Software Defined Networking System Research Articles

SPARQ: SYN Protection using Acyclic Redundancy check and Quartile range on P4 switches

Software-defined networking (SDN), enabled by high-performance programmable switches, offers a new avenue to counter cyber attacks. Programmable switches offer the ability to customize and conduct in-depth packet analysis, thus providing efficient and timely responses to DDoS attacks. However, implementing sophisticated DDoS detection may be a challenge in programmable switches because the p4 language does not support floating-point arithmetic, logarithmic functions, or loops. Furthermore, the limited SRAM and TCAM memory on programmable switches makes storing the network connection state difficult. Hence, effective deployment of DDoS detection techniques remains challenging due to these limitations and the rising complexity of the attacks. Many researchers proposed the DDoS detection solution directly on a programmable switch, ignoring the pressing need for a distributed solution. Therefore, this paper presents an innovative, decentralized traffic analysis framework called SPARQ that optimally utilizes the data and control planes. SPARQ is based on Rényi entropy that filters TCP SYN DDoS attacks. It leverages the programming ability of data planes for traffic classification and utilizes the control plane to calculate the metrics and acyclic redundancy checks within the traffic. Moreover, SPARQ uses quartile ranges to track packet inter-arrival time so that abnormal traffic patterns can be identified. We implement SPARQ in a BMv2 switch using the p4runtime controller, enabling seamless integration with SDN systems. We compare the performance of SPARQ with state-of-the-art solutions using the CAIDA dataset. The comparative analysis demonstrates that SPARQ provides a 20.59% reduction in CPU load, an average detection time shorter than 88%, and a 17.8% improvement in true positive rate (TPR).

FEAROL: Aging Flow Entries Based on Local Staircase Randomized Response for Secure SDN Flow Tables

Software-Defined Networking (SDN) systems are sensitive to the lifespans of flow entries in flow tables as such lifespans affect the overall network-forwarding latency and the flow table space usage, particularly when the systems are under cyber attack. Instead of developing extra approaches to reactively detect the attacks and mitigate the impact of the attacks, this paper views the lifespans of flow entries as the privacy of the SDN systems and proposes a Flow-Entry Aging RandOmization Layer (FEAROL), which applies the staircase randomized response mechanism in the flow-entry-aging process at switches. FEAROL locally perturbs the lifespan of each flow entry in the flow table. Since the true lifespan of each flow entry is different from the lifespan set in the entry by the controller and dynamically perturbed by FEAROL, Low-rate Denial-of-Service (LDoS) attacks based on the sniffed flow-entry timeouts cannot be effectively organized. FEAROL proactively prevents LDoS attacks from overflowing the flow tables and legitimate flow packets from being dropped due to the broken synchronization between attack flows and the network settings. FEAROL can adjust its aging policies and privacy budget based on the real-time monitored network performance. FEAROL is prototyped in an open-source soft switch (OpenVSwitch) and evaluated through simulations on real network traces. The results show that FEAROL increases the overhead of aging a flow entry. However, this overhead can be significantly reduced by adjusting the interval at which the aging process is triggered. FEAROL also effectively defends against flow table overflow LDoS attacks by significantly reducing the table usage of LDoS attack flows. When the aging strategy is carefully chosen, the table space used by attack flow entries can be reduced to 0.

SNAG: SDN-Managed Network Architecture for GridFTP Transfers Using Application-Awareness

Increasingly, academic campus networks support large-scale data transfer workflows for data-intensive science. These data transfers rely on high-performance, scalable, and reliable protocols for moving large amounts of data over a high-bandwidth, high-latency network. GridFTP is a widely used protocol for wide area network (WAN) data movement. However, as the GridFTP protocol does not share connection information with the network-layer, network operators have reduced flexibility, particularly in identifying/managing flows across the network. We address this problem by deploying a production “ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">application-aware</i> ” software defined network (SDN) for managing GridFTP transfers for data-intensive science workflows. We first propose a novel application-aware architecture called SNAG (SDN-managed Network Architecture for GridFTP transfers). SNAG combines <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">application-layer and network-layer collaboration</i> (termed “application-awareness”) with SDN-enabled network management to classify, monitor and to manage network resources actively. Until now, our SNAG deployment has successfully classified over <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1.5 Billion</i> GridFTP connections at the Holland Computing Center (HCC), University of Nebraska-Lincoln (UNL). Next, we develop an application-aware SDN system to provide differentiated network services for distributed computing workflows. At HCC, we also demonstrate how our system ensures the quality of service (QoS) for high-throughput workflows such as Compact Muon Solenoid (CMS) and Laser Interferometer Gravitational-Wave Observatory (LIGO). Further, we also demonstrate how application-aware SDN can be exploited to create <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">policy-driven</i> approaches to achieve accurate resource accounting for each workflow. We present strategies for implementing differentiated network services and discuss their capacity improvement benefits. Lastly, we provide some guidelines and recommendations for developing application-aware SDN architectures for general-purpose applications.

