Software Defined Networking Devices Research Articles

Anomaly detection for software defined datacenter networks using X-Pack

The global data center market is growing as more and more enterprises are increasingly adopting cloud computing services and applications. Data centers are evolving towards highly virtualized architectures where transformation to software defined network (SDN) based solutions provides benefits in terms of network programmability, automation, and flow visibility. With the benefits, the need for securing network becomes essential as many critical applications are hosted on to such networking platforms. Anomaly detection is a continuous process of monitoring the traffic pattern and alerting the user about the anomalies if detected. For such real time analysis NoSQL and relational databases are less efficient. This paper proposes a framework for anomaly detection and alerting system using Elasticsearch database for SDN. Traffic patterns generated from SDN devices are continuously monitored and predefined actions are taken immediately if an anomaly is detected. The proof of concept is implemented in NOKIAs Nuage Networks Laboratory and the results showed a real time anomaly detection and took relevant actions within minimum time.

An End-Host-Importance-Aware Secure Service-Enabled Hybrid SDN Deployment

Security is critical to networks, but TCP/IP-based legacy networks are difficult to advance new security functions due to the use of costly inflexible hardware devices and error-prone network configurations. Recent literature explores the paradigm of consolidating security services with the forwarding functionality using Software-defined Networking (SDN). Existing full SDN deployment, replacing all legacy network devices with SDN devices, is cost-prohibitive. Whereas the hybrid SDN that only upgrades partial legacy devices to SDN switches is considered practical. However, the challenge is to minimize threats and deployment expenses simultaneously under heterogeneous end-host businesses that have various importance. In this paper, we study the challenge and propose the (EASON) problem. We mathematically formulate the EASON problem as an integer programming problem, prove its non-polynomial time complexity, and propose a heuristic algorithm called BonSéc. We conduct rigorous simulations on real-world topologies and traces. Experimental results show that BonSéc achieves comparable security and cost performances to the optimal solution on small topologies. Meanwhile, it is scalable on larger topologies.

DDoSMitigator: An On-The-Fly Method of Mitigating Denial of Service Attack in Software Defined Networking

Abstract: Started in the early 2000s, the Software Defined Networking (SDN) paradigm has become the backbone for various network based technologies. It has the advantage of being simple to manage and easy to add new features to the network. In comparison to legacy hardware-based networks, scalability, performance, and maintainability become more advanced. However, hackers are more likely to target the SDN, putting the entire network at risk. Denial of Service is a common example of such a threat. It is feasible to reduce such attacks by carefully planning and building the SDN controller as well as the network applications that administer the SDN. This paper presents a novel and efficient method applicable to various types of protocol based Distributed Denial of Service (DDoS) attacks in SDN/OpenFlow networks. It can be used to detect and mitigate Transmission Control Protocol (TCP) SYN attacks, Internet Control Message Protocol (ICMP) ping flood attacks and User Datagram Protocol (UDP) flood attacks that happen against the SDN devices and/or any host. This feature stands above the controller and conforms to the OpenFlow policy without leveraging additional devices. All the detection and mitigation are done based on a True Host list which is created by tracking the Address Resolution Protocol (ARP) requests and replies from hosts. As ARP protocol is necessarily used by all hosts, this method can be effectively utilised for true host list creation and further attack detection and mitigation

Q-Soft: QoS-Aware Traffic Forwarding in Software-Defined Cyber–Physical Systems

The next-generation cyber–physical systems (CPSs) with heterogeneous applications have diverse Quality-of-Service (QoS) requirements in terms of throughput, end-to-end latency, and packet drop reliability. To meet such diverse QoS requirements, in this article, we propose a QoS-aware traffic forwarding scheme in software-defined CPS. The proposed scheme is presented as a two-stage optimization framework to minimize the associated costs in traffic forwarding. In the first stage, we aim to minimize the required number of “candidate” switches for a given network to minimize network deployment costs. In the second stage, we design a comprehensive cost function considering end-to-end delay, flow-rule utilization, and link utilization in the network. Based on the designed cost function, we formulate another optimization problem for optimal traffic forwarding (OTF). As solving OTF is NP-hard, we propose an efficient greedy-heuristic approach to solve the problem while considering application-specific QoS requirements. Further, we propose a packet-tagging method to assist the controller in mitigating rule congestion at the software-defined networking devices, and hence improve the overall network performance. Extensive results show that the proposed scheme minimizes the network delay and QoS-violated flows by up to 50% and 90%, respectively, compared to the state-of-the-art schemes.

