Software Defined Networking Data Plane Research Articles

Multi-Stage Learning Framework Using Convolutional Neural Network and Decision Tree-Based Classification for Detection of DDoS Pandemic Attacks in SDN-Based SCADA Systems

Supervisory Control and Data Acquisition (SCADA) systems, which play a critical role in monitoring, managing, and controlling industrial processes, face flexibility, scalability, and management difficulties arising from traditional network structures. Software-defined networking (SDN) offers a new opportunity to overcome the challenges traditional SCADA networks face, based on the concept of separating the control and data plane. Although integrating the SDN architecture into SCADA systems offers many advantages, it cannot address security concerns against cyber-attacks such as a distributed denial of service (DDoS). The fact that SDN has centralized management and programmability features causes attackers to carry out attacks that specifically target the SDN controller and data plane. If DDoS attacks against the SDN-based SCADA network are not detected and precautions are not taken, they can cause chaos and have terrible consequences. By detecting a possible DDoS attack at an early stage, security measures that can reduce the impact of the attack can be taken immediately, and the likelihood of being a direct victim of the attack decreases. This study proposes a multi-stage learning model using a 1-dimensional convolutional neural network (1D-CNN) and decision tree-based classification to detect DDoS attacks in SDN-based SCADA systems effectively. A new dataset containing various attack scenarios on a specific experimental network topology was created to be used in the training and testing phases of this model. According to the experimental results of this study, the proposed model achieved a 97.8% accuracy rate in DDoS-attack detection. The proposed multi-stage learning model shows that high-performance results can be achieved in detecting DDoS attacks against SDN-based SCADA systems.

An Optimized Routing Scheme in SDN-Based IoT Using the Lion Optimization Algorithm

The Internet of Things (IoT) speaks to the current and future state of the Internet. Numerous things (objects) related to the Internet generate a large amount of information that requires a ton of labor and prepare tasks to move to valuable data. In addition, for the association and control of this enormous information, the original ideas in the project and the executives of the IoT system need to expedite and improve its presentation. A software-defined networking (SDN) system is another worldview that has recently emerged to cover all the complexities in the traditional system architecture by summarizing all the controls and management functions from the basic devices (things in IoT). The open-flow protocol is used to make messages between switches and controllers. It is a correspondence conference, through which the controller integrates the path of the network pocket with switches. Therefore, data packets should be directed to the optimum path to improve system operation. The best or optimal path for packet routing in the SDN data plane is found using the Lion Optimization Algorithm (LOA), which is proposed in this study. Response times and packet loss rates can both be decreased by choosing the best route between the hosts. The suggested LOA outperforms current optimal path detection methods in terms of performance, delay, packet delivery rate, performance, and pocket loss rate, according to simulation findings.

Flow Table Overflow Attacks in Software Defined Networks: A Survey

<p>While Software-Defined Networks (SDNs) have separated control and data planes and completely decouple the flow control from the data forwarding to enable network flexibility, programmability, and innovation, they also raise serious security concerns in each plane and the interfaces between the two planes. This paper, instead of studying the security issues in the SDN control plane as many literatures have done in current research, focuses on the security issues in the SDN data plane, aiming at the state of the art mechanims to identify, detect, and mitigate them. Specifically, this paper reviews the typical models, detections, and mitigations of SDN flow table overflow attacks. After reviewing the various vulnerabilities in SDNs, this paper categorizes the flow table overflow attacks into saturation, low-rate table exhaustion, and slow saturation attacks, and summarizes the attack models, detections, and mitigations of each category. It reviews the typical attacks that can overflow the flow tables and provides the main challenges and open issues for the future research.</p> <p> </p>

