Software Defined Network Environment Research Articles

Improving the fault-tolerance of software-defined networks with dynamic overlay agreement

Software-Defined Networking (SDN) emerges as one of the leading technologies to address the pressing networking problems such as network virtualization and data center complexity issues using programmable switches and controllers. To well exchange information and have coordinated control for the SDN environment, the multi-controller SDN network has been proposed. Unfortunately, this network architecture still faces the problem of faulty controllers that may forge the command arbitrarily, and then the whole network will be broken down easily. Thus, it is important to propose the fault-tolerance scheme under the SDN network system. In this paper, a new SDN environment called the Multi-Controller Overlay Groups (MCOG) where each device is managed by the controllers is proposed. Besides, the degree of the faulty influence will be revised to define the different bounds of fault tolerance in the MCOG environment. Furthermore, the new protocol named General Dynamic Multi-Controller Agreement (GDMCA) protocol is proposed to solve the Byzantine Agreement (BA) problem in the MCOG environment. Based on the proof of complexity, it can show that the proposed GDMCA protocol is optimal under the MCOG environment.

Highly-Efficient and Adaptive Network Monitoring: When INT Meets Segment Routing

The rapid development of software-defined networking (SDN) has promoted the idea of programmable data plane (PDP), which opens up unprecedented opportunities for realizing powerful and timely network monitoring. This work explores the advantages of PDP to merge two famous techniques (i.e., the segment routing (SR) and in-band network telemetry (INT)) seamlessly for highly-efficient and adaptive network monitoring. Specifically, by leveraging the protocol-oblivious forwarding (POF), we propose SR-INT, which time-multiplexes the header fields in each packet for INT and SR, and keeps packet length constant end-to-end even though both INT and SR are used. Hence, our proposal can enjoy the benefits of INT and SR, while avoiding the accumulated overheads due to simultaneous usage. We design the packet format of SR-INT, and lay out its packet processing procedure to guarantee that the configuration of SR-INT can be adjusted dynamically to adapt to the requirements of network monitoring. We implement and experimentally demonstrate SR-INT in a POF-based SDN environment. Our results show that SR-INT not only reduces the bandwidth overheads of using SR and INT simultaneously but also simplifies the operations in software-based POF switches.

A Comparative Performance Analysis for Static and Dynamic Load Balancing Techniques in Software Defined Network Environment

Traditional load balancer suffers from inflexibility, high cost and the difficulty to manage the network. Software-Defined Network (SDN) gives a promising solution for traditional load balancer limitations through enabling programmability and centralized control over the network, which offers inexpensive and scalable solutions. This paper investigates the impact of increasing the workload requests from 0 up to 180 requests per second (req/sec) in order to explore average network throughput under the deployment of static as well as dynamic load balancing algorithms by the POX controller. The study was based on the utilization of HTTPerf based on the fact that it provides a flexible facility for the generation of various HTTP workloads as well for the measurement of server performance. Our experiments revealed that as the number of requests increases the throughput increases as well. Dynamic least bandwidth-based load balance scheme has shown a remarkable improvement in terms of average network throughput up to 8%, 3.3% and 2.56 %, as compared with static load balancing schemes like random, round-robin and weighted round-robin. However, Dynamic least bandwidth recorded a slight ineffective improvement less than 1 % was recorded when a comparison was carried out dynamic least connections, this directed us to the fact that their performance was almost the same. Based on what dynamic least bandwidth scheme has achieved in terms of average network throughput, more efforts should be driven by the researchers on algorithm development like introducing static weight for each server as well as the application of the algorithm on several POX controllers to avoid a single point of failure.

An Open Source Testbed for Virtualized Communication Networks

Communication networks and the systems they interconnect are going through a phase of tremendous change. The former agnostic delivery of content between endpoints has given way to networks increasingly adding functionality beyond moving data. Softwarization technologies including network function virtualization (NFV) and soft-ware-defined networking (SDN) are key enablers that introduce computing into the network. This revolution, especially for mobile communication networks, represents a major paradigm shift away from agnostic data delivery. Subsequently, there is a significant need to provide well-defined environments offering replicability to effectively test and evaluate protocols and mechanisms that integrate computing into networks. This article presents the Communication Networks Emulator (ComNetsEmu), which provides an SDN and NFV network emulation environment based on community-embraced open source packages and enables replicable research and development on limited resource commodity hardware. In this article, we describe the underlying ComNetsEmu architecture and provide a hands-on description of its use for researchers, practitioners, and educators alike.

