Rule Update Research Articles

LearningTuple: A packet classification scheme with high classification and high update

Packet classification is widely used in network infrastructures and is the key technique that supports security and other functions. The real-time nature of network services naturally demands high classification speed, while the emerging SDN makes rule changes more flexible, thus placing higher demands on the performance of rule update in classification schemes. In this paper, Learning Tuple(LT) is proposed to achieve high classification performance for packets while maintaining the high update characteristics of tuple space-based schemes. Specifically, to solve the issue of excessive tuples and rule overlap due to merging tuples, LT iteratively divides the space by using rule overlap and hash collisions as negative feedback and applies a reinforcement learning algorithm, SARSA, at each level to ensure its reasonableness. Efficient space partitioning guides the construction of tuples, and an excellent rule mapping method called PLR is designed, which improves classification performance. Experimental results demonstrate that compared with classic and advanced classification schemes TSS, TupleMerge, MultilayerTuple, PartitionSort, HybridTSS, and TupleTree, LT achieves average classification performance improvements of 9.23x, 1.74x, 1.45x, 2.85x, 1.37x and 1.25x, as well as average update performance improvements of 1.83x, 6.75x, 1.22x, 6.16x, 1.21x, 10.66x, respectively.

Effects of the added sugar labeling on consumers' willingness to pay: The case of cranberry products under different nutrition‐related information treatments

AbstractThe Food and Drug Administration announced a rule update to the Nutrition Facts Panel (NFP) requiring the declaration of added sugars on the NFP starting in 2020. This study measures the impact of these changes by estimating the willingness to pay for added sugars in cranberry products under different nutrition‐related information treatments. We found significant discounts for increases in added sugars that vary across information treatments and consumer subsamples. A positive information frame about the health benefits of cranberries was not found to consistently offset the impact of additional information on the recommended daily intake limits for added sugars.

Partitioned 2D Set-Pruning Segment Trees with Compressed Buckets for Multi-Dimensional Packet Classification

Abstract Multi-dimensional packet classification is one of the most important functions to support various services in next generation routers. Both the memory-efficient data structure to support larger rule tables and the hardware architecture to achieve a higher throughput are desired. In this paper, we propose a parallel and pipelined architecture called Set-Pruning Segment Trees with Buckets (SPSTwB) for multi-dimensional packet classification. SPSTwB significantly reduces rule duplication based on a novel partitioning scheme and an efficient bucket merging scheme. The key feature of our proposed architecture is that memory consumption is reduced significantly regardless of the characteristics of various rule tables. In addition, the logic complexity of each pipeline stage is simplified by not storing rule IDs and priorities and thus it can run at a high clock rate. The proposed scheme needs less than 20 bytes per rule for various 100 K rule tables generated by ClassBench. In addition, the proposed scheme supports fast incremental rule update. The proposed pipelined architecture can achieve a throughput of 134 Gbps from the implementation on Xilinx Virtex-7 FPGA device with dual-ported Block RAM.

Data-Driven Prediction of Students’ Online Learning Needs and Optimization of Knowledge Library Management

Thanks to the advancement of information technology, online learning has become a crucial tool of modern education, and the management of modern education is facing the challenges of how to effectively predict students’ learning needs and how to optimize the management of the knowledge library to support these needs. However, existing data-driven prediction approaches are flawed in handling complex learning environments and timely adapting to changes, so this study attempts to solve these questions by exploring the correlation between learning needs, the extraction of knowledge linkages, and the optimization of knowledge libraries based on rule updates. In our work, a new method was proposed for extracting learning needs and knowledge linkages to more accurately identify and predict students’ learning needs, and a rule-based knowledge library management optimization method was introduced to allow the knowledge library to more flexibly adapt to students’ learning needs and the changes in educational resources. In this way, this study offers a comprehensive and flexible solution for education management via the combination of these two aspects, which not only increases student satisfaction and improves teaching quality but also reduces resource waste and gives students a more personalized and efficient learning experience. Furthermore, the methods and findings of this study could also be used as references for data-driven decision-making in other fields.