An intelligent zero trust secure framework for software defined networking

Software-defined networking (SDN) faces many of the same security threats as traditional networks. The separation of the SDN control plane and data plane makes the controller more vulnerable to cyber attacks. The conventional “perimeter defense” network security model cannot prevent lateral movement attacks caused by malicious insider users or hardware and software vulnerabilities. The “zero trust architecture” has become a new security network model to protect enterprise network security. In this article, we propose an intelligent zero-trust security framework IZTSDN for the software-defined networking by integrating deep learning and zero-trust architecture, which adopts zero-trust architecture to protect every resource and network connection in the network. IZTSDN uses a traffic anomaly detection mode CALSeq2Seql based on a deep learning algorithm to analyze users’ network behavior in real-time and achieve continuous tracking and analysis of users, restrict malicious users from accessing network resources, and realize the dynamic authorization process. Finally, the Mininet simulation platform is extended to build the simulation platform MiniIZTA supporting zero-trust architecture and the proposed security framework IZTSDN is experimentally analyzed. The experimental results show that the IZTSDN security framework can provide about 80.5% of throughput when the network is attacked. The accuracy of abnormal traffic detection reaches 99.56% on the SDN dataset, which verifies that the reliability and availability of the IZTSDN security framework are verified.

A deep learning technique to detect distributed denial of service attacks in software-defined networks

Software-Defined Network (SDN) is an established networking paradigm that separates the control plane from the data plane. It has central network control, and programmability facilities, therefore SDN can improve network flexibility, management, performance, and scalability. The programmability and control centralization of SDN have improved network functions but also exposed it to security challenges such as Distributed Denial of Service (DDoS) attacks that target both control and data planes. This paper proposes an effective detection technique against DDoS attack in SDN control plane and data plane. For the control plane, the technique detects DDoS attacks through a Deep Learning (DL) model using new features extracted from traffic statistics. A DL method (AE-BGRU) for DDoS detection uses Autoencoder (AE) with Bidirectional Gated Recurrent Unit (BGRU). The proposed features for the control plane include unknown IP destination address, packets inter-arrival time, Transport layer protocol (TLP) header, and Type of service (ToS) header. For the data plane, the technique tracks the switch's average arrival bit rate with an unknown destination address in the data plane. Then, the technique detects DDoS attacks through a DL-based model which also uses AE with BGRU. The proposed features in the data plane include the switch's stored capacity, the average rate of packets with unknown destination addresses, the IP Options header, and the average number of flows. The dataset is generated from feature extraction and computations from normal and attack packets and used with the classifier. Also, additional Machine Learning (ML) methods are used to enhance the detection process. If the model detects an attack, the technique mitigates DDoS effects by updating the user's trust value and blocking suspicious senders based on the trust value. The experimental results proved that compared to related techniques, the suggested method had a higher accuracy and lower false alarm rate.

FFRLI: Fast fault recovery scheme based on link importance for data plane in SDN

For many years, link fault recovery has always been a hotspot problem in Software-Defined Networking (SDN). Current researches mainly include proactive and reactive schemes. However, proactive scheme wastes the Ternary Content Addressable Memory (TCAM) and bandwidth resources seriously, and reactive scheme has a long recovery time. Hence, none of them qualifies as a complete solution. In this paper, we present a new two-stage fast fault recovery scheme based on link importance (FFRLI) to balance backup resource consumption and recovery time. In stage 1, FFRLI innovatively introduces Markov chains and pinning control to evaluate the importance and rank of different links, and labels them as main link, minor link and edge link. On this basis, in stage 2, we develop different recovery schemes and optimization objectives for different links. More specifically, for main links, we minimize the hops of backup path and install flow rules into switches in advance. Similarly, we store backup path of minor link in controller, and improve A-star algorithm to minimize hops and distance of backup path. Finally, FFRLI takes reactive recovery for edges link and adopts bidirectional Dijkstra to reduce backup path calculation time. Compared to existing state-of-the-art solutions, the simulation results present that FFRLI can effectively balance the consumption of backup resource and fault recovery time, and achieve fast fault link recovery.