IeHDDP: An Integrated Solution for Topology Discovery and Automatic In-Band Control Channel Establishment for Hybrid SDN Environments

In-Band enhanced Hybrid Domain Discovery Protocol (ieHDDP) is a novel integral approach for hybrid Software-Defined Networking (SDN) environments that simultaneously provides a topology discovery service and an autonomous control channel configuration in the band. This contribution is particularly relevant since, to the best of our knowledge, it is the first all-in-one proposal for SDN capable of collecting the entire topology information (type of devices, links, etc.) and establishing in-band control channels at once in hybrid SDN environments (composed by SDN/no-SDN, wired/wireless devices), even with isolated SDN devices. ieHDDP facilitates the integration of heterogeneous networks, for example, in 5G/6G scenarios, and the deployment of SDN devices by using a simple exploration mechanism to gather all the required topological information and learn the necessary routes between the control and data planes at the same time. ieHDDP has been implemented in a well-known SDN software switch and evaluated in a comprehensive set of randomized topologies, acknowledging that ieHDDP is scalable in representative scenarios.

Hybrid SDN Networks: A Multi-parameter Server Load Balancing Scheme

Software-defined networking (SDN) provides many benefits, including traffic programmability, agility, and network automation. However, budget constraints burdened with technical (e.g., scalability, fault tolerance, security issues) and, sometimes, business challenges (user acceptance and confidence of network operators) make providers indecisive for full SDN deployment. Therefore, incremental deployment of SDN functionality through the placement of a limited set of SDN devices among traditional devices represents a rational and efficient environment that can offer customers modern and more data-intensive services. A unique challenge is the flexible distribution of loads on the servers that serve these services in network environments. The research in this paper focuses on developing a new load balancing scheme utilizing a hybrid SDN environment built with a minimal set of SDN devices (controller and one switch). We propose a novel load balancing scheme to monitor current server load indicators and apply multi-parameter metrics for scheduling connections to balance the load on the servers as efficiently as possible. The base of the new load balancing scheme is continuous monitoring of server load indicators and implementations of multi-parameter metrics (CPU load, I/O Read, I/O Write, Link Upload, Link Download) for scheduling connections. The testing performed on servers aims to balance the server’s load as efficiently as possible. The obtained results have shown that this mechanism achieves better results than existing load balancing schemes in traditional and SDN networks. Moreover, a proposed load balancing scheme can be used with various services and applied in any client-server environment.

A review on P4-Programmable data planes: Architecture, research efforts, and future directions

Software Defined Networking (SDN) is a promising technology that provides flexibility, programmability, and network automation by shifting the network intelligence to the logically centralized controller. In SDN architecture, the controller maintains the global view of network topology; therefore the network management is efficient as compared to the traditional networks. Moreover, the cost of SDN devices is less due to the use of open source network operating system instead of proprietary and vendor-specific software. In spite of the flexibility offered by the SDN, OpenFlow enabled switches have a fixed behavior as specified in the datasheet of switch ASIC. They recognize fixed set of header fields according to the support of OpenFlow version. In addition, SDN is suffering from scalability and performance issues because SDN switches heavily dependent on the control plane to forward the packets which increases the data-control communication overhead. To resolve these issues, P4-Programmable data plane switches can be used. The analysis of review articles about SDN suggests insufficient focus on the data plane programmability. Therefore, this paper provides the comprehensive overview of domain-specific language (P4) for the programmability of the data plane. We have discussed the problems in the traditional SDN architecture and then, how these problems can be managed by the data plane programmability. Further, this study critically analyze the research articles based on the P4 programming language for network traffic monitoring, DDoS attack detection, load balancing, and packet aggregation and disaggregation. Finally, we have identified the research gaps and highlighted the open research challenges in the field of data plane programmability for the future directions.