A novel class of adaptive observers for dynamic nonlinear uncertain systems

AbstractNumerous techniques have been proposed in the literature to improve the performance of high‐gain observers with noisy measurements. One such technique is the linear extended state observer, which is used to estimate the system's states and to account for the impact of internal uncertainties, undesirable nonlinearities, and external disturbances. This observer's primary purpose is to eliminate these disturbances from the input channel in real‐time. This enables the observer to precisely track the system states while compensating for the various sources of uncertainty that can influence the system's behaviour. So, in this paper, a novel nonlinear higher‐order extended state observer (NHOESO) is introduced to enhance the performance of high‐gain observers under noisy measurement conditions. The NHOESO is designed to observe the system states and total disturbance while eliminating the latter in real time from the input channel. It is capable of handling disturbances of higher‐order derivatives, including internal uncertainties, undesirable nonlinearities, and external disturbances. The paper also presents two innovative schemes for parametrizing the NHOESO parameters in the presence of measurement noise. These schemes are named time‐varying bandwidth NHOESO (TVB‐NHOESO) and online adaptive rule update NHOESO (OARU‐NHOESO). Numerical simulations are conducted to validate the effectiveness of the proposed schemes, using a nonlinear uncertain system as a test case. The results demonstrate that the OARU technique outperforms the TVB technique in terms of its ability to sense the presence of noise components in the output and respond accordingly. However, it is noted that the OARU technique is slower than the TVB technique and requires more complex parameter tuning to adaptively account for the measurement noise.

EXPLORING THE LANDSCAPE OF SDN-BASED DDOS DEFENSE: A HOLISTIC EXAMINATION OF DETECTION AND MITIGATION APPROACHES, RESEARCH GAPS AND PROMISING AVENUES FOR FUTURE EXPLORATION

Over the course of time, a multitude of security solutions have been proposed in order to safeguard the Internet architecture from an extensive array of malware threats. However, the task of ensuring the security of the Internet and its associated applications remains an ongoing research challenge. Researchers persistently delve into the exploration of innovative network architectures, such as the utilization of HTTP as the narrow waist, the implementation of Named Data Networking (NDN), the development of programmable networks, and the adoption of Software-Defined Networking (SDN), with the aim of designing a more dependable and resilient network infrastructure. Among these alternative approaches, SDN has emerged as a robust and secure solution for countering malicious activities. By separating the control plane from the data plane, SDN provides an array of advantages, including enhanced manageability, improved control, dynamic rule updates, advanced analysis capabilities, and a comprehensive network overview facilitated by a centralized controller. Despite its superiority over conventional IP-based networks, SDN is susceptible to various network intrusions and encounters significant challenges in terms of deployment. The purpose of this paper is to conduct a comprehensive review of approximately 70 prominent mechanisms employed for the detection and mitigation of Distributed Denial of Service (DDoS) attacks in SDN networks. These mechanisms are systematically categorized into four main groups, namely information theory-based methods, machine learning-based methods, approaches based on Artificial Neural Networks (ANN), and other miscellaneous methods. Furthermore, the paper identifies and discusses several unresolved research issues and gaps that exist in the deployment of a secure DDoS defense solution within SDN networks. The objective of this comprehensive review is to provide valuable insights to the research community, assisting in the development of more robust and reliable DDoS mitigation solutions that are specifically tailored for SDN networks.