GASF-IPP: Detection and Mitigation of LDoS Attack in SDN

Software defined networking (SDN), a highly regarded architecture, enhances the programmability and manageability of the network by decoupling the data plane and the control plane. It has emerged to bring more possibilities to the Internet, but at the same time, its inherent shortcomings have become a pool for malicious attackers. Low-rate denial of service (LDoS) attacks, a variant of denial of service attacks, also pose a threat to the SDN architecture. In this paper, we replicate LDoS attacks for the SDN data plane and propose a detection and mitigation framework called GASF-IPP based on multiple traffic and IP-port data by analyzing the network anomalies. By leveraging the OpenFlow protocol, the traffic of switches is monitored. We use Gramian angular summation field (GASF) transformation based on timing analysis to analyze the traffic and combine it with other features to determine whether an attack has occurred. By locating the attacker and the victim, flow rules can be constructed for mitigation. Experiments prove that our proposed framework is correct and effective, the detection and mitigation module can perform real-time work with a low false positive rate (FPR) and respond in average 6.77 s.

ENHANCING SECURITY IN SOFTWARE-DEFINED NETWORKING THROUGH ROUTING TECHNIQUES EXPLORATION

In today's world, network security is a key issue of information security. Virtual Networks have become an integral part of modern IT infrastructure, which presents us with challenges in the field of security. One solution to this problem is the use of software-defined networking (SDN), which provides a means to control and manage network traffic. However, as with any technology, SDN has its vulnerabilities that must be considered when deploying it. One of the tools that helps to take into account the vulnerabilities of network infrastructure is the Common Vulnerability Scoring System (CVSS) standard. It allows you to quantify the level of vulnerability of the infrastructure, which enables effective network protection. Analysis of the CVSS standard is an important stage in the development of a network security strategy. This paper analyzes the standards for building software-configured networks. It is noted that SDN is a modern approach to the design, construction, and operation of information communication networks. Using SDN makes it possible to directly program and dynamically manage the network, as well as to abstract the functionality of the infrastructure layer. However, the growing interest in SDN has revealed the shortcomings of their application in the fight against cybersecurity threats. The SDN architecture itself, external malicious attacks, and insufficient access control and encryption tools were found to be the main security challenges. The use of secure routing tools based on vulnerability metrics is proposed to increase the level of SDN data plane network security. According to the conducted analysis of SDN data plane vulnerabilities and the functionality of routing tools, the authors recommend using the CVSS standard to quantify the level of infrastructure vulnerability during the development and research of promising approaches to secure routing in the data plane of software-configured networks.

The LOFT Attack: Overflowing SDN Flow Tables at a Low Rate

The emerging Software-Defined Networking (SDN) is being adopted by data centers and cloud service providers to enable flexible control. Meanwhile, the current SDN design brings new vulnerabilities. In this paper, we explore a stealthy attack that uses a minimum rate of attack packets to disrupt SDN data plane. To achieve this, we propose the LOFT attack that computes the lower bound of attack rate to overflow flow tables based on the inferred network configurations. Particularly, each attack packet always triggers or maintains consumption of one flow rule. LOFT can ensure the attack effect under various network configurations while reducing the possibility of being captured. We demonstrate its feasibility and effectiveness in a real SDN testbed consisting of commercial hardware switches. The experimental results show that LOFT incurs significant network performance degradation and potential network DoS at an attack rate of only tens of Kbps. To defeat the attack, we develop a data-to-control plane collaborative defense system named LOFTGuard, which is lightweight and transparent to SDN applications. Evaluations show that Guard effectively protects SDN against the attack and introduces a small overhead.

SECURING CENTRALIZED SDN CONTROL WITH DISTRIBUTED BLOCKCHAIN TECHNOLOGY

Software Defined Networks (SDN) advocates segregation of network control logic, forwarding functions and management applications into different planes to achieve network programmability, automated and dynamic flow control in next generation networks. It promotes deployment of novel and augmented network management functions to have flexible, robust, scalable and cost-effective network deployments. All these features introduce new research challenges and require secure communication protocols among the segregated network planes. This manuscript focuses on the security issue of southbound interface which operates between the SDN control and data plane. We have highlighted the security threats associated with an unprotected southbound interface and the issues related with the existing TLS based security solution. A lightweight blockchain based decentralized security solution is proposed for southbound interface to secure the resources of logically centralized SDN controllers and distributed forwarding devices from opponents. The proposed mechanism can operate in multi-domain SDN deployment and can be used with wide range of network controllers and data plane devices. In addition to it, the proposed security solution is analyzed in terms of security features, communication and reauthentication overhead.

