SDN-based Data Center Networks Research Articles

Retracted: An Adaptive Authenticated Model for Big Data Stream SAVI in SDN-Based Data Center Networks

Retracted: An Adaptive Authenticated Model for Big Data Stream SAVI in SDN-Based Data Center Networks

SAFE: EFFICIENT DDOS ATTACK DEFENSE WITH ELASTIC TRAFFIC FLOW INSPECTION IN SDN-BASED DATA CENTERS

In this paper, we propose an efficient distributed denial-of-Service (DDoS) Attack deFEnse solution, namely SAFE, which utilizes an elastic traffic flow inspection mechanism, for Software-Defined Networking (SDN) based data centers. In particular, we first examine a leaf-spine SDN-based data center network, which is highly vulnerable to volumetric DDoS attacks. Next, we develop a rank-based anomaly detection algorithm to recognize anomalies in the amount of incoming traffic. Then, for the traffic flow inspection, we introduce a component called DFI (Deep Flow Inspection) running an Open vSwitch (OvS) that can be dynamically initiated (as a virtual machine) on-demand to collect traffic flow statistics. By utilizing deep reinforcement learning-based traffic monitoring from our previous study, the DFIs can be protected from the flow-table overflow problem while providing more detailed traffic flow information. Afterward, a machine learning-based attack detector analyzes the gathered flow rule statistics to identify the attack, and appropriate policies are implemented if an attack is recognized. The experiment results show that the SAFE can effectively defend against volumetric DDoS attacks while assuring a reliable Quality-of-Service level for benign traffic flows in SDN-based data center networks. Specifically, for TCP SYN and UDP floods, the SAFE attack detection performance is improved by approximately 40% and 30%, respectively, compared to the existing SATA solution. Furthermore, the attack mitigation performance, the ratio of dropped malicious packets obtained by the SAFE is superior by approximately 48% (for TCP SYN flood) and 52% (for UDP flood) to the SATA.

Modeling and optimization of the data plane in the SDN-based DCN by queuing theory

Complicated management tasks and various functions of traditional Data Center Network (DCNs) motivate the research on Software-Defined Networking (SDN). However, the limited flow table space in the SDN switch has a significant impact on the data plane especially the availability. In this paper, we propose a theoretical model based on queuing theory to estimate the flow table states of SDN switches, providing operators insights into the requirements of flow table resources and guaranteeing the performance of the data plane. First, we analyze the lifecycle of a flow table entry and construct a queuing theory based estimation model to estimate flow table states in the data plane. Second, we observe the real workloads of DCNs and figure out the probability characteristics of routing strategies to calculate the key parameters in our model. Third, for achieving an optimally latency-aware data plane, we propose an auxiliary method, Amora, to maintain the availability of the data plane by improving routing decisions with the consideration of the optimal flow table states obtained by our model. Comprehensive experiments show that the relative estimation error of flow table states in our model is around 10%, which exposes the actual flow table states and benefits the selection of proper switches. Moreover, Amora efficiently eliminates the failure cases of establishing routing paths in the data plane, which further demonstrates the precision and practicability of our estimation model.

Oddlab: fault-tolerant aware load-balancing framework for data center networks

Data center networks (DCNs) act as critical infrastructures for emerging technologies. In general, a DCN involves a multi-rooted tree with various shortest paths of equal length from end to end. The DCN fabric must be maintained and monitored to guarantee high availability and better QoS. Traditional traffic engineering (TE) methods frequently reroute large flows based on the shortest and least-congested paths to maintain high service availability. This procedure results in a weak link utilization with frequent packet reordering. Moreover, DCN link failures are typical problems. State-of-the-art approaches address such challenges by modifying the network components (switches or hosts) to discover and avoid broken connections. This study proposes Oddlab (Odds labels), a novel deployable TE method to guarantee the QoS of multi-rooted data center (DC) traffic in symmetric and asymmetric modes. Oddlab creatively builds a heuristic model for efficient flow scheduling and faulty link detection by exclusively using the gathered statistics from the DCN data plane, such as residual bandwidth and the number of installed elephant flows. Besides, the proposed method is implemented in an SDN-based DCN without altering the network components. Our findings indicate that Oddlab can minimize the flow completion time, maximize bisection bandwidth, improve network utilization, and recognize faulty links with sufficient accuracy to improve DC productivity.