HDDP: Hybrid Domain Discovery Protocol for Heterogeneous Devices in SDN

Computer networks are adopting the new Software-Defined Networking (SDN) architecture, however not all devices can support it, mainly due to power and computational constraints. This letter proposes the Hybrid Domain Discovery Protocol (HDDP), a new discovery protocol that enhances the existing OpenFlow Discovery Protocol (OFDP). HDDP allows the discovery of hybrid network topologies composed of both SDN and non-SDN devices, which no other state-of-the-art protocol can achieve. HDDP has been implemented in a software switch and emulated in diverse networks, where it discovers hybrid topologies by using a number of messages similar to competitors, as they only discover SDN devices.

An energy-efficient load distribution framework for SDN controllers

Software-defined networking (SDN) has evolved as an effective platform for future Internet due to its capability of configuring the network dynamically with varying requirements. It has been observed that the load and energy requirement of SDN devices increase significantly with the growth of communication networks. Therefore, there is a need for efficient modeling of SDN controller that can balance the load as well as optimize the energy consumption by the devices. In this paper, we present an energy-efficient load distribution framework; controller system model for efficient load distribution and routing of traffic that objectively optimize the energy consumption in the network. Our model balances load according to the heterogeneous traffic demands as well as reduces energy consumption by introducing energy-efficient routing algorithm selection procedure. The load balancing scheme is drifted by switch migration technique for multiple controllers simultaneously, whereas the novelty of energy-efficient routing lies on sleep and active mode of network devices. We present interaction between load-balancing scheme and energy-efficient routing towards the network’s performance enhancement. The efficacy of our proposed controller system model is justified with extensive simulation results that show approximately 25% reduction of energy consumption and approximately 20% performance increment. Our proposed model is applicable to real-life network environment satisfying the standards of green communication.

Enforcing Optimal ACL Policies Using K-Partite Graph in Hybrid SDN

Software Defined Networking (SDN) as an innovative network paradigm that separates the management and control planes from the data plane of forwarding devices by implementing both the management and control planes at a logically centralized entity, called controller. Therefore, it ensures simple network management and control. However, due to several reasons (e.g., deployment cost, fear of downtime) organizations are very reluctant to adopt SDN in practice. Therefore, a viable solution is to replace the legacy devices by SDN devices incrementally. This results in a new network architecture called hybrid SDN. In hybrid SDN, both SDN and legacy devices operate in such a way to achieve the maximum benefit of SDN. The legacy devices are running a traditional protocol and SDN devices are operating using Open-flow protocols. Network policies play an essential role to secure the entire network from several types of attacks like unauthorized access and port/protocol control. In a hybrid SDN, policy implementation is a tedious task that requires extreme care and attention due to the hybrid nature of network traffic. Network policies may be implemented at various positions in hybrid SDN, e.g., near the destination or source node, and at the egress or ingress ports of a router. Each of these schemes has some trade-offs. For example, if policies are implemented near the source nodes then each packet generated from the source must pass through the filter and, thus, requires more processing power, time, resources, etc. Similarly, if policies are installed near the destination nodes, then a lot of unwanted traffic generated causing network congestion. This is an NP-hard problem. To address these challenges, we propose a systematic design approach to implement network policies optimally by using decision tree and K-partite graph. By traversing all the policies, we built up the decision tree that identifies which source nodes can communicate with which destination. Then, we traverse the decision tree and constructs K-partite graph to find possible places (interfaces of the routers) where ACL policies are to be implemented based on the different criteria (i.e., the minimum number of ACL rules and the minimum number of transmissions for unwanted traffic). The edge weight represents the cost per criteria. Then, we traverse the K-partite graph to find the optimal place for ACL rules implementation according to the given criteria. The simulation results indicate that the proposed technique outperforms existing approaches in terms of computation time, traffic optimization and successful packet delivery, etc. The results also indicate that the proposed method improves network performance and efficiency by decreasing network congestion and providing ease of policy implementation.

