offloading can notably reduce the system's average delay as the demand for network functions increases. The optimization technique we adopted exhibited rapid convergence in our experiments, reflecting the method's efficacy. Furthermore, a rigorous parametric sensitivity analysis spanning no offloading, full offloading, and optimal offloading strategies underscores that optimal offloading to NFV consistently augments system performance, particularly in terms of delay reduction. Conclusively, our study furnishes valuable insights into offloading strategies, augmenting the narrative on resource allocation in both PNFs and VNFs.

P4SQA: A P4 Switch-Based QoS Assurance Mechanism for SDN

Data center networks include a wide variety of service categories, which leads to a complex network topology. As a result, the QoS of different service flows cannot be guaranteed. In this paper, we propose a QoS assurance mechanism based on P4 switches (P4SQA) to make full use of network resources. P4SQA includes two functions: in-network traffic classification and in-network queue management. To reduce the communication overhead and computational pressure on the Software Defined Network (SDN) controller, we offload part of the neural computation from the control plane to the data plane. A fully connected neural network-based traffic classification method is deployed in the programmable data plane to classify different traffic types. In addition, the optimized active queue management algorithm CoDeL is integrated into the P4 switch (PCoDeL) to prevent network congestion while guaranteeing QoS more effectively. The evaluation results show that traffic classification accuracy has improved, especially in terms of the F1_score, which reached 0.97, significantly better than other state-of-the-art methods. Moreover, compared to traditional queue management algorithms, PCoDeL can improve network throughput and reduce transmission delay, which verifies the effectiveness and superiority of P4SQA in ensuring QoS.

Programmable Name Obfuscation Framework for Controlling Privacy and Performance on CCN

Consumer privacy leakage from data names poses a serious threat to Content-Centric Networking (CCN) networks. Obfuscating names is a promising countermeasure, and anonymizers with deterministic encryption schemes have been proposed to provide data privacy while enabling CCN features, such as in-network caching. Existing studies assume a weak threat model in which anonymizers are honest, and their obfuscation schemes are not resilient against privacy attacks such as name guessing attacks. This paper designs a name obfuscation framework based on the realistic assumption that anonymizers are semi-honest. The framework strengthens data privacy using multiple keys and separates obfuscation for prefixes and suffixes, and is implemented on a P4 switch to provide Tbps forwarding speed.

Runtime Verification for Programmable Switches

We introduce a runtime verification framework for programmable switches that complements static analysis. To evaluate our approach, we design and develop, a runtime verification system that automatically detects, localizes, and patches software bugs in P4 programs. Bugs are reported via a violation of pre-specified expected behavior that is captured by . is based on machine learning-guided fuzzing that tests P4 switch non-intrusively, i.e., without modifying the P4 program for detecting runtime bugs. This enables an automated and real-time localization and patching of bugs. We used a prototype to detect and patch existing bugs in various publicly available P4 application programs deployed on two different switch platforms, namely, behavioral model (bmv2) and Tofino. Our evaluation shows that significantly outperforms bug detection baselines while generating fewer packets and patches bugs in large P4 programs, e.g., switch.p4 without triggering any regressions.

P4SGD: Programmable Switch Enhanced Model-Parallel Training on Generalized Linear Models on Distributed FPGAs

Generalized linear models (GLMs) are a widely utilized family of machine learning models in real-world applications. As data size increases, it is essential to perform efficient distributed training for these models. However, existing systems for distributed training have a high cost for communication and often use large batch sizes to balance computation and communication, which negatively affects convergence. Therefore, we argue for an efficient distributed GLM training system that strives to achieve linear scalability, while keeping batch size reasonably low. As a start, we propose P4SGD, a distributed heterogeneous training system that efficiently trains GLMs through model parallelism between distributed FPGAs and through forward-communication-backward pipeline parallelism within an FPGA. Moreover, we propose a light-weight, latency-centric in-switch aggregation protocol to minimize the latency of the AllReduce operation between distributed FPGAs, powered by a programmable switch. As such, to our knowledge, P4SGD is the first solution that achieves almost linear scalability between distributed accelerators through model parallelism. We implement P4SGD on eight Xilinx U280 FPGAs and a Tofino P4 switch. Our experiments show P4SGD converges up to 6.5X faster than the state-of-the-art GPU counterpart.