Investigation of secure routing models based on basic vulnerability metrics in SDN networks

The article presents and investigates flow-based models of secure routing under base score metrics of vulnerability criticality in Software-Defined Networks (SDN). The analysis of the routing means functionality against possible attacks confirmed the perspective of their application, taking into account the base score metrics of vulnerability criticality to increase the level of network security of the SDN data plane. It is proposed to improve the existing secure routing model taking into account the base score metrics of vulnerability criticality by modifying the routing metrics so that the resulting model acquires the properties of secure QoS routing. In the improved model, the optimal route was chosen considering base score metrics of vulnerability criticality and the bandwidth of the communication links that make up this route. In addition, the quadratic optimality criterion is used in the model for the balanced distribution of flows transmitted in the data plane of the software-defined network into sub-flows taking into account the multipath routing strategy. The comparative analysis of the existing secure routing model, the QoS-routing model with metrics similar to the OSPF protocol, and the improved secure-QoS-routing model taking into account the base score metrics of vulnerability criticality proved the adequacy and efficiency of the model proposed in work. The comparison of models was based on calculating the compromise probability of the transmitted packet flow.

Hierarchical Domain-Based Multicontroller Deployment Strategy in SDN-Enabled Space–Air–Ground Integrated Network

The space–air–ground integrated network (SAGIN) is considered to be a significant framework for realizing the vision of “6G intelligent connection of all things.” A typical SAGIN consists of three parts: a space-based network composed of various orbiting satellites, an air-based network composed of aircraft, and a traditional ground-based network. Considering the cost of satellite launch, the network needs to be flexible and controllable. In order to ensure that the ground can handle satellite anomalies in real time by program, it is necessary to introduce in-orbit programmable networks, such as the software-defined network (SDN). In the network management architecture, if the controller plane in the SDN adopts the flat management scheme, the expansion of the control plane is limited due to the low efficiency of data synchronization among controllers. Compared with controller deployments on terrestrial networks, multicontroller deployments in the SAGIN face the following problems: the dynamic change of the satellite network topology, the large-scale network nodes, the increase or decrease in the number of aerial vehicles, and the unbalanced distribution of ground users. Therefore, it is of great significance to study how to optimize the deployment of multiple controllers in the SDN-enabled SAGIN. This article introduces an SDN into the SAGIN and designs a hierarchical domain-based SDN-enabled SAGIN architecture. A multicontroller deployment strategy for the hierarchical domain-based SDN-enabled SAGIN is proposed. First, we divide the SDN control plane into two layers, i.e., the primary controller layer is deployed on the ground network and the secondary on the space-based network. The SDN data plane is composed of space-based, air-based, and ground-based networks. Second, considering the average network delay and the controller load, a multiobjective optimization model is constructed. To determine the number of controllers and the relative positions of switch nodes and controllers, the clustering algorithm based on <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> -means is adopted to initially divide the data plane. Finally, to improve the global search ability of the algorithm, a multiobjective optimization algorithm based on a genetic algorithm is adopted. The simulation results show that the proposed strategy is effective in reducing the average network delay and improving the controller load balance. Compared to other algorithms, the average network delay is reduced by 13.3% and the controller load is improved by 10.33%.