ANCHOR

Software-defined networking (SDN) decouples the control and data planes of traditional networks, logically centralizing the functional properties of the network in the SDN controller. While this centralization brought advantages such as a faster pace of innovation, it also disrupted some of the natural defenses of traditional architectures against different threats. The literature on SDN has mostly been concerned with the functional side, despite some specific works concerning non-functional properties such as security or dependability. Though addressing the latter in an ad-hoc, piecemeal way may work, it will most likely lead to efficiency and effectiveness problems. We claim that the enforcement of non-functional properties as a pillar of SDN robustness calls for a systemic approach. We further advocate, for its materialization, the reiteration of the successful formula behind SDN: ‘logical centralization’. As a general concept, we propose anchor , a subsystem architecture that promotes the logical centralization of non-functional properties. To show the effectiveness of the concept, we focus on security in this article: we identify the current security gaps in SDNs and we populate the architecture middleware with the appropriate security mechanisms in a global and consistent manner. Essential security mechanisms provided by anchor include reliable entropy and resilient pseudo-random generators, and protocols for secure registration and association of SDN devices. We claim and justify in the article that centralizing such mechanisms is key for their effectiveness by allowing us to define and enforce global policies for those properties; reduce the complexity of controllers and forwarding devices; ensure higher levels of robustness for critical services; foster interoperability of the non-functional property enforcement mechanisms; and promote the security and resilience of the architecture itself. We discuss design and implementation aspects, and we prove and evaluate our algorithms and mechanisms, including the formalisation of the main protocols and the verification of their core security properties using the T amarin prover.

Lightweight framework for preserving network policies in dynamic SDN topologies

Software Defined Network (SDN) is an emerging paradigm in networking to add programmability to traditional networks as well as reducing hardware cost by decoupling control plane and management plane from data plane in SDN device. The control plane is responsible for translating network policies to rules applied on SDN devices using communication protocol (OpenFlow). These policies are configured in network applications. SDN rules can be applied with spoofed addresses in SDN devices that make conflict with each other, because these rules are generated from different sources. This conflict is a security concern that can be used to exploit network policies. In this paper, a proposed technique for protection against rules insertion conflict with spoofed addresses is presented in dynamic network topologies. The proposed technique replaces physical and logical addresses in rules to SDN devices port numbers as a way for representing hosts address positions in SDN network. These positions are updated up-on network topology changes by using DHCP and link discovery services in SDN controller. Next, a HashMap is used for storing the replaced rules to detect inserted rules by spoofed addresses in rule insertion process. Extensive simulations using different numbers of rules show the ability of proposed technique to detect conflict accurately with low processing overhead.

SDN-RDCD: A Real-Time and Reliable Method for Detecting Compromised SDN Devices

A software-defined network (SDN) is increasingly deployed in many practical settings, bringing new security risks, e.g., SDN controller and switch hijacking. In this paper, we propose a real-time method to detect compromised SDN devices in a reliable way. The proposed method aims at solving the detection problem of compromised SDN devices when both the controller and the switch are trustless, and it is complementary with existing detection methods. Our primary idea is to employ backup controllers to audit the handling information of network update events collected from the primary controller and its switches, and to detect compromised devices by recognizing inconsistent or unexpected handling behaviors among the primary controller, backup controllers, and switches. Following this idea, we first capture each network update request and its execution result in the primary controller, collect each received network update instruction and the information of any state update in switches, and deliver these four kinds of information to those backup controllers in an auditor role. An auditor controller is designed to create an audit record for each received network update request and to add its execution result of this network update request as well as the received four kinds of matching information to the audit record. In particular, heterogeneous auditor controllers are proposed to avoid the same vulnerability with the primary controller. The audit algorithm and theoretical proof of its effectiveness for security enhancement are then presented. Finally, based on our prototype implementation, our experimental results further validate the proposed method and its low costs.