An Adaptive Authenticated Model for Big Data Stream SAVI in SDN-Based Data Center Networks

With the rapid development of data-driven and bandwidth-intensive applications in the Software Defined Networking (SDN) northbound interface, big data stream is dynamically generated with high growth rates in SDN-based data center networks. However, a significant issue faced in big data stream communication is how to verify its authenticity in an untrusted environment. The big data stream traffic has the characteristics of security sensitivity, data size randomness, and latency sensitivity, putting high strain on the SDN-based communication system during larger spoofing events in it. In addition, the SDN controller may be overloaded under big data stream verification conditions on account of the fast increase of bandwidth-intensive applications and quick response requirements. To solve these problems, we propose a two-phase adaptive authenticated model (TAAM) by introducing source address validation implementation- (SAVI-) based IP source address verification. The model realizes real-time data stream address validation and dynamically reduces the redundant verification process. A traffic adaptive SAVI that utilizes a robust localization method followed by the Sequential Probability Ratio Test (SPRT) has been proposed to ensure differentiated executions of the big data stream packets forwarding and the spoofing packets discarding. The TAAM model could filter out the unmatched packets with better packet forwarding efficiency and fundamental security characteristics. The experimental results demonstrate that spoofing attacks under big data streams can be directly mitigated by it. Compared with the latest methods, TAAM can achieve desirable network performance in terms of transmission quality, security guarantee, and response time. It drops 97% of the spoofing attack packets while consuming only 9% of the controller CPU utilization on average.

Research on Data Center Load Balancing Technology Based on SDN

With the rise of mobile Internet and big data, the continuous expansion of data center network deployment, the trend toward more complex traffic patterns and fine-grained performance management requirements, have brought more and more network performance issues to the fore. As an emerging network architecture, SDN separates the control plane from the data plane, and has the characteristics of centralized control and programmable. The centralized control feature of SDN technology enables the SDN controller to dynamically obtain network topology, link information, node information, and flow information in a timely manner, thereby realizing flexible and fine-grained centralized scheduling of network flows, which is very suitable for the needs of data centers. Due to the high dynamic nature of SDN, how to improve the timeliness of its load balancing and better solve network congestion is very important. Aiming at the problems in data center network applications, this paper studies the SDN-based data center network load balancing management system structure, and discusses the load balancing technology of data center server clusters based on improved ant colony algorithm.

Novel resource allocation mechanism for SDN-based data center networks

With the development of virtualization technologies, Service Providers (SP) can offer services to customers by renting various kinds of hardware resources from Data Centers (DC) instead of purchasing hardware equipment frequently, which not only increases the flexibility, but also decreases the cost. For the multi-tenant DC environment, each SP can be regarded as a DC tenant. Then, the request of each tenant could be abstracted as a Virtual Data Center (VDC) which is implemented by mapping the required virtual nodes and links onto physical servers and optical paths. Such process is also referred to as the VDC mapping, during which the corresponding resources will be allocated. It is aware that the VDC mapping problem is essentially different from the virtual network mapping problem, and the former one is much more complex than the latter one. Therefore, the solution of VDC mapping still faces many challenges. In this work, we focus on addressing the VDC mapping problem with a flexible and efficient resource allocation. Firstly, the concepts of Software Defined Networking (SDN) and Network Function Virtualization (NFV) are both introduced to construct a logically centralized and physically distributed resource allocation framework which decouples the server resource control and the network resource control. In this way, the whole resource allocation process can be managed in a more flexible and targeted way towards achieving high resource utilization. Secondly, a location-aware VDC partition process is introduced before VDC mapping based on the label propagation algorithm, which clusters the virtual nodes of a VDC request according to the communication frequency between any two virtual nodes. Generally, the higher the communication frequency, the more cost will be spent on network resource consumption, such that the virtual nodes clustered in the same group will be mapped onto the same DC to avoid excessive backbone network consumption. Lastly, a cost and security aware VDC mapping mechanism is proposed to address the corresponding resource allocation problem, which aims at minimizing the overall cost with both the basic resource constraints, mapping constraints, the wavelength continuity constraint and the security constraint taken into consideration. The experiment indicates that the proposed mechanism can decrease the overall VDC mapping cost by about 10%–25%, and increases the VDC acceptance rate and the total revenue by up to 34% and 71% respectively compared to the state-of-the-art benchmarks.

An optimal and dynamic elephant flow scheduling for SDN-based data center networks

An optimal and dynamic elephant flow scheduling for SDN-based data center networks

Deep Q-Learning for Routing Schemes in SDN-Based Data Center Networks

In order to adapt to the rapid development of cloud computing, big data, and other technologies, the combination of data center networks and SDN is proposed to make network management more convenient and flexible. With this advantage, routing strategies have been extensively studied by researchers. However, the strategies in the controller mainly rely on manual design, the optimal solutions are difficult to be obtained in the dynamic network environment. So the strategies based on artificial intelligence (AI) are being considered. This paper proposes a novel routing strategy based on deep Q-learning (DQL) to generate optimal routing paths autonomously for SDN-based data center networks. To satisfy the different demands of mice-flows and elephant-flows in data center networks, deep Q networks are trained for them respectively to achieve low latency and low packet loss rate for mice-flows as well as high throughput and low packet loss rate for elephant-flows. Furthermore, with the consideration of the distribution of traffic and the limited resources of data center networks and SDN, we choose port rate and flow table utilization to describe the network state. Simulation results show that compared with Equal-Cost Multipath (ECMP) routing and Selective Randomized Load Balancing (SRL)+FlowFit, the proposed routing scheme can reduce both the average delay of mice-flows and average packet loss rate, while increase the average throughput of elephant-flows.