Traffic-aware efficient consistency update in NFV-enabled software defined networking

In network function virtualization(NFV)-enabled software defined networks, the controller needs to frequently update the flow forwarding rules in the data plane to adapt to dynamic changes in network topologies or service requests. However, inconsistent rule updates may lead to blackholes, loops, transient congestion or policy violations (e.g., packets do not traverse designated network functions in a specific order), resulting in service interruption and throughput degradation. Therefore, this paper proposes an effective rule consistent update mechanism to avoid the above four problems simultaneously, while improving network throughput and satisfying user requests. Specifically, we first build three effective models to avoid blackholes, loops, and policy violations. Then, considering that network function nodes may change the sizes of their processed flows, we build a congestion avoidance model based on traffic changes to avoid congestion, which can reduce unnecessary rule update delays and packet loss. Subsequently, we prove that the consistent update problem constructed above is NP-hard, and then design an effective heuristic rule consistent update algorithm to obtain the rule update sequence that can simultaneously avoid blackholes, loops, congestion, and policy violations. Extensive trace-driven simulation results show that compared with the existing update methods, our proposed method can improve the success rate by up to 20.6% and reduce the maximum link utilization by up to 7.5%.

A Parallel and Updatable Architecture for FPGA-Based Packet Classification With Large-Scale Rule Sets

As a programmable hardware, field-programmable gate array (FPGA) provides more opportunities for algorithmic network packet classification. Despite more than 10 years of research, the most actively investigated pipeline architectures still struggle to support fast rule search and efficient rule update for large-scale rule sets. In this article, we design and implement a novel architecture for multitree-based packet classification on FPGA, where the search and update processes are decoupled. A strategy of multi-processing elements (PEs), parallel search, and serial update is adopted. The parsing of multiple tree search results adopts a modular and hierarchical design, supporting architecture with various tree numbers. In addition, incremental rule updates can be achieved simply by traversing all PEs in one pass, with little and bounded impact on rule searching. Compared with TcbTree, the state-of-the-art updatable classifier, the experimental results on FPGA show that the classification performance of our design improves 3.4× on average for various 100k-scale rule sets.

RuleOut Forwarding Anomalies for SDN

Reliable Software-Defined Networking (SDN) should mitigate forwarding anomalies due to cross-plane rule inconsistencies. Most existing countermeasures either inject probe packets to infer forwarding correctness or collect packet traces to detect forwarding anomalies. They, however, cannot detect or filter forwarding anomalies for production packets in real time. In this paper, we propose RuleOut as the first attempt to automatically throttle SDN forwarding anomalies. It disambiguates dependent rules via augmenting their matching fields with unique tags. Leveraging source routing, we further bind each packet with the tag sequence corresponding to rules the packet should match. RuleOut thus renders each packet to match at most one rule on each switch. This completely addresses the root cause of forwarding ambiguity. To implement RuleOut, we develop a non-overlapping rule dependency graph, a series of algorithms for incremental rule update and tag generation upon it, and various optimization techniques toward scalability and efficiency. We prototype RuleOut on the Ryu controller and Open vSwitch and evaluate its performance over public rule sets such as Stanford, Internet2, and Airtel1. RuleOut can use tags of only several bits long to disambiguate thousands to millions of rules and generate tags fairly fast within a few milliseconds.

Distributed Multicast Traffic Engineering for Multi-Domain Software-Defined Networks

Previous research on SDN multicast traffic engineering mainly focused on intra-domain optimization. However, the main traffic on the Internet is inter-domain, and the selection of border nodes and sharing of network information between domains are usually distributed but ignored in previous works. In this article, we explore multi-domain online distributed multicast traffic engineering (MODMTE). To effectively solve MODMTE, we first prove that MODMTE is inapproximable within <inline-formula><tex-math notation="LaTeX">$|D_{\max }|$</tex-math></inline-formula> , which indicates that it is impossible to find any algorithm with a ratio better than <inline-formula><tex-math notation="LaTeX">$|D_{\max }|$</tex-math></inline-formula> for MODMTE, and <inline-formula><tex-math notation="LaTeX">$|D_{\max }|$</tex-math></inline-formula> is the maximum number of destinations for a multicast tree. Then, we design a <inline-formula><tex-math notation="LaTeX">$|D_{\max }|$</tex-math></inline-formula> -competitive distributed algorithm with the ideas of Domain Tree, Dual Candidate Forest Construction, and Forest Rerouting to achieve the tightest performance bound for MODMTE. Experiments on a real SDN with YouTube traffic manifest that the proposed distributed algorithm can reduce more than 30% of the total cost of bandwidth consumption and rule updates for multicast tree rerouting compared with the state-of-the-art algorithms.