Asynchronous Federated Learning for Elephant Flow Detection in Software Defined Networking Systems

This paper introduces an Asynchronous Federated Learning (AFL) approach to train an elephant flow model over Software Defined Networking (SDN) systems with distributed controllers. The AFL addresses the issues of data privacy and communication overhead in collecting network statistics over large-scaled SDN systems. It allows each local controller to train a local model based on its local statistics using Decision Tree and upload the local model to the root in an asynchronous manner, so that the root controller can aggregate each local model into a global model once a local model is received to improve its time efficiency. The AFL proposes to weight the performance of each local model to form the global model. The evaluation based on 5 real packet traces demonstrates the accuracy of the AFL is better than any local models and two classical federated learning approaches.

Design and implementation of a secured SDN system based on hybrid encrypted algorithms

Software defined network suggests centralizing network knowledge in one network portion by separating the routing (control plane) mechanism from the transmission network packet operation (data plane). The control plane is composed of one, two or more controllers which are considered as software-defined networking (SDN) network brain where the real intelligence is incorporated. The process of separating the control unit from the data unit led to a problem related to poor security of data sent in the network, so solutions to these problems had to be found. In this paper, address this problem by implementing robust algorithms to encrypt information, based on advanced encryption standard (AES), Rivest–Shamir–Adleman (RSA), and hybrid encryption algorithms to guarantee data protection and authenticity. The results showed that the hybrid coding method is better in terms of security and improved time (faster than RSA alone) by applying several scenarios in the SDN network to a set of encrypted files.

Detecting Ddos Attack Using Adaptive Boosting with Software Defined Network in Cloud Computing Environment

Cloud computing is most widely used platform in past decade for computational operations in the computers and which offers the cost effective system with the measurable results. Cloud computing and software defined network (SDN) combination gives the better environment which reduces the difficulties with the cloud network and improves the dynamism, programmability, scalability and manageability of the cloud. Several weaknesses are attacked on one side by changing the SDN pattern into the centralized architecture namely as Distribute denial of service (DDoS) attacks. So these interrupts are detected and then prevented in SDN with the technology. Detecting of DDoS attack by using anomaly-based adaptive boosting in SDN cloud environment is presented in this paper. By coordinating the SDN features with the adaptive boosting algorithm, the cloud environment of SDN system DDoS attacks are noticed and prevented. Decision stump is used to generate the learning data and serves huge data to the servers within less time which is used as the prediction data. Predictions are can be processed by the formation of learning data. The experimental test results show that the adaptive boosting algorithm with SDN features has effectiveness in detecting attacks with high accuracy and in the SDN the DDoS attacks are detected even in the low communication.

Genetic Algorithms with Variant Particle Swarm Optimization Based Mutation for Generic Controller Placement in Software-Defined Networks

To enable learning-based network management and optimization, the 5th Generation Mobile Communication Technology and Internet of Things systems usually involve software-defined networking (SDN) architecture and multiple SDN controllers to efficiently collect the big volume of runtime statistics, define network-wide policies, and enforce the policies over the whole network. To better plan the placement of controllers over SDN systems, this article proposes a generic controller placement problem (GCP) that considers the organization and placement of controllers as well as the switch attachment to optimize the delay between controllers and switches, the delay among controllers, and the load imbalance among controllers. To solve this problem without losing generality, a novel multi-objective genetic algorithm (MOGA) with a mutation based on a variant Particle Swarm Optimization (PSO) is proposed. This PSO chooses a global best position for a particle according to a pre-computed global best position set to lead the mutation of the particle. It successfully handles multiple conflicting objectives, fits the scenario of mutation, and can apply in many other flavors of MOGAs. Evaluations over 12 real Internet service provider networks show the effectiveness of our MOGA in reducing convergence time and improving the diversity and accuracy of the Pareto frontiers. The proposed approaches in formulating and solving the GCP in this article are general and can be applied in many other optimization problems with minor modifications.

