Software Defined Networking Paradigm Research Articles

EN-LAKP: Lightweight Authentication and Key Agreement Protocol for Emerging Networks

Emerging network technologies that will be developed and implemented in the next generation to enhance computing facilities are Wireless Sensor Networks (WSNs) and Software Defined Networking (SDN). Since micro-electromechanical system (MEMS) technology progress, WSNs become more and more popular since they offer realistic and affordable real- time monitoring options. As a result, as network traffic and the variety of sensor nodes rise, the SDN paradigm is being integrated into WSN to avoid a performance bottleneck with traditional network design. Since the sensor nodes are dispersed throughout a hostile environment and they communicate over a public channel, the information shared between entities is vulnerable to attack. The proposed protocol illustrated why it made sense to provide network administration and control responsibilities to centralized SDN controller nodes. We thus offer the Lightweight Authentication and Key Agreement Protocol (LAKP) for SDN-enabled WSNs to protect entity communication. Furthermore, we demonstrate that the suggested solution avoids known security vulnerabilities by doing both formal and informal security examinations using the Scyther tool and Burrows-Abadi-Needham (BAN) logic.

[formula omitted]-LB: Software-defined IDS with UAV Resource Aware Load-Balancing in FANET disaster scenarios

In critical scenarios like natural disasters, the physical infrastructure of the network may be heavily damaged or completely torn down making difficult communications and rescue activities. In such cases, due to their nature, Unmanned Aerial Vehicles (UAVs) are usually employed to provide a temporary support network by forming a Flying Ad-Hoc Network (FANET). However, this network should be carefully monitored and safeguarded to guarantee its stability by deploying network security appliances, like Intrusion Detection Systems (IDSs). In the wake of these considerations, this paper delves into the utilization of IDS functions deployed on UAVs, named IDS-enabled UAVs, in emergencies leveraging the modern Software-Defined Network (SDN) paradigm. Specifically, the study proposes a dynamic approach to promptly activate IDS-enabled UAVs, in an SDN-FANET, responding to network traffic increasing and/or malicious activities taking place within the network. In order to achieve this objective, a Software-defined IDS with UAV Resource Aware Load Balancing strategy – SURA-LB – is proposed and implemented within the SDN controller, leveraging its programmable nature and its holistic view of the network. The SURA-LB strategy equally distributes the load among the set of IDS-enabled UAVs by considering their resources and energy utilization along with the experienced network traffic conditions. Finally, an extensive experimental campaign shows the benefits of the proposed load-balancing strategy in reducing and fairly distributing the workload among the IDS-enabled UAVs outperforming naive and baseline load-balancing strategies like Random and Round-Robin and, therefore, bolstering the resilience and the reliability of the set of IDS-enabled UAVs while the traffic to be monitored and analyzed increases.

KS-SDN-DDoS: A Kafka streams-based real-time DDoS attack classification approach for SDN environment

Software-Defined Networking (SDN) is a modern networking architecture that segregates control logic from data plane and supports a loosely coupled architecture. It provides flexibility in this advanced networking paradigm for any changes. Further, it controls the complete network in a centralized using controller(s). However, it comes with several security issues: Exhausting bandwidth and flow tables, Distributed Denial of Service (DDoS) attacks, etc. DDoS is a powerful attack for Internet-based applications and services, traditional and SDN paradigms. In the case of the SDN environment, attackers frequently target the central controller(s). This paper proposes a Kafka Streams-based real-time DDoS attacks classification approach for the SDN environment, named KS-SDN-DDoS. The KS-SDN-DDoS has been designed using highly scalable H2O ML techniques on the two-node Apache Hadoop Cluster (AHC). It consists of two modules: (i) Network Traffic Capture (NTCapture) and (ii) Attack Detection and Traffic Classification (ADTClassification). The NTCapture is deployed on the two nodes Apache Kafka Streams Cluster (AKSC-1). It captures incoming network traffic, extracts and formulates attributes, and publishes significant network traffic attributes on the Kafka topic. The ADTClassification is deployed on the two nodes Apache Kafka Streams Cluster (AKSC-2). It consumes network flows from the Kafka topic, classifies it based on the ten attributes, and publishes it to the decision Kafka topic. Further, it saves attributes with outcome to the Hadoop Distributed File System (HDFS). The KS-SDN-DDoS approach is designed and validated using the recent “DDoS Attack SDN dataset”. The result shows that the proposed system gives better classification accuracy (100%).