A Learned Bloom Filter-Assisted Scheme for Packet Classification in Software-Defined Networking

Traditional routing technologies based on a single IP address domain faces the challenge to meet the increasing demand for network services and security. Packet classification is a technique to differentiate multi-domain network traffic in a fine-grained manner using packet header fields. Packet classification requires to operate efficiently to avoid it becoming a bottleneck in the packet routing process. Tuple space search (TSS) used in SDN supports fast rule updates but low-speed packet classification. In this paper, we propose a learned Bloom filter (LBF)-based packet classification algorithm that combines LBF and TSS to promote classification speed by avoiding invalid hash table accesses. Specifically, LBF consists of multiple RNN models and one support Bloom filter (SBF), in which the learned models are trained with the positive and negative sets, and used as a pre-filter to identify the two sets. For the filter outcomes with a negative result from learned models, SBF is constructed to perform the second filtration. To ensure efficiency of RNN and SBF, we carefully select key features to be used in RNN and SBF, which can also maintain efficient search in the final stage of hash checking. Our experimental results show that the proposed algorithm saves more memory space than Tuple space pruning (TSP) given the same false positive rate. The proposed algorithm is competitive in terms of the number of memory accesses, while achieving almost one order of magnitude improvement on pre-processing time over NeuroCuts which is an advanced decision tree classifier.

Computer Network Intrusion Anomaly Detection Based on Rough Fourier Fast Algorithm

Since there is a close relationship between network information security attack events and time complexity, it is necessary to count the degree of correlation between the current connection record and the connection record within a certain period of time before. Only in this way can the relationship between network connection data and network information security attack events be better reflected. In this paper, a rough Fourier fast algorithm based on rough set theory is proposed. Based on the characteristic attributes of the intrusion detection data set with the most value of character attributes as the data division basis, the computer network intrusion anomaly detection data set is intelligently divided into small data sets, so as to carry out attribute reduction. The network intrusion detection rule update experiment adopts the misuse detection method, extracts some samples from the KDD99 data set for training, obtains the computer network intrusion detection rules in the hierarchical decision table, and uses the incremental learning algorithm to update the rules, compared with the intrusion detection rules expressed by the decision table to test the feasibility and effectiveness of the rule update, and compared with the improved RSDB, RE-RFE algorithm, and KNN algorithm to evaluate the effect of the rough Fourier fast detection model applied to the problem of network intrusion anomaly detection. Using the attribute subset reduced by the rough Fourier algorithm to perform classification and modeling of computer network intrusion anomaly detection is significantly reduced, and the average time is reduced by 0.09 seconds, and this paper lays a good foundation for the application of network security intrusion detection algorithm.

Efficient hierarchical hash tree for OpenFlow packet classification with fast updates on GPUs

Packet classification is an important functionality of modern routers/switches, needed in packet forwarding, Quality of Service (QoS), firewall etc. In order to better utilize routers on the Internet, Software Defined Network (SDN) decouples control plane from data plane to fulfill centralized management. Based on OpenFlow standards, packet classification in SDN is designed for multi-field rules which are more complex than traditional 5-tuple rules. In the paper, we propose a novel packet classification algorithm, called hierarchical hash tree (H-HashTree), based on the two IP address fields and the 7 exact-match fields to partition rules into groups. An extended Bloom filter is also proposed to accelerate search process by skipping groups in the hash tree. To further improve the performance, H-HashTree is implemented on GPU. We tested on 100K rules including synthesized rules containing characteristics of ACL, FW, and IPC with different wildcard ratios in exact-match fields, and real OpenFlow rules from Open vSwitch. Compared with the existing state-of-the-art algorithms, CutTSS and TabTree [19][18], H-HashTree achieves the best performance on both search and update speeds. H-HashTree achieves 1.17-13.9 and 2.48-12.7 times faster in search speed and 2.03-6.0 and 1.87-4.53 times faster in rule updates from synthesized rulesets than CutTSS and TabTree, respectively. On the GPU platform, H-HashTree can achieve up to 114 MPPS in search speed and less than 0.04 usec/rule in rule updates.