A Software Defined Network information security risk assessment based on Pythagorean fuzzy sets

The concept of software-defined networking is introduced to the networking domain to enhance networking capabilities to cope with network resources’ fast-growing requirements. Initially, security in Software Defined Network (SDN) is not considered as a priority concern, but later many research surveys taken place for determining the security loopholes in SDN architecture. To date, no algorithm exists for determining information security in contrast to SDN architecture or SDN based architecture. Here, a mechanism is introduced to determine the information risk associated with SDN or SDN based architecture. The SDN properties influence themselves; thus, the Multi-Criteria Decision Making (MCDM) method is incorporated in the proposed algorithm as a comprehensive mechanism while determining the information risk. To be specific, this proposed algorithm is divided into three different phases wherein; the first phase incorporates the Pythagorean Fuzzy Decision-Making Trial and Evaluation Laboratory method (PFDEMATEL) for determining the influences among SDN properties and vulnerabilities. The second phase implements the Pythagorean Fuzzy Analytical Hierarchical Process (PFAHP) for evaluating the priority of the severity weights of SDN properties along with vulnerabilities. Lastly, phase 3 implements information entropy to determine the overall SDN system risk. Our proposition is introduced in the first place to help the network administrator to determine associated risk in their SDN or SDN based architecture before the actual implementation and take proper countermeasures while implementing.

An Analysis of Load Balancing Algorithm Using Software- Defined Network

A data center is one of the secured space which serves as a house for many disks, switches, servers, routers, and several other hardware for a computer. It is a hardware solution for users who are present near the data center. Cloud Computing (CC) is the newer version of the data center which is capable of giving computer services to the users. Cloud service is the one which provides the users with data center set up when needed or preferred by the user themselves. In general cloud network service will be limited to a particular location or zone. In case if the target area of the user is near then the server will complete the action needed for the user. Only certain servers can provide service for the user in such cases some servers will remain idle. If the provided service by the servers is not used properly this may also lead to the issue of processing and managing a larger set of traffic which is one of the difficult tasks to perform. More network traffic may lead to giving more amount of pressure and complexity to the data center. In such a case Load Balancing (LB) is the preferred process for reducing the network failure and degradation process of the entire network. Software-defined networking is one the upcoming process which is capable of managing the entire network and also gives a general view about the network and its further configuration which needed to be upgraded. In this research paper, a software-defined network is developed for LB algorithms. In this paper, a Dynamic Server LB algorithm (Dserv- LB) is used for open-flow switches in the software-defined network system. This algorithm is one of the packet type LB algorithm. The request in the server is directly forwarded to the web-server with a higher level of server resources. From the result of the proposed algorithm, it was found that Dserv-LB is capable of improving the performance of the entire network and properly uses the server resource.

Joint Switch–Controller Association and Control Devolution for SDN Systems: An Integrated Online Perspective of Control and Learning

In software-defined networking (SDN) systems, it is a common practice to adopt a multi-controller design and control devolution techniques to improve the performance of the control plane. However, in such systems the decision-making for joint switch-controller association and control devolution often involves various uncertainties, e.g., the temporal variations of controller accessibility, and computation and communication costs of switches. In practice, statistics of such uncertainties are unattainable and need to be learned in an online fashion, calling for an integrated design of learning and control. In this article, we formulate a stochastic network optimization problem that aims to minimize time-average system costs and ensure queue stability. By transforming the problem into a combinatorial multi-armed bandit problem with long-term stability constraints, we adopt bandit learning methods and optimal control techniques to handle the exploration-exploitation tradeoff and long-term stability constraints, respectively. Through an integrated design of online learning and online control, we propose an effective Learning-Aided Switch-Controller Association and Control Devolution ( LASAC ) scheme. Our theoretical analysis and simulation results show that LASAC achieves a tunable tradeoff between queue stability and system cost reduction with a sublinear time-averaged regret bound over a finite time horizon.