Priority based energy and load aware routing algorithms for SDN enabled data center network

Nowadays, to accommodate the swift expansion of cloud computing, big data, and other emerging technologies, integrating data center networks and SDN (Software Defined Network) is suggested, which also improves the network management’s convenience and flexibility. As network devices in these data centers continue to increase at a high rate, efficient route management to handle these devices’ vast amounts of data has emerged as a significant concern. This work suggests a novel admission and routing scheme considering the importance or priorities of the network flows, path energy, and routing path load. Using the SDN paradigm in DCN (Data Center Network), we first develop a Mixed Integer Linear Programming (MILP) formulation by jointly considering flow priority, path energy, and path load. The MILP formulation can maximize the number of flows as well as minimize the energy consumption and load variance in the network, or it can make a trade-off among all three. However, due to the potentially long running time, later, we introduce two greedy methods, Priority Based Energy Minimization Algorithm (PEMA) and Priority Based Evenly Load Distribution Algorithm (PEDL), where PEMA aims to maximize the flow with less energy, and PEDL focuses on maximizing the flow with reduced load variation. Finally, the developed routing strategies are implemented, and the simulation results demonstrate the out-performance of our work compared to the existing works in terms of successful flow ratio, energy savings, and load balancing.

Resource allocation for fog computing based on software-defined networks

<p><span lang="EN-US">With the emergence of cloud computing as a processing backbone for internet of thing (IoT), fog computing has been proposed as a solution for delay-sensitive applications. According to fog computing, this is done by placing computing servers near IoT. IoT networks are inherently very dynamic, and their topology and resources may be changed drastically in a short period. So, using the traditional networking paradigm to build their communication backbone, may lower network performance and higher network configuration convergence latency. So, it seems to be more beneficial to employ a software-defined network paradigm to implement their communication network. In software-defined networking (SDN), separating the network’s control and data forwarding plane makes it possible to manage the network in a centralized way. Managing a network using a centralized controller can make it more flexible and agile in response to any possible network topology and state changes. This paper presents a software-defined fog platform to host real-time applications in IoT. The effectiveness of the mechanism has been evaluated by conducting a series of simulations. The results of the simulations show that the proposed mechanism is able to find near to optimal solutions in a very lower execution time compared to the brute force method.</span></p>

Towards Effective Intrusion Detection in OpenFlow-Based SDN Architectures

This research article develops and assesses a thorough intrusion detection system (IDS) to investigate improvements in security inside Software-Defined Networking (SDN) environments. With an emphasis on packet-level analysis for the detection and mitigation of possible network intrusions, the study explores the integration of IDS features into SDN controllers. The suggested IDS is simulated and empirically assessed in a variety of network circumstances, such as traffic fluctuations, delay changes, and increased iperf scenarios, using a Mininet-based framework. The research advances our understanding of efficient intrusion detection techniques inside the SDN paradigm by providing insights into security issues and possible solutions for upcoming SDN deployments.