Latency control in service chaining using P4-based data plane programmability

Service chaining is becoming one of the most considered service deployment frameworks in the context of Network Function Virtualization (NFV) in edge and data center environments, conveniently supported by automatic connectivity configurations offered by Software Defined Networking (SDN). Current research on the topic is focusing on how to guarantee Quality of Service (QoS) in terms of guaranteed end-to-end latency for time critical services. Indeed, latency issues may depend on intra-server virtualization inefficiencies, leading to Virtual Network Function (VNF) delivery delays, or by congestion events occurring at intermediate network elements connecting VNFs. Latency control requires stateful information such as flow delay measurements at a per-packet level, typically not available at traditional SDN switches or inside the VNF. This paper proposes the adoption of SDN data plane programmability exploiting the P4 language and presents two P4 pipeline solutions, suitable for both intra-rack and inter-rack service chain deployments, to automatically check the path latency experienced by selected high priority flows, also resorting to the recent in-band telemetry applications. The programmable pipelines enforce proactive in-network functions, such as priority change or drop actions, in order to guarantee a bound SFC segment latency delivery, including both the network and the segment VNFs. The proposed solutions are implemented and evaluated in a network testbed employing programmable software switches showing their effectiveness in guaranteeing the configured end-to-end latency, and the limited effort in terms of additional processing at the P4 switch. The evaluation is carried out using the reference P4 software switch, i.e., BMv2. The aim is to validate the full P4 capabilities and the code feasibility in terms of scalability, load and resource impact and added intra-switch latency. The experimental results show the proposed approach scales with the number of forwarded flows and achieves per-segment latency control enforcement in both congested and non-congested scenarios with a very limited impact on the switch extra-latency, exploiting finer per-packet tuning of drop and priority change simply applicable through flow entry configuration. Applicability analysis on hardware switches guaranteeing line rate performance are provided.

Scalable and Flexible Traffic Steering for Service Function Chains

Network Function Virtualization (NFV) has inspired numerous orchestration algorithms to decide Virtualized Network Function (VNF) placement and routing paths for service requests with Service Function Chain (SFC) demands. With different optimization goals, these algorithms may select various routing paths for request flows. Nevertheless, existing traffic steering solutions either fail to fully support NFV Orchestrator (NFVO) in path selection, or result in low scalability in the underlay Software Defined Network (SDN). In this paper, we propose STAR to tackle both problems simultaneously. STAR divides the entire routing path for SFC request into several path segments, then performs Output-Port-based, Default-Path-based or RSP-ID-based traffic steering on each path segment. With the idea of path division and these traffic steering mechanisms, STAR achieves flexible traffic steering along any paths selected by NFVO and enables different Rendered Service Paths (RSPs) with the same path segments to share the same forwarding rules. In this way, STAR ensures the correct enforcement of path selection decisions from NFVO and significantly reduces forwarding rule consumption and control overhead. We evaluate STAR with the experiments on a real testbed and large-scale simulations. The results show that our framework is scalable in the SDN data plane and control plane (e.g., reducing rules in hardware switches by more than 70% compared with NSH-based solutions) while retaining the flexibility of steering traffic along any SFC routing paths to provide full support for path decision enforcement (e.g., achieving the highest path decision enforcement ratio in 11 of the 12 cases) with acceptable overhead.

DeepAir: Deep Reinforcement Learning for Adaptive Intrusion Response in Software-Defined Networks

In this paper, we propose an adaptive intrusion response solution based on deep reinforcement learning, namely DeepAir, to effectively defend against cyber-attacks in Software-Defined Networks (SDN). Specifically, we first study an intrusion response system (IRS) that operates at the SDN control plane. Next, we propose a dynamic intrusion response solution to maximize the attack defense performance while minimizing the negative impact on benign traffic forwarding and the policy deployment cost in the SDN data plane. Then, we model the intrusion response system based on a Markov decision process (MDP) approach and formulate the related optimization problem. Afterward, we develop a Double Deep <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${Q}$ </tex-math></inline-formula> -Network based intrusion response control algorithm to assist the intrusion response system to quickly obtain the optimal intrusion response policy. In our case study, we consider denial-of-service (DoS) attacks—the performance evaluation results demonstrate that DeepAir can effectively prevent malicious packets from arriving at the victim in all considered DoS attack scenarios, i.e., approximately 85% of attack packets are dropped. Moreover, by applying the optimal intrusion response policy, DeepAir can significantly reduce the ratio of Quality-of-Service violated traffic flows compared to a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${Q}$ </tex-math></inline-formula> -learning based approach (by 70%), and to two existing solutions, i.e., GATE (by 75%) and GTAC-IRS (by 80%), respectively.