ConPoolUBF: Connection pooling and updatable Bloom filter based SYN flood defense in programmable data planes

SYN flood attack is one of the common ways in which attackers take the advantage of TCP’s three-way handshake connection establishment to overwhelm target systems. With the emergence of programmable networks, many promising security functions have been implemented at the network layer. SYN authentication and cookie-based SYN proxy are two significant approaches recommended on programmable switches against SYN flood attacks. However, while the implementation of a cookie-based SYN proxy causes additional delays and packet drops, the SYN authentication approach increases the number of packets required to establish a TCP connection. In this study, two novel functions are implemented on programmable switches using the P4 language, and a new security solution against SYN flood attacks is proposed by combining both functions. The first function is the high-accuracy updatable Bloom filters implemented to track the state of network flows for TCP connection establishment. As the proposed data structure uses a salted input, it is more resistant to target-set coverage attacks. The second is the connection pooling function on programmable switches for requests to the backend servers. In this regard, the TCP three-way handshake is offloaded from the target systems to network switches. Upon the verification of a connection request, dynamic resource allocation is carried out from the connection pool on the P4 switch, enabling the client to connect to the server seamlessly and transparently without the need for additional packets. We implement these functions and demonstrate their feasibility as an effective defense against SYN flood.

Offloading in P4 Switch Integrated with Multiple Virtual Network Function Servers

Offloading in P4 Switch Integrated with Multiple Virtual Network Function Servers

Enabling P4 Network Telemetry in Edge Micro Data Centers With Kubernetes Orchestration

Integrating computation resources with networking technologies is an hot research topic targeting the optimization of containers deployment on a set of host machines interconnected by a network infrastructure. Particularly, next generation edge nodes will offer significant advantages leveraging on integrated computation resources and networking awareness, enabling configurable, granular and monitorable quality of service to different micro-services, applications and tenants, especially in terms of bounded end-to-end latency. In this regard, SDN is a key technology enabling network telemetry and traffic switching with the granularity of the single traffic flow. However, currently available solutions are based on legacy SDN techniques, not enabling the matching of tunneled traffic, and thus require a tricky integration inside the hosts where containers are deployed. This work considers Kubernetes clusters deployed on next generation edge micro data center platforms and proposes an innovative SDN solution exploiting the P4 technology to gain visibility inside tunnelled traffic exchanged among pods. This way, the integration is achieved at the control plane level through the communication between Kubernetes and the SDN controller. The proposed solution is experimentally validated including a comprehensive framework enabling effective traffic switching and in-band telemetry at pod level. The major paper contributions consist in the design and the development of: (i) the networking applications at SDN control plane level; (ii) the P4 switch pipeline at the data plane level; (iii) the monitoring system used to collect, aggregate and elaborate the telemetry data.

Synchronizing DDoS defense at network edge with P4, SDN, and Blockchain

Botnet-originated DDoS attacks continue to plague the internet and disrupt services for legitimate users. While various proposals have been presented in the last two decades, the botnet still has advantages over the defenders, because botnets have orchestrated processes to launch disruptive attacks. On the other hand, the defenders use manual methods, siloed tools, and lack orchestration among different organizations. These unorchestrated efforts slow down the attack response and extend the lifespan of botnet attacks. This article presents shieldSDN and shieldCHAIN, an inter-organization collaborative defense framework using P4, SDN , and Blockchain , which extends our earlier research on microVNF, a solution of Edge security for SIP-enabled IoT devices with P4. Besides mitigating DDoS attacks, microVNF also produces attack fingerprints called Indicator of Compromise (IOC) records. ShieldSDN and shieldCHAIN distribute these IOCs to other organizations so that they can create their own packet filters . Effectively, shieldSDN and shieldCHAIN synchronize packet filters for different organizations to mitigate against the same botnet strain. Four experiments were performed successfully to validate the functionalities of shieldSDN and shieldCHAIN. The scope for the first experiment was intra-company, while the second, third, and fourth experiments were inter-company. In the first experiment, shieldSDN extracted IOCs from the source switch and installed these as packet filters on other switches within the same organization (in the U.S.). In the second experiment, the shieldCHAIN in the publishing organization (in the U.S.) shared IOCs by posting them to the Blockchain. In the third experiment, the shieldCHAIN in the subscriber organizations (in Singapore & the U.K.) retrieved these IOCs from Blockchain. Finally, in the last experiment, the shieldCHAIN in the subscriber organizations installed the retrieved IOCs as packet filters; that are identical to those in the originating organization. To the best of our knowledge, this is the first framework that uses the P4 switch, SDN controller, and Blockchain together for this use case. As SDN and Blockchain gain acceptance, this framework empowers community members to collaborate and defend against botnet DDoS attacks.