DINNRS: A Distributed In-Network Name Resolution System for information-centric networks

Information-Centric Networking (ICN) is a promising network paradigm designed to address the challenges arising from the inherent ambiguity of IP addresses. ICN prioritizes the content itself as the main factor in network transmission. The Name Resolution System (NRS) is the primary component of the ICN architecture, relying on flat naming. Unfortunately, existing NRS frequently encounters scalability and performance issues. In this paper, we present the Distributed In-Network Name Resolution System (DINNRS), an NRS that leverages the software-defined networking and ICN paradigm. DINNRS offers global-scale name-based routing with high scalability and minimal request delay. Additionally, we propose a modular control domain architecture for easy implementation and an enhanced marked cuckoo filter for fast resolving. Simulation experiments using the ICN emulator demonstrate that our methods result in significant performance gains, with a 61.2% reduction in data acquire latency and a 55.2% lower link load control overhead compared to MDHT.

Modeling DDOS attacks in sdn and detection using random forest classifier

ABSTRACT A Software-defined network paradigm provides flexibility and programmability to deal with the growing users of future networks. As a result of the centralized control attribute, it could be regarded as a single point of failure that is vulnerable to various forms of attacks, such as Distributed denial of service (DDOS) attacks. This study attempts to show a mathematical representation of DDOS attacks in SDN, together with how some five-tuple features contribute to the attacks. The studied features were used to detect DDOS using a random forest classifier. The result shows 96.3% detection accuracy and 96.45% precision.

AI-Enabled Traffic Control Prioritization in Software-Defined IoT Networks for Smart Agriculture.

Smart agricultural systems have received a great deal of interest in recent years because of their potential for improving the efficiency and productivity of farming practices. These systems gather and analyze environmental data such as temperature, soil moisture, humidity, etc., using sensor networks and Internet of Things (IoT) devices. This information can then be utilized to improve crop growth, identify plant illnesses, and minimize water usage. However, dealing with data complexity and dynamism can be difficult when using traditional processing methods. As a solution to this, we offer a novel framework that combines Machine Learning (ML) with a Reinforcement Learning (RL) algorithm to optimize traffic routing inside Software-Defined Networks (SDN) through traffic classifications. ML models such as Logistic Regression (LR), Random Forest (RF), k-nearest Neighbours (KNN), Support Vector Machines (SVM), Naive Bayes (NB), and Decision Trees (DT) are used to categorize data traffic into emergency, normal, and on-demand. The basic version of RL, i.e., the Q-learning (QL) algorithm, is utilized alongside the SDN paradigm to optimize routing based on traffic classes. It is worth mentioning that RF and DT outperform the other ML models in terms of accuracy. Our results illustrate the importance of the suggested technique in optimizing traffic routing in SDN environments. Integrating ML-based data classification with the QL method improves resource allocation, reduces latency, and improves the delivery of emergency traffic. The versatility of SDN facilitates the adaption of routing algorithms depending on real-time changes in network circumstances and traffic characteristics.

Software defined fog platform

<p><span lang="EN-US">In recent years, the number of end users connected to the internet of things (IoT) has increased, and we have witnessed the emergence of the cloud computing paradigm. These users utilize network resources to meet their quality of service (QoS) requirements, but traditional networks are not configured to backing maximum of scalability, real-time data transfer, and dynamism, resulting in numerous challenges. This research presents a new platform of IoT architecture that adds the benefits of two new technologies: software-defined networking and fog paradigm. Software-defined networking (SDN) refers to a centralized control layer of the network that enables sophisticated methods for traffic control and resource allocation. So, fog paradigm allows for data to be analyzed and managed at the edge of the network, making it suitable for tasks that require low and predictable delay. Thus, this research provides an in-depth view of the platform organize and performance of its base ingredients, as well as the potential uses of the suggested platform in various applications.</span></p>