Predictive Switch-Controller Association and Control Devolution for SDN Systems

For software-defined networking (SDN) systems, to enhance the scalability and reliability of control plane, existing solutions adopt either multi-controller design with static switch-controller association, or static control devolution by delegating certain request processing back to switches. Such solutions can fall short in face of temporal variations of request traffics, incurring considerable local computation costs on switches and their communication costs to controllers. So far, it still remains an open problem to develop a joint online scheme that conducts dynamic switch-controller association and dynamic control devolution. In addition, the fundamental benefits of predictive scheduling to SDN systems still remain unexplored. In this paper, we identify the non-trivial trade-off in such a joint design and formulate a stochastic network optimization problem which aims to minimize time-averaged total system costs and ensure long-term queue stability. By exploiting the unique problem structure, we devise a predictive online switch-controller association and control devolution (POSCAD) scheme, which solves the problem through a series of online distributed decision making. Theoretical analysis shows that without prediction, POSCAD can achieve near-optimal total system costs a tunable trade-off for queue stability. With prediction, POSCAD can achieve even better performance with shorter latencies. We conduct extensive simulations to evaluate POSCAD. Notably, with mild-value of future information, POSCAD incurs a significant reduction in request latencies, even when faced with prediction errors.

Towards Distributed SDN: Mobility Management and Flow Scheduling in Software Defined Urban IoT

The growth of Internet of Things (IoT) devices with multiple radio interfaces has resulted in a number of urban-scale deployments of IoT multinetworks, where heterogeneous wireless communication solutions coexist (e.g., WiFi, Bluetooth, Cellular). Managing the multinetworks for seamless IoT access and handover, especially in mobile environments, is a key challenge. Software-defined networking (SDN) is emerging as a promising paradigm for quick and easy configuration of network devices, but its application in urban-scale multinetworks requiring heterogeneous and frequent IoT access is not well studied. In this paper we present UbiFlow, the first software-defined IoT system for combined ubiquitous flow control and mobility management in urban heterogeneous networks. UbiFlow adopts multiple controllers to divide urban-scale SDN into different geographic partitions (assigning one controller per partition) and achieve distributed control of IoT flows. A distributed hashing based overlay structure is proposed to maintain network scalability and consistency. Based on this UbiFlow overlay structure, the relevant issues pertaining to mobility management such as scalable control, fault tolerance, and load balancing have been carefully examined and studied. The UbiFlow controller differentiates flow scheduling based on per-device requirements and whole-partition capabilities. Therefore, it can present a network status view and optimized selection of access points in multinetworks to satisfy IoT flow requests, while guaranteeing network performance for each partition. Simulation and realistic testbed experiments confirm that UbiFlow can successfully achieve scalable mobility management and robust flow scheduling in IoT multinetworks; e.g., 67.21 percent throughput improvement, 72.99 percent reduced delay, and 69.59 percent jitter improvements, compared with alternative SDN systems.

A low latency service function chain with SR-I/OV in software defined networks

A network flow is required to be processed by multiple network functions such as PGW and SGW in mobile networks as a service function chain (SFC). Compared to hardware-based network functions, virtualized network functions are more flexible for deployment. Software defined network (SDN) provides a centralized network architecture to manage network resources and route the network flow among network functions in sequence and virtual machines are leveraged to deploy the network functions as network function virtualization (NFV). However, currently the performance of NFV suffers from I/O latency because packet processing causes lots of interrupts that decreases CPU utilization. To address the I/O latency issue, SR-I/OV network card is designed to replace OpenvSwitch in host machines to reduce the system interrupts. However, SR-I/OV is not compatible with existing SDN system, which is an important component in future 5G networks. Therefore, we propose an integrated architecture called the low latency service function chain from a wider perspective in system design to overcome main defects described above. We modify appropriate components in SR-I/OV driver and OpenvSwitch to dramatically reduce packet processing latency in SFC composed by several VNFs. Moreover, our design is compatible with SDN environment and benefited by central control.