An Efficient Route Management Framework for Load Balance and Overhead Reduction in SDN-Based Data Center Networks

A data center network (DCN) is composed of many servers interconnected by well-organized switches, which involves massive amount of data transmissions to provide cloud services. It is critical to manage packet routes in DCNs to avoid congestion on some links. The software-defined networking (SDN) technique supports auto-configuration of switches by a central controller, and gives an easy way to manage traffic flows. In the paper, we exploit SDN to improve performance of fat-tree DCNs, and propose a low-cost, load-balanced route management (L2RM) framework. L2RM keeps monitoring network traffics and computes a load-deviation parameter to check if some links of switches are burden with heavy loads. Then, an adaptive route modification mechanism is triggered if necessary, which considers the size limitation of flow tables and uses group tables in OpenFlow to distribute flows among different links to balance their loads. Besides, L2RM uses a dynamic information polling mechanism to query switches about their statuses, so as to reduce the message overhead of the controller. Through Mininet simulations, we show that our L2RM framework can better increase link utilization, alleviate table overflow, and reduce message cost, as comparing with other SDN-based approaches for fat-tree DCNs.

Overhead reduction scheme for SDN-based Data Center Networks

This paper proposes a framework on controller and switches to reduce overhead of controller-switch communication for SDN-based Data Center Networks (DCN). The proposal focuses on OpenFlow (OF), a well-known, sophisticated protocol for SDN, to reduce the number of control messages, consisting of both PACKET_IN and PACKET_OUT messages handled by the OF controller during rule installation on OF switches’ flow tables. The controller receives the first packet of a flow for forwarding path determination and selectively chooses switches for rule installation. Moreover, to ensure lower loads for the controller to handle, the proposed framework adds an out-of-band controller and avoids a hybrid architecture. Extensive simulation shows significant results on reduced controller workload. The performance provides a mutual trade-off by considerably improving rule matching rate in the presence of slightly enhanced number of flow entries, conserving resources on both OF controller and OF switches for SDN-based DCN operation. As a consequence, network latency is reduced while throughput is enhanced, which offers a great promise in the future deployment of DCN.

Efficient Anonymous Communication in SDN-Based Data Center Networks

With the rapid growth of application migration, the anonymity in data center networks becomes important in breaking attack chains and guaranteeing user privacy. However, existing anonymity systems are designed for the Internet environment, which suffer from high computational and network resource consumption and deliver low performance, thus failing to be directly deployed in data centers. In order to address this problem, this paper proposes an efficient and easily deployed anonymity scheme for software defined networking-based data centers, called mimic channel (MIC). The main idea behind MIC is to conceal the communication participants by modifying the source/destination addresses, such as media access control (MAC) and Internet protocol (IP) address at switch nodes, so as to achieve anonymity. Compared with the traditional overlay-based approaches, our in-network scheme has shorter transmission paths and less intermediate operations, thus achieving higher performance with less overhead. We also propose a collision avoidance mechanism to ensure the correctness of routing, and three mechanisms to enhance the traffic-analysis resistance. To enhance the practicality, we further propose solutions to enable MIC co-existing with some MIC-incompatible systems, such as packet analysis systems, intrusion detection systems, and firewall systems. Our security analysis demonstrates that MIC ensures unlinkability and improves traffic-analysis resistance. Our experiments show that MIC has extremely low overhead compared with the base-line transmission control protocol (TCP) (or secure sockets layer (SSL)), e.g., less than 1% overhead in terms of throughput. Experiments on MIC-based distributed file system show the applicability and efficiency of MIC.

LTSS: Load-Adaptive Traffic Steering and Forwarding for Security Services in Multi-Tenant Cloud Datacenters

Currently, different kinds of security devices are deployed in the cloud datacenter environment and tenants may choose their desired security services such as firewall and IDS (intrusion detection system). At the same time, tenants in cloud computing datacenters are dynamic and have different requirements. Therefore, security device deployment in cloud datacenters is very complex and may lead to inefficient resource utilization. In this paper, we study this problem in a software-defined network (SDN) based multi-tenant cloud datacenter environment. We propose a load-adaptive traffic steering and packet forwarding scheme called LTSS to solve the problem. Our scheme combines SDN controller with TagOper plug-in to determine the traffic paths with the minimum load for tenants and allows tenants to get their desired security services in SDN-based datacenter networks. We also build a prototype system for LTSS to verify its functionality and evaluate performance of our design.