BatchUp: Achieve fast TCAM update with batch processing optimization in SDN

The parallel access mechanism supported by TCAM has made it popular with commercial switches. However, due to the ordered arrangement of rules, TCAM’s update speed cannot keep up with policy update requests, especially for software-defined networks, which expect to achieve fine-grained control over the network. Meanwhile, the legacy single-rule update solutions cause redundant rule moves due to weak global view. In this paper, we present a new two-stage batch processing solution BatchUp to alleviate the high time cost of the rule update process. In stage 1, we propose the costless rule insertion algorithm CRIA. CRIA models the rules to be inserted with the available locations in TCAM as a bipartite graph. By solving for maximum matching, CRIA obtains an upper bound on the number of rules that can be inserted without TCAM movement. However, the high utilization of TCAM makes it unrealizable to find available locations for all rules to be inserted directly. Therefore, in stage 2, we model the remaining rules insertion as an optimization problem for solving the minimum movement cost and prove that it has NP-hard complexity. A heuristic updating algorithm HRIA based on simulated annealing and greedy algorithm is proposed to search for approximate optimal solution. The evaluation results present that BatchUp has advantages over existing state-of-the-art solutions in terms of the number of TCAM moves and overall time cost, and has applicability and robustness in different scenarios.

A Brief History of Updates of Answer-Set Programs

AbstractOver the last couple of decades, there has been a considerable effort devoted to the problem of updating logic programs under the stable model semantics (a.k.a. answer-set programs) or, in other words, the problem of characterising the result of bringing up-to-date a logic program when the world it describes changes. Whereas the state-of-the-art approaches are guided by the same basic intuitions and aspirations as belief updates in the context of classical logic, they build upon fundamentally different principles and methods, which have prevented a unifying framework that could embrace both belief and rule updates. In this paper, we will overview some of the main approaches and results related to answer-set programming updates, while pointing out some of the main challenges that research in this topic has faced.

Towards privacy-preserving dynamic deep packet inspection over outsourced middleboxes

The prosperity of network function virtualization (NFV) pushes forward the paradigm of migrating in-house middleboxes to third-party providers, i.e., software (virtualized) middlebox services. A lot of enterprises have outsourced traffic processing such as deep packet inspection(DPI), traffic classification, and load balancing to middleboxes provided by cloud providers. However, if the traffic is forwarded to the cloud provider without careful processing, it will cause privacy leakage, as the cloud provider has all the rights to access the data. To solve the security issue, recent efforts are made to design secure middleboxes that can directly conduct network functions over encrypted traffic and middlebox rules. However, security concerns from dynamic operations like dynamic DPI and rule updates are still not yet fully addressed. In this paper, we propose a privacy-preserving dynamic DPI scheme with forward privacy for outsourced middleboxes. Our design can enable cloud side middlebox to conduct secure packet inspection over encrypted traffic data. Besides, the middlebox providers cannot analyze the relationship between the newly added rules and the previous data. Several recent papers have proven that it is a strong property that resist adaptive attacks. Furthermore, we design a general method to inspect stateful packets while still ensuring the state privacy protection. We formally define and prove the security of our design. Finally, we implement a system prototype and analyze the performance from experimental aspects. The evaluation results demonstrate our scheme is effective and efficient.