Make Flows Great Again: A Hybrid Resilience Mechanism for OpenFlow Networks

A top concern in Software-Defined Networking (SDN) is the management of network flows. The resource limitation in SDN devices, e.g., Ternary Content Addressable Memory (TCAM) size, and the signaling overhead between the control and data plane elements can impose scalability restrictions for a network. A notable SDN technology is the OpenFlow protocol, and failures in links and nodes inside an OpenFlow network could lead to drawbacks, such as packet loss. This work proposes the Local Node Group fast reroute (LONG), a hybrid resilience mechanism for OpenFlow networks that combines protection and restoration resilience mechanisms. The results achieved indicate that LONG is a practical approach when compared against the state-of-the-art algorithms.

Utility-optimized bandwidth and power allocation for non-orthogonal multiple access in software defined 5G networks

The fifth Generation (5G) wireless network will be in very high carrier frequencies with massive bandwidths, extreme base stations and device densities. For optimization of 5G network, it is of vital importance to design end to end resource allocation mechanism across the radio access network and core network. In this paper, we propose an algorithm for joint resource optimization across wireless links and core networks. Our goal is twofold. First, Non-Orthogonal Multiple Access (NOMA) technique is considered for performance enhancement in 5G network, and Software Defined Network (SDN) technique is considered for resource allocation in core network. Second, the joint network utility optimization algorithm with multipath is proposed through proper power allocation across access network in conjunction with bandwidth allocation across core network, in which utility is an important indicator to reflect the level of user or application satisfaction and fairness of the allocated bandwidth. Extensive simulation has been done to evaluate the performance of proposed algorithm. The results show that the proposed joint optimization algorithm is able to achieve significant improvement in terms of network utility with more SDN devices deployed.

Hybrid SDN Networks: A Survey of Existing Approaches

Software defined networking (SDN) decouples the control plane from the data plane of forwarding devices. This separation provides several benefits, including the simplification of network management and control. However, due to a variety of reasons, such as budget constraints and fear of downtime, many organizations are reluctant to fully deploy SDN. Partially deploying SDN through the placement of a limited number of SDN devices among legacy (traditional) network devices, forms a so-called hybrid SDN network. While hybrid SDN networks provide many of the benefits of SDN and have a wide range of applications, they also pose several challenges. These challenges have recently been addressed in a growing body of literature on hybrid SDN network structures and protocols. This paper presents a comprehensive up-to-date survey of the research and development in the field of hybrid SDN networks. We have organized the survey into five main categories, namely hybrid SDN network deployment strategies, controllers for hybrid SDN networks, protocols for hybrid SDN network management, traffic engineering mechanisms for hybrid SDN networks, as well as testing, verification, and security mechanisms for hybrid SDN networks. We thoroughly survey the existing hybrid SDN network studies according to this taxonomy and identify gaps and limitations in the existing body of research. Based on the outcomes of the existing research studies as well as the identified gaps and limitations, we derive guidelines for future research on hybrid SDN networks.

Intelligent path control for energy-saving in hybrid SDN networks

As power consumption of the internet has been growing quickly in recent years, saving energy has become an important problem of networking research. Software-Defined Networking (SDN) brings excellent opportunities to improve network performance and reduce energy consumption by flexible centralized control. However, due to budget constraints and technique limitations, ISPs can upgrade only a limited number of conventional switches in backbone networks to SDN devices at one time. In this paper, we propose one heuristic scheme for incrementally deploy SDN switches in hybrid SDNs, the objective of which is to achieve energy saving by rerouting the flows to shut down idle links and switches as many as possible. Our solution can achieve two objectives: 1) maximizing the network control ability with a given SDN switches upgrading budget constraint, and 2) maximizing energy saving by shutting down idle links and switches with deployed SDN switches. The results of evaluations show that our scheme can achieve 95% of the number of flows controlled with only 10% of upgrading cost, and it also can achieve saving more about 10% of the total power consumption when compared to the existing solutions.