Detecting Saturation Attacks Based on Self-Similarity of OpenFlow Traffic

As a new networking paradigm, Software-Defined Networking (SDN) separates data and control planes to facilitate programmable functions and improve the efficiency of packet delivery. Recent studies have shown that there exist various security threats in SDN. For example, a saturation attack may disturb the normal delivery of packets and even make the SDN system out of service by flooding the data plane, the control plane, or both. The existing research has focused on saturation attacks caused by SYN flooding. This paper presents an anomaly detection method, called SA-Detector, for dealing with a family of saturation attacks through IP spoofing, ICMP flooding, UDP flooding, and other types of TCP flooding, in addition to SYN flooding. SA-Detector builds upon the study of self-similarity characteristics of OpenFlow traffic between the control and data planes. Our work has shown that the normal and abnormal traffic flows through the OpenFlow communication channel have different statistical properties. Specifically, normal OpenFlow traffic has a low self-similarity degree whereas the occurrences of saturation attacks typically imply a higher degree of self-similarity. Therefore, SA-Detector exploits statistical results and self-similarity degrees of OpenFlow traffic, measured by Hurst exponents, for anomaly detection. We have evaluated our approach in both physical and simulation SDN environments with various time intervals, network topologies and applications, Internet protocols, and traffic generation tools. For the physical SDN environment, the average accuracy of detection is 97.68% and the average precision is 94.67%. For the simulation environment, the average accuracy is 96.54% and the average precision is 92.06%. In addition, we have compared SA-Detector with the existing saturation attack detection methods in terms of the aforementioned performance metrics and controller’s CPU utilization. The experiment results indicate that SA-Detector is effective for the detection of saturation attacks in SDN.

Enabling Digital Grid for Industrial Revolution: Self-Healing Cyber Resilient Platform

Driving digital grid development to provide sustainable, reliable and secure network systems requires deploying a variety of applications against any potential cyber attacks. Therefore, there is an urgent demand to accelerate the development of an intelligent Software-Defined Networking (SDN) platform that can address the tremendous challenges of data protection for digital resiliency. Modern grid technology tends to adopt distributed SDN controllers for further slicing power grid domain and protect the boundaries of electric data at network edges. To facilitate these techniques, this article proposes an intelligent secure SDN controller for supporting digital grid resiliency, considering management coordination capability, self-healing features and recovery of network traffic forwarding during service interruptions. A set of advanced features are employed in grid controllers to configure the network elements in response to possible disasters or link failures. In addition, various SDN topology scenarios are introduced for efficient coordination and configurations of network domains. Finally, to justify the potential advantages of an intelligent secure SDN system, a case study is presented to evaluate the requirements of secure digital modern grid networks and pave the path toward the next phase of industry revolution.

Defending Against Flow Table Overloading Attack in Software-Defined Networks

The Software-Defined Network (SDN) is a new and promising network architecture. At the same time, SDN will surely become a new target of cyber attackers. In this paper, we point out one critical vulnerability in SDNs, the size of flow table, which is most likely to be attacked. Due to the expensive and power-hungry features of Ternary Content Addressable Memory (TCAM), a flow table usually has a limited size, which can be easily disabled by a flow table overloading attack (a transformed DDoS attack). To provide a security service in SDN, we proposed a QoS-aware mitigation strategy, namely, peer support strategy, which integrates the available idle flow table resource of the whole SDN system to mitigate such an attack on a single switch of the system. We established a practical mathematical model to represent the studied system, and conducted a thorough analysis for the system in various circumstances. Based on our analysis, we found that the proposed strategy can effectively defeat the flow table overloading attacks. Extensive simulations and testbed-based experiments solidly support our claims. Moreover, our work also shed light on the implementation of SDN networks against possible brute-force attacks.