Latency control in service chaining using P4-based data plane programmability

Service chaining is becoming one of the most considered service deployment frameworks in the context of Network Function Virtualization (NFV) in edge and data center environments, conveniently supported by automatic connectivity configurations offered by Software Defined Networking (SDN). Current research on the topic is focusing on how to guarantee Quality of Service (QoS) in terms of guaranteed end-to-end latency for time critical services. Indeed, latency issues may depend on intra-server virtualization inefficiencies, leading to Virtual Network Function (VNF) delivery delays, or by congestion events occurring at intermediate network elements connecting VNFs. Latency control requires stateful information such as flow delay measurements at a per-packet level, typically not available at traditional SDN switches or inside the VNF. This paper proposes the adoption of SDN data plane programmability exploiting the P4 language and presents two P4 pipeline solutions, suitable for both intra-rack and inter-rack service chain deployments, to automatically check the path latency experienced by selected high priority flows, also resorting to the recent in-band telemetry applications. The programmable pipelines enforce proactive in-network functions, such as priority change or drop actions, in order to guarantee a bound SFC segment latency delivery, including both the network and the segment VNFs. The proposed solutions are implemented and evaluated in a network testbed employing programmable software switches showing their effectiveness in guaranteeing the configured end-to-end latency, and the limited effort in terms of additional processing at the P4 switch. The evaluation is carried out using the reference P4 software switch, i.e., BMv2. The aim is to validate the full P4 capabilities and the code feasibility in terms of scalability, load and resource impact and added intra-switch latency. The experimental results show the proposed approach scales with the number of forwarded flows and achieves per-segment latency control enforcement in both congested and non-congested scenarios with a very limited impact on the switch extra-latency, exploiting finer per-packet tuning of drop and priority change simply applicable through flow entry configuration. Applicability analysis on hardware switches guaranteeing line rate performance are provided.

P4-TINS: P4-Driven Traffic Isolation for Network Slicing With Bandwidth Guarantee and Management

Network slicing is an essential technology for 5G mobile networks. It partitions network resource logically into multiple isolated slices, each of which can satisfy a suite of network requirements for one specific service. However, it cannot be fulfilled by the current SDN (Software-Defined Networks), since the conventional SDN data-plane technology, OpenFlow, is not flexible enough to offer fine-grained network resource control or queue/packet scheduling. It leads to many research studies developing corresponding solutions on programmable switches. In this work, we focus on the support of the bandwidth guarantee and management for network slices. Although several studies with the similar goal have been proposed, they do not consider interference among different flow types or use the built-in meter for easy deployment on COTS (Commercial Off-The-Shelf) P4 switches. To this end, we first conduct a case study to examine the interference cases. We then propose a solution, designated as P4-TINS (P4-driven Traffic Isolation for Network Slicing), to resolve the interference by isolating different types of traffic flows in priority queues and set the P4 switch’s bucket size based on the time granularity of its bandwidth management operation. It cannot only ensure the guaranteed bandwidth for each slice but also enable coexistent slices to fairly share residual bandwidth. We have confirmed its effectiveness experimentally based on our prototype over an ONOS (Open Network Operating System) controller and a COTS P4 switch.