Retracted] A New Rule‐Based Approach for Classical Arabic in Natural Language Processing

Named entity recognition (NER) is fundamental in several natural language processing applications. It involves finding and categorizing text into predefined categories such as a person's name, location, and so on. One of the most famous approaches to identify named entity is the rule‐based approach. This paper introduces a rule‐based NER method that can be used to examine Classical Arabic documents. The proposed method relied on triggers words, patterns, gazetteers, rules, and blacklists generated by the linguistic information about entities named in Arabic. The method operates in three stages, operational stage, preprocessing stage, and processing the rule application stage. The proposed approach was evaluated, and the results indicate that this approach achieved a 90.2% rate of precision, an 89.3% level of recall, and an F‐measure of 89.5%. This new approach was introduced to overcome the challenges related to coverage in rule‐based NER systems, especially when dealing with Classical Arabic texts. It improved their performance and allowed for automated rule updates. The grammar rules, gazetteers, blacklist, patterns, and trigger words were all integrated into the rule‐based system in this way.

Research on Data Currency Rule and Quality Evaluation

Data currency is a temporal reference of data, it reflects the degree to which the data is current with the worldit models. Currency rule is a formal rule extracted from the data set and reflecting the currency order of thedata tuples, it can be used for both data repairing and currency quality evaluation. Based on the research of datacurrency repairing, the basic form of currency rule is extended, and parallel rule extraction and update algorithmsare proposed to meet the requirement of running on dynamic data sets. Besides, four data currency qualityevaluation models are proposed and verified by experiments. The performance test show that the efficiencyof parallel algorithms is significantly improved, the rules compliance mean(CM2) model based on extendedcurrency rule has the highest average precision. The extended currency rules not only improve the efficiencyand adaptability, but also provide more valuable features for data quality evaluation.

CMT: An Efficient Algorithm for Scalable Packet Classification

AbstractPacket classification plays an essential role in diverse network functions such as quality of service, firewall filtering and load balancer. However, implementing an efficient packet classifier is a challenging problem. The problem even gets worse in the era of software-defined network, in which frequent rule updates are performed, and complex flow tables are used. This paper proposes CMT, a new software algorithm named by its novel data structure—common mask tree—to implement an efficient multi-field packet classifier. The core idea of CMT is to combine the strengths of both decision-tree and tuple-space schemes by employing tree-like structures and hash tables simultaneously. The objective of CMT is to achieve both high classification performance and fast rule updates. In the evaluation section, CMT is compared with decision-tree and tuple-space schemes. Compared to the state-of-the-art decision-tree methods, CMT performs rule updates at two orders of magnitude faster. CMT has a stable performance on different rulesets and achieves a 40% improvement in memory access compared to the state-of-the-art tuple-space method.

A TCAM-based Caching Architecture Framework for Packet Classification

Packet Classification is the enabling function for performing many networking applications like Integrated Services, Differentiated Services, Access Control/Firewalls, and Intrusion Detection. To cope with high-speed links and ever-increasing bandwidth requirements, time-efficient solutions are needed for which Ternary Content Addressable Memories (TCAMs) are popularly used. However, high cost, heavy power consumption, and poor scalability limit their use in many commercial switches. In this work, an efficient framework for caching the packet classification rules on TCAMs in accordance with traffic characteristics is proposed. The proposed design will have a two-level classification engine in which level-1 is a TCAM classifier with a smaller rule capacity and level-2 is a software classifier. The classifiers are assisted by a rule update engine that monitors the rule temporal behavior and performs timely updates of the rules onto level-1. Crucial challenges with respect to the proposed framework design are defined and addressed effectively in this work. Simulation results shows that the architecture can achieve a throughput of 250 Gbps on average by caching only 10% of the total rules for rule databases of sizes 10,000. The proposed architecture, to the best of our knowledge, is the only traffic-aware architecture using TCAMs that provides a completely deployable framework and also can scale for speeds beyond 250 Gbps (OC-1920 and beyond).