Kaki: Efficient Concurrent Update Synthesis for SDN

Modern computer networks based on the software-defined networking (SDN) paradigm are becoming increasingly complex and often require frequent configuration changes in order to react to traffic fluctuations. It is essential that forwarding policies are preserved not only before and after the configuration update but also at any moment during the inherently distributed execution of such an update. We present Kaki, a Petri game based tool for automatic synthesis of switch batches which can be updated in parallel without violating a given (regular) forwarding policy like waypointing or service chaining. Kaki guarantees to find the minimum number of concurrent batches and supports both splittable and nonsplittable flow forwarding. In order to achieve optimal performance, we introduce two novel optimisation techniques based on static analysis: decomposition into independent subproblems and identification of switches that can be collectively updated in the same batch. These techniques considerably improve the performance of our tool Kaki, relying on TAPAAL’s verification engine for Petri games as its backend. Experiments on a large benchmark of real networks from the Internet Topology Zoo database demonstrate that Kaki outperforms the state-of-the-art tools Netstack and FLIP. Kaki computes concurrent update synthesis significantly faster than Netstack and compared to FLIP, it provides shorter (and provably optimal) concurrent update sequences at similar runtimes.

A Graph reinforcement learning based SDN routing path selection for optimizing long-term revenue

Software-Defined Network (SDN) paradigm decouples control plane from data plane and provides a logically-centralized control to whole underlying network, which enables the controller to centrally configure the network, and has demonstrated great potential in fully utilizing network capacity. However, the traditional SDN does not consider the accumulative long-term revenue in routing configuration for network service provider (SP). For example, it is prone to choosing the path passing through important nodes, which may increase the possibility of future congestion, and hamper the SP’s long-term revenue. Deep reinforcement learning (DRL) has brought about the transformative advances in decision-making when facing uncertainty. As a well-known type of DRL, Deep Q-network (DQN) can explore optimal routing schemes from high dimensional network state. However, most of existing DRL based methods fail to provide satisfactory configuration when confronted with a topology unseen during training. Meanwhile, many existing network optimization schemes ignore the impact of nodes and global network attributes on the routing configuration. Consequently, they may perform poorly in real scenarios. In this paper, we propose a graph reinforcement learning (GRL) based SDN routing selection scheme, GN-DQN for optimizing SP’s accumulative long-term revenue. First, besides the link embeddings, GN-DQN explicitly learns the representations of the routers and globe network topology with full graph neural network block. Then, through utilizing the formed network representation as the state, DQN is used to learn to sequentially choose the optimal routing path from the candidate path set to maximize the accumulative long-term revenue. Thorough experiments on multiple real network topologies show that our proposed GN-DQN outperforms other GRL based and traditional routing selection schemes, and can generalize over arbitrary topologies. Moreover, GN-DQN also demonstrates great robustness to the link failure scenario.

Virtual Network Function Development for NG-PON Access Network Architecture

Modern networks urge agility, flexibility, and capacity to cope with the growing demand for media content and applications increasingly oriented toward data consumption. The Central Offices (CO) of telecommunication providers, being a vital aggregator of different access networks, such as optical and mobile, need to be prepared to deal with these demands. The Open Broadband-Broadband Access ion (OB-BAA) architecture fits into the initiative to modernize the Information Technology (IT) components of broadband networks, more specifically the COs. This paper discusses the development of a Virtualized Network Function (VNF) in the context of network security to be integrated as a component of an OB-BAA architecture guided by the Software-Defined Network paradigm. More specifically, the authentication and authorization of network equipment within the IEEE 802.1X protocol are applied to Next Generation Passive Optical Networks. The VNF development is based on the Golang language combined with gRPC programmable interfaces for communication between the various elements of the OB-BAA architecture, and then the components were “containerized” and inserted in the Docker and Kubernetes virtualization frameworks of a multinational telecommunications operator. Finally, performance metrics such as computational resource usage (CPU, memory, and network I/O) and execution time of VNF processes were analyzed in usage tests with multiple supplicants and distinct operational modes, to attest to the most promising virtualization scenarios.