Achieving minimum bandwidth guarantees and work-conservation in large-scale, SDN-based datacenter networks

Performance interference has been a well-known problem in datacenters and one that remains a constant topic of discussion in the literature. Software-Defined Networking (SDN) may enable the development of a robust solution for interference, as it allows dynamic control over resources through programmable interfaces and flow-based management. However, to date, the scalability of existing SDN-based approaches is limited, because of the number of entries required in flow tables and delays introduced. In this paper, we propose Predictor, a scheme to scalably address performance interference in SDN-based datacenter networks (DCNs), providing minimum bandwidth guarantees for applications and work-conservation for providers. Two novel SDN-based algorithms are proposed to address performance interference. Scalability is improved in Predictor as follows: first, it minimizes flow table size by controlling flows at application-level; second, it reduces flow setup time by proactively installing rules in switches. We conducted an extensive evaluation, in which we verify that Predictor provides (i) guaranteed and predictable network performance for applications and their tenants; (ii) work-conserving sharing for providers; and (iii) significant improvements over DevoFlow (the state-of-the-art SDN-based proposal for DCNs), reducing flow table size (up to 94%) and having similar controller load and flow setup time.

A congestion-aware and robust multicast protocol in SDN-based data center networks

Continuously enriched distributed systems in data centers generate much network traffic in push-style one-to-many group mode, raising new requirements for multicast transport in terms of efficiency and robustness. Existing reliable multicast solutions, which suffer from low robustness and inefficiency in either host-side protocols or multicast routing, are not suitable for data centers. In order to address the problems of inefficiency and low robustness, we present a sender-initiated, efficient, congestion-aware and robust reliable multicast solution mainly for small groups in SDN-based data centers, called MCTCP. The main idea behind MCTCP is to manage the multicast groups in a centralized manner, and reactively schedule multicast flows to active and low-utilized links, by extending TCP as the host-side protocol and managing multicast groups in the SDN-controller. The multicast spanning trees are calculated and adjusted according to the network status to perform a better allocation of resources. Our experiments show that, MCTCP can dynamically bypass the congested and failing links, achieving high efficiency and robustness. As a result, MCTCP outperforms the state-of-the-art reliable multicast schemes. Moreover, MCTCP improves the performance of data replication in HDFS (Hadoop Distributed File System) compared with the original and TCP-SMO (an alternative reliable multicast scheme) based ones, e.g., achieves up to 1.5× and 1.1× improvements in terms of throughput, respectively.

Horizon: a QoS management framework for SDN-based data center networks

Data center networks (DCNs), which serve as the infrastructural backbone of big data, have been receiving increasing attention recently. To improve the service quality of data centers, researchers have been working on congestion control, network monitoring, and performance optimization. However, most such works focus on user-centric service quality, which means that the quality of network service itself is not factored into the quality of service (QoS) problem. In this study, we illustrate the problem of data center operations and management as a new type of QoS that is the foundation of user-centric QoS implementation. Inspired by traditional works on network performance optimization, we define the quality of network service in a software-defined networking (SDN)-based DCN and develop a framework called Horizon as the architecture of our QoS solution. This framework comprises a Markov-process-based method to predict link popularity, and we use SDN technology to monitor network status. We implement the proposed method, and the experimental results indicate that Horizon can relieve congestion in DCNs to meet QoS requirements. The experimental results show that our approach has a similar performance to the optimal solution. When compared with the ECMP approach, our approach has a much lower latency. The results also show that the proposed approach is effective in terms of network congestion control.

Parallel Simulation and Virtual-Machine-Based Emulation of Software-Defined Networks

The emerging software-defined networking (SDN) technology decouples the control plane from the data plane in a computer network with open and standardized interfaces, and hence opens up the network designers’ options and ability to innovate. The wide adoption of SDN in industry has motivated the development of large-scale, high-fidelity testbeds for evaluation of systems that incorporate SDN. In this article, we develop a framework to support OpenFlow-based SDN simulation and distributed emulation, by leveraging our prior work on a hybrid network testbed with a parallel network simulator and a virtual-machine-based emulation system. We show how to exploit typical SDN controller behaviors to handle performance issues caused by the centralized controller in parallel discrete-event simulation. In particular, we develop an asynchronous synchronization algorithm for passive SDN controllers and design a two-level architecture for active SDN controllers. We evaluate the system performance, showing good scalability. Finally, we present a case study, using the testbed, to evaluate network verification applications in an SDN-based data center network.