Network Slicing for mMTC and URLLC Using Software-Defined Networking with P4 Switches

Massive machine-type communication (mMTC) and ultra-reliable low-latency communication (URLLC) are two key services in fifth-generation (5G) mobile wireless networks. These networks have been developed with extremely high service quality requirements: scalability for mMTC and reliability with low latency for URLLC. Fifth-generation network slicing will play a key role in supporting the distinct requirements of various services. Software-defined networking (SDN), a promising technology for network softwarization, physically separates the network control plane from the data plane by centrally controlling switches with an SDN controller. However, control channel bottleneck and processing delays due to this centralized control may reduce the scalability, reliability, and security of SDN. This paper proposes an SDN framework with programming protocol–independent packet processor (P4) switches (SDNPS), and defines a packet format containing in-band network telemetry data to simultaneously support heavy Internet of Things and URLLC traffic in 5G network slices. The method both satisfies the requirements of mMTC and URLLC and alleviates the load on the SDN controller. P4 is an advanced switch interface technology that provides enhanced stateful forwarding and reveals a persistent state on the SDN data plane. To demonstrate the superiority of SDNPS, simulations are performed on conventional SDNs and SDNPS. SDNPS outperforms the other schemes in terms of average throughput, packet loss ratio, and packet delay for both the mMTC and URLLC network slices.

Dynamic Segmentation, Configuration, and Governance of SDN

Software Defined Networks (SDN) is a networking paradigm that helps transform networks by breaking away from the restrictive constraints put by networking hardware used in traditional non-SDN networks. They bring improved agility, scalability, and programmability of the control and the switching of the traffic. The challenges of structuring the SDN data plane for security still necessitate further investigation especially to deal with dynamic SDN networks. The use of the Robust Network and Segmentation (RNS) algorithm, which is based on Product Family Algebra, is essential for implementing layered defence and segmentation strategies to compartmentalize the networks and attain an access-control secure network. In this paper, we present an additional plane in charge of the configuration and governance of SDN data planes that we call Dynamic Configuration and Governance (DCG) plane. It is intended to give agility to dynamic networks. It implements the RNS algorithm in the SDN environment. Moreover, we propose and assess three architectures that use the DCG plane. The assessment results identify an architecture that is suitable for dynamic networks and another for networks that are more stable regarding changes to policies and network topology.

AccelSDP: A Reconfigurable Accelerator for Software Data Plane Based on FPGA SmartNIC

Software-defined networking (SDN) has attracted much attention since it was proposed. The architecture of the SDN data plane is also evolving. To support the flexibility of the data plane, the software implementation approach is adopted. The software data plane of SDN is commonly implemented on a commercial off-the-shelf (COTS) server, executing an entire processing logic on a commodity CPU. With sharp increases in network capacity, CPU-based packet processing is overwhelmed. However, completely implementing the data plane on hardware weakens the flexibility. Therefore, hybrid implementation where a hardware device is adopted as the accelerator is proposed to balance the performance and flexibility. We propose an FPGA SmartNIC-based reconfigurable accelerator to offload some of the operation-intensive packet processing functions from the software data plane to reconfigurable hardware, thus improving the overall data plane performance while retaining flexibility. The accelerated software data plane has a powerful line-rate packet processing capability and flexible programmability at 100 Gbps and higher throughput. We offloaded a cached-rule table to the proposed accelerator and tested its performance with 100 GbE traffic. Compared with the software implementation, the evaluation result shows that the throughput can achieve a 600% improvement when processing small packets and a 100% increase in large packet processing, and the latency can be reduced by about 20× and 100×, respectively, when processing small packets and large packets.

Low interruption ratio link fault recovery scheme for data plane in software-defined networks

Low interruption ratio link fault recovery scheme for data plane in software-defined networks

Providing cyber resilience in software-defined networks by secure routing means

This paper is devoted to solving the technical task of providing cyber resilience utilizing secure routing means in Software-Defined Networks (SDN). The work analyzes the SDN architecture and its main components, the concept of cyber resilience and its means, as well as security issues in SDN. Particular attention is paid to the use of secure routing in software-defined networks. Numerical research of the model of secure multipath routing of fragmented confidential messages in the SDN data plane was conducted. The calculation of the message compromise probability for different values of links compromise probabilities was performed. The obtained results showed that the model of secure multipath routing of fragmented confidential messages with redundancy provides a better balancing of message parts by routes. Results of the numerical study proved the adequacy of the selected secure multipath routing model.