A review of localization algorithms based on software defined networking approach in wireless sensor network

Wireless Sensor Network (WSN) localization is an important challenge, because A strong relationship between aggregation sense data and the location of data's origin. Software Defined Networks (SDN) technique is support localization algorithm and take into account all network's limitations and constraints. By making use of global network knowledge provided by SDN controller, the results of previous studies show that considerable improvement in network performance can be achieved. This paper explores the recently proposed localization algorithms and discusses the simulation results for each method used in Software Defined Wireless Sensor Networks (SDWSN) to find the best way to localized nodes with the highest accuracy and lowest energy consumption. This paper also present Software defined networking paradigm and WSNS challenges which solved by SDWSNs.

An SDN perspective IoT-Fog security: A survey

The utilization of the Internet of Things (IoT) has burst in recent years. Fog computing is a notion that solves cloud computing’s limitations by offering low latency to IoT network user applications. However, the significant number of networked IoT devices, the large scale of the IoT, security concerns, users’ critical data, and heterogeneity in this extensive network significantly complicate the implementation. The IoT-Fog architecture consists of fog devices (servers) at the fog layer, which decreases network utilization and response time due to their closeness to IoT devices. However, as the number of IoT and fog devices under the IoT-Fog architecture grows, new security concerns and requirements emerge. Because incorporating fog computing into IoT networks introduces some vulnerabilities to IoT-Fog networks, the nodes in the fog layer are the target of security threats. Software-Defined Networking (SDN) is a novel paradigm that decouples the data plane from control plane, resulting in better programmability and manageability. Attack defense mechanisms can be implemented in the IoT-Fog network without SDN. But SDN paradigm provides the IoT-Fog with some characteristics that facilitate counterattacks. This survey briefly explains some works that utilized the SDN features in the IoT-Fog network for security threats in the IoT-Oriented fog layer. To this end, we examine IoT-Fog, SDN, and SDN-based IoT-Fog networks. We describe security threats in IoT-Fog networks and briefly explain the vulnerabilities and attacks in the fog layer. Then, we describe the fog layer’s most common IoT-Fog security defense mechanisms. Following that, we present the SDN features, explore how SDN can help defensive mechanisms in IoT-Fog networks, and categorize the works based on the SDN features they use. We explain their features and present a comparison between them. Finally, we discuss the disadvantages of SDN in IoT-Fog networks.

Performance and Scalability Analysis of SDN-Based Large-Scale Wi-Fi Networks

The Software-Defined Networking (SDN) paradigm is one that is utilized frequently in data centers. Software-Defined Wireless Networking, often known as SDWN, refers to an environment in which concepts from SDN are implemented in wireless networks. The SDWN is struggling with challenges of scalability and performance as a result of the growing number of wireless networks in its coverage area. It is thought that SDN techniques, such as Mininet-Wi-Fi and Ryu Controller for wireless networks, can overcome the problems with scalability and performance. Existing Wi-Fi systems do not provide SDN execution to end clients, which is one reason why the capability of Wi-Fi is restricted on SDN architecture. Within the scope of this study, we analyzed Wi-Fi networks operating on SDN using the Transmission Control Protocol (TCP) and User Datagram Protocol (UDP). By utilizing a testbed consisting of Ryu Controller and Mininet-Wi-Fi, we were able to test Wi-Fi over SDN and evaluate its performance in addition to its scalability. When evaluating the performance of a network, we take into account a number of different metrics, such as bandwidth, round-trip time, and jitter. In order to assess the level of performance, the SDN-based Wi-Fi controller Ryu is linked to an increasing number of access points (1, 2, 3, and 4) as well as stations (10, 30, 50, and 100). The experimental findings obtained using Mininet-Wi-Fi indicate the scalability and dependability of the network performance provided by the SDN Wi-Fi network controller Ryu in an SDN environment. In addition, the round-trip time for TCP packets grows proportionally with the number of hops involved. A single access point is capable of simultaneously supporting up to fifty people at once.