Routing Strategy for Internet of Vehicles based on Hierarchical SDN and Fog Computing

The fog computing is invited to solve the lack of resources problem in the sensors of Internet of Things (IoT) and handle the tasks quickly. Internet of Vehicles (IoV) is a special application of IoT networks that composed of heterogeneous sensors that are found in vehicles. These sensors transfer the tasks to the fog servers that process them and give the responses to the sensors. However, the mobility of vehicles effects on the delivery operation of responses. When the source vehicle of a task exited from the domain of some fog server through the processing time of this task, the response will not be reached to that vehicle correctly. Therefore, it is need to compute the optimal path to that vehicle. This process causes exceeding the task deadline and decreasing the throughput. To overcome this issue, this paper produces a hierarchical architecture based on Software Defined Network (SDN) and fog computing for IoV networks. This architecture consists of IoV vehicles, fog computing framework, semi-central SDN controllers and central SDN controller layers. Moreover, a routing strategy is proposed called Delay-Efficient Routing strategy based on SDN and Fog computing for IoV (DRSFI). The SDN controllers perform DRSFI to compute the routes with minimum delay with taking into consideration the available bandwidth constraint and the location and speed of the vehicle. From the results of simulation of different scenarios with various mobility speeds and various number of tasks, we concluded that the proposed system is better than IoV-Fog-central SDN system and IoV-Fog system in terms of average delay from end to end, percentage of packet loss and percentage of successfully transmission.&#x0D;

Implementation of a real-time network traffic monitoring service with network functions virtualization

The Network Functions Virtualization (NFV) extends the functionality provided by Software-Defined Networking (SDN). It is a virtualization technology that aims to replace the functionality provided by traditional networking hardware using software solutions. Thereby, enabling cheaper and efficient network deployment and management. The use of NFV and SDN is anticipated to enhance the performance of Infrastructure-as-a-Service (IaaS) clouds. However, due to the presence of a large number of network devices in IaaS clouds offering a plethora of networked services, there is need to develop a traffic monitoring system for the efficient network. This paper proposes and validates an extensible SDN and NFV-enabled network traffic monitoring system. Using extensive experiments, we show that the proposed system can closely match the performance of traditional networks at cheaper costs and by adding more flexibility to network management tasks.

Implementation experience in multi-domain SDN: Challenges, consolidation and future directions

Network architectures compliant with the Software Defined Networking (SDN) design paradigm, are expected to provide extreme flexibility for service orientation and allow for efficient use of network resources of cloud systems. Nevertheless, radical reconsidering and removal of boundaries set out when studying multi-domain communications are required, in order to unleash the hidden potential of SDN and provide a “holistic” network view. Although many domain-specific efforts have been proposed in the literature and indeed they gain a lot of industrial attention, real multi-domain SDN implementations over converged wireless-optical networks are just starting to disclose.In this work we present an open end-to-end multi-domain SDN system, while focusing on the necessary abstractions and virtualization techniques to integrate virtual wireless and optical resources. With the proposed system, called CONTENT, we shed light in the field of wireless-optical network virtualization from an end-to-end perspective. We present the architecture and the integrated testbed that realize the envisioned system. Evaluation results are provided and implementation experience is reported using the integrated solution. The way SDN methodologies and techniques can be used to support NFV concepts in end-to-end fashion are also presented.

Developing and Deploying a Carrier-Class SDN-Centric Network Management System for a Tier 1 Service Provider Network

Software-defined networking (SDN) has considerably shaken the telecommunications industry, with almost every major vendor upgrading their product portfolio and all providers building use cases to inculcate the SDN concept. Significant collaborative activity is underway toward a common set of SDN standards. However, with a huge amount of existing network gear, one question remains: How should providers adopt SDN given the existing infrastructure? To this end, we have developed a well-standardized technology with minor tweaks and created a hardware paradigm whose forwarding plane conforms to carrier-class standards, but whose control plane caters to the SDN philosophy. This paper discusses our experience building such a control plane and its subsequent deployment. We describe the design and implementation of a network management system (NMS) for carrier-class networks using carrier Ethernet manifestations. The management system subscribes to the SDN philosophy, thereby facilitating user-control-based provisioning and service definitions. A centralized controller communicates with carrier Ethernet switch routers (CESRs) that provision services based on multiple identifiers such as IPv6, IPv4, MAC, CTAG/STAG, and port-based identifiers. In this paper, we describe the design of the controller in the NMS and the control state-machine in the CESR, as well as their interactions. The paper details the concepts underlying the SDN system as well as its module-level and service-level implementation aspects. Our key contribution is that the CESR we built along with the SDN NMS is put to the test in a tier 1 provider network, thereby facilitating real network performance measurement. A citywide network was built and we present its results in this paper.