Coordinate-based efficient indexing mechanism for intelligent IoT systems in heterogeneous edge computing

Powered by edge servers (also called as edge nodes) which are close to the data source, distributed edge AI processes the huge amounts of data generated by Internet of Things (IoT) devices, extracting value for users. In edge computing, massive data are stored in several distributed edge nodes with heterogeneous capabilities. Intelligent applications running on one edge node may need data from other edge nodes. An efficient data indexing mechanism can rapidly locate the edge node where the data is kept, supporting latency-sensitive intelligent applications. The existing indexing methods in edge computing assume that all edge nodes are the same in capability and the number of edge nodes is constant. This paper proposes CREIM, a coordinate-based efficient indexing mechanism for intelligent IoT systems in heterogeneous edge computing. CREIM achieves fair load balancing on edge nodes with heterogeneous capabilities. The indexing mechanism deals well with the horizontal scaling of edge nodes. Besides, CREIM addresses a fast lookup with one overlay hop, providing low latency data retrieval for edge intelligent applications. In the experiments, CREIM is applied in a realistic network simulated by the mininet and the routing forwarding is supported by the P4 switch. The experiments are constructed by combining real location datasets of Shanghai Telecoms base stations with the real-collected requests of end-devices. The experimental results demonstrate that CREIM achieves a near-optimal latency of index-lookup, adapts the heterogeneous capabilities among edge nodes and reduces the cost of increasing/decreasing edge nodes by 56.36% compared with the state-of-the-art method.

Multi-domain network infrastructure based on P4 programmable devices for Digital Data Marketplaces

There are many organizations interested in sharing data with others, and they can do this only if a multi-domain secure platform is available. Such platforms, often referred to as Digital Data Marketplaces (DDMs), require that all the transactions follow the pre-defined policies that are established by the participating parties i.e, domains. However, building a multi-domain network infrastructure in which each domain can manage its own connectivity while at the same time all of the transactions follow the sharing agreements is still a challenge. In this paper, we introduce a multi-domain containerized DDM that is built upon a P4-based network. It can handle the communication of multiple domains and guarantee that the operation of transactions is based on the pre-defined policies. We also studied the setup performance by defining a model which we demonstrated follows the real measurements, and we can use for decision making. The results also show the low overhead of using P4 switch in network setup time. In addition, we conducted a security evaluation which showed that our P4-based network setup is secure against most types of attacks.

Dynamic Traffic Engineering Considering Service Grade in Integrated Service Network

This study proposes a dynamic traffic engineering method to improve network resource utilization efficiency without affecting important services in an integrated service network where multiple grades of service are accommodated. Network resource utilization is biased over time because future fluctuations in traffic demand are unpredictable. Although a service network provider prefers to re-optimize network resource utilization using a dynamic traffic engineering, it is often superfluous for users who do not want their mission-critical communications, for example, executive web meetings or online surgery, to be affected. Therefore, we classified traffic into very important packets and commoners, and only commoners were dynamically optimized. To classify traffic, we assigned the identifier to a packet on the application side. In this approach, only the application and edge nodes of the network required modification; the core network routers were unaffected. Furthermore, we established the architecture of the edge node using a software-defined network controller and P4 switch. We also provided an algorithm for optimization based on linear programming and demonstrated that it is possible to improve network resource utilization efficiency without affecting very important packets and that the computational and memory costs are practical.

Tabular Interpolation Approach Based on Stable Random Projection for Estimating Empirical Entropy of High-Speed Network Traffic

The empirical entropy of the network flow attributes is an essential measure for identifying anomalous network traffic. However, computing the exact entropy values for high-speed networks in real-time is computationally expensive. Accordingly, the present study replaces the complex computations of existing stable random projection methods for entropy estimation with a simple table lookup procedure. Notably, the size of the lookup table is reduced through a piece-wise linear interpolation heuristic in order to facilitate the implementation of the proposed scheme in resource-constrained pipeline environments. The proposed architecture enables entropy estimation to be performed using both the Log-Mean Estimator (LME) method and the New Estimator of Compressed Counting (NECC) algorithm reported in the literature. The feasibility of the proposed approach is verified empirically using both real-world network traffic traces and synthetic data streams. Moreover, the practical applicability is demonstrated via stream-based implementation in the programmable data planes of the NetFPGA-Plus framework and a Tofino P4 switch, respectively. The results indicate that the proposed tabulation-based entropy estimation scheme allows minimum-sized Ethernet frames to be processed with a wire speed of up to several hundred gigabits per second.