Research on the Controller Deployment Strategy of Aviation Information Network

With the development of intelligent aviation platforms, Aviation Information Networks (AIN) has emerged as a promising architecture to accommodate various aviation missions. However, the current Airborne Ad Hoc Networks (AANETs) suffer from the challenges of tightly-coupled devices and complex aviation environments. To tackle the issues, the Software Defined Network (SDN) is introduced to manage the AINs by decoupling the control plane from the data plane and allocating the network resources logically. Considering the large-scale and dynamic changing characteristics of the AINs, we utilize the hybrid architecture consisting of multiple controllers to establish the control system. To construct the AIN of the SDN paradigm, the first issue that needs to be reckoned with is the controller deployment. This paper proposes a controller deployment strategy that includes network division and regional deployment. Firstly, the network is rapidly divided into areas according to the key performance indicators of the network, and then the platform with the highest reliability is selected as the controller to be deployed in each area. The experimental results show that the proposed algorithm has low computational complexity and can effectively improve the network performance in terms of average requirement delay, load balance index, controller deployment cost, and reliability, which is suitable for addressing the controller deployment issue in aviation scenarios.

SDN Application Plane Where Intelligence Meets Networking

The software-defined networking (SDN) paradigm has revolutionized the way we think about network management and control. The SDN application plane is a critical component of this paradigm, where intelligent applications are leveraged to drive network behavior and optimize network performance. In this abstract, we explore the role of the SDN application plane in bridging the gap between traditional network management and the intelligent, dynamic network of the future. We discuss the challenges and opportunities of deploying SDN applications, including the need for standardized APIs and the importance of intelligent analytics and machine learning techniques. Finally, we highlight the transformative potential of the SDN application plane, from enabling new applications and services to improving network security and resilience. By bringing intelligence and networking together in new and innovative ways, the SDN application plane promises to revolutionize the way we design, manage, and secure our networks.

Traffic-aware service relocation in software-defined and intent-based elastic optical networks

The paper focuses on the efficient dynamic routing of unicast and data center (dc)-related requests in elastic optical networks (eons) implementing software-defined networking (sdn) and intend-based networking (ibn) paradigms. To improve the network performance (measured as a ratio of the accepted traffic), we apply the service relocation (i.e., the adaptive process of changing the assigned dc for an anycast request). To enable a realistic case study, we propose a novel traffic model for dc-oriented and intent-based transport networks. The model reflects patterns observed in real networks and relates them with the economic and demographic parameters of the cities associated with network nodes. Then, we propose a dedicated allocation algorithm and introduce 21 different service relocation policies. These are traffic- and network-aware approaches, which use three data types for decision-making — traffic prediction, bit-rate rejection history, and topological network characteristics. Finally, we perform extensive simulations to: (i) tune the proposed optimization approaches, (ii) compare their efficiency and select the best one, (iii) determine benefits provided by the traffic- and network-aware service relocation in sdn/ibn optical networks. The results prove a high efficiency of the proposed policies, which allowed to serve up to 5.39% more traffic compared to the network with the fixed dc assignment. They also reveal that the most efficient policy makes its decisions based on traffic prediction.

Q-learning based distributed denial of service detection

<span lang="EN-US">Distributed denial of service (DDoS) attacks the target service providers by sending a huge amount of traffic to prevent legitimate users from getting the service. These attacks become more challenging in the software-defined network paradigm, due to the separation of the control plane from the data plane. Centralized software defined networks are more vulnerable to DDoS attacks that may cause the failure of all networks. In this work, a new approach is proposed based on q-learning to enhance the detection of DDoS attacks and reduce false positives and false negatives. The results of this work are compared with entropy detection in terms of the number of received packets to detect the attack and also the continuity of service for legitimate users. Moreover, these results indicate that the proposed system detects the DDoS attack from flash crowds and redirects the traffic to the edge of the data center. A second controller is used to redirect traffic to a honeypot server that works as a mirror server. This guarantees the continuity of service for both normal and suspected traffic until further analysis is done. The results indicate an increase of up to 50% in the throughput compared to other approaches.</span>