Information for Contributors

The fifth Generation (5G) wireless network will be in very high carrier frequencies with massive bandwidths, extreme base stations and device densities. For optimization of 5G network, it is of vital importance to design end to end resource allocation mechanism across the radio access network and core network. In this paper, we propose an algorithm for joint resource optimization across wireless links and core networks. Our goal is twofold. First, Non-Orthogonal Multiple Access (NOMA) technique is considered for performance enhancement in 5G network, and Software Defined Network (SDN) technique is considered for resource allocation in core network. Second, the joint network utility optimization algorithm with multipath is proposed through proper power allocation across access network in conjunction with bandwidth allocation across core network, in which utility is an important indicator to reflect the level of user or application satisfaction and fairness of the allocated bandwidth. Extensive simulation has been done to evaluate the performance of proposed algorithm. The results show that the proposed joint optimization algorithm is able to achieve significant improvement in terms of network utility with more SDN devices deployed.

Incremental Deployment and Throughput Maximization Routing for a Hybrid SDN

To explore the advantages of software defined network (SDN), while preserving the legacy networking systems, a natural deployment strategy is to deploy a hybrid SDN incrementally to improve the network performance. In this paper, we address two technical challenges: an incremental deployment strategy and a throughput-maximization routing, for deploying a hybrid network incrementally. For incremental deployment, we propose a heuristic algorithm for deploying a hybrid SDN under the budget constraint, and prove the approximate factor of $ 1- \frac {1}{e} $ . For throughput-maximization routing, we apply a depth-first-search method and a randomized rounding mechanism to solve the multi-commodity $h$ -splittable flow routing problem in a hybrid SDN, where $h\ge 1$ . We also prove that our method has approximation ratio $O\left({\frac {1}{\log N}}\right)$ , where $ N $ is the number of links in a hybrid SDN. We then show, by both analysis and simulations, that our algorithms can obtain significant performance gains and perform better than the theoretical worst-case bound. For example, our incremental deployment scheme helps to enhance the throughout about 40% compared with the previous deployment scheme by deploying a small number of SDN devices, and the proposed routing algorithm can improve the throughput about 31% compared with ECMP in hybrid networks.

Minnie: An SDN world with few compressed forwarding rules

Software Defined Networking (SDN) is gaining momentum with the support of major manufacturers. While it brings flexibility to the management of flows within the data center fabric, this flexibility comes at the cost of smaller routing table capacities. Indeed, the Ternary Content-Addressable Memory (TCAM) needed by SDN devices has smaller capacities than CAMs used in legacy hardware.In this paper, we investigate compression techniques to maximize the utility of SDN switches forwarding tables. We validate our algorithm, called Minnie, with intensive simulations for well-known data center topologies, to study its efficiency and compression ratio for a large number of forwarding rules. Our results indicate that Minnie scales well, being able to deal with around a million of different flows with less than 1000 forwarding entries per SDN switch, requiring negligible computation time.To assess the operational viability of Minnie in real networks, we deployed a testbed able to emulate a k=4 Fat-Tree data center topology. We demonstrate on the one hand, that even with a small number of clients, the limit in terms of number of rules is reached if no compression is performed, increasing the delay of new incoming flows. Minnie, on the other hand, reduces drastically the number of rules that need to be stored, with no packet losses, nor detectable extra delays if routing lookups are done in the Application-Specific Integrated Circuits (ASICs).Hence, both simulations and experimental results suggest that Minnie can be safely deployed in real networks, providing compression ratios between 70% and 99%.