SYNGuard: Dynamic threshold‐based SYN flood attack detection and mitigation in software‐defined networks

SYN flood attacks (half-open attacks) have been proven a serious threat to software-defined networking (SDN)-enabled infrastructures. A variety of intrusion detection and prevention systems (IDPS) have been introduced for identifying and preventing such security threats, but they often result in significant performance overhead and response time. Therefore, those existing approaches are inflexible for large-scale networks and real-time applications. For this reason, a novel and adaptive threshold-based kernel-level intrusion detection and prevention system by leveraging SDN capabilities are proposed. The proposed systems to detect and mitigate the aforementioned threats within an SDN over widely used traditional IDPS technologies, Snort and Zeek, are comparatively examined. The approach is evaluated using a mixture of fundamental adverse attacks and SDN-specific threats on a real-world testbed. The experimental results demonstrate the efficacy of the mechanism to detect and mitigate SYN flood attacks within an SDN environment.

Achieving Balanced Load Distribution with Reinforcement Learning-Based Switch Migration in Distributed SDN Controllers

Distributed controllers in software-defined networking (SDN) become a promising approach because of their scalable and reliable deployments in current SDN environments. Since the network traffic varies with time and space, a static mapping between switches and controllers causes uneven load distribution among controllers. Dynamic migration of switches methods can provide a balanced load distribution between SDN controllers. Recently, existing reinforcement learning (RL) methods for dynamic switch migration such as MARVEL are modeling the load balancing of each controller as linear optimization. Even if it is widely used for network flow modeling, this type of linear optimization is not well fitted to the real-world workload of SDN controllers because correlations between resource types are unexpectedly and continuously changed. Consequently, using the linear model for resource utilization makes it difficult to distinguish which resource types are currently overloaded. In addition, this yields a high time cost. In this paper, we propose a reinforcement learning-based switch and controller selection scheme for switch migration, switch-aware reinforcement learning load balancing (SAR-LB). SAR-LB uses the utilization ratio of various resource types in both controllers and switches as the inputs of the neural network. It also considers switches as RL agents to reduce the action space of learning, while it considers all cases of migrations. Our experimental results show that SAR-LB achieved better (close to the even) load distribution among SDN controllers because of the accurate decision-making of switch migration. The proposed scheme achieves better normalized standard deviation among distributed SDN controllers than existing schemes by up to 34%.

Analysis of Different Attacks on Software Defined Network and Approaches to Mitigate using Intelligent Techniques

The detection of DDoS (Distributed Denial of Service) attacks is essential topic under network security. DDoS attacks cause network services to become unavailable by repeatedly flooding servers with unwanted traffic. The volume, magnitude, and complexity of these attacks increased dramatically as a result of low-cost Internet connections and easily available attack tools. Both Software Defined Networking (SDN) and Deep Learning (DL) have recently found a number of practical and fascinating applications in industry and academia. SDN enables centralized management, a global view of the overall network, and configurable control planes, allowing network devices to adapt to diverse applications. When applied to diverse categorization problems, DL-based approaches outperformed classic machine learning techniques, while SDN characteristics offer better network monitoring and security of the managed network when compared to traditional networks. By inheriting the non-linearity of neural networks, they increase feature extraction and reduction from a high-dimensional dataset in an unsupervised way. An overview of deep learning algorithms for sensing distributed denial of service attacks in software-defined networks with Deep learning is presented within this article. Furthermore, SDN environment is simulated in Mininet using RYU controller. In addition, each paper's mitigation method is examined in the survey.

Configuration and Governance of Dynamic Secure SDN

Abstract Software Defined Networks (SDN) is a networking paradigm that separates the control plane from the forwarding plane. There is little research on structuring the SDN data plane for security. The Robust Network and Segmentation Algorithm (RNS) is an algorithm based on Product Family Algebra (PFA) that implements layered defence and segmentation strategies to segment resources towards designing secure networks. In this paper, we present an additional plane in charge of the configuration and governance of SDN data planes that we call Dynamic Configuration and Governance (DCG) plane. It is intended to give agility to dynamic networks. It implements the RNS algorithm in SDN environment. Moreover, we propose and suggest three architectures that use DCG plane. Then we assess the three architectures. The assessment results identify an architecture that is suitable for dynamic networks and another for networks that are more stable regarding changes to policy and network topology.

Analysis of Machine Learning for Securing Software-Defined Networking

Advancements in Software-Defined Networking (SDN) are growing with the emerging network architectures which face the security issues and challenges when adversary launches severe attacks such as Distributed Denial of Service (DDoS) attacks. Therefore, a considerable number of solutions have been devised to alleviate DDoS attacks in SDN using a machine learning approach. Thus, the aim of this study is to review and analyze the machine learning-based schemes for securing the SDN environment targeted by DDoS attacks. The schemes’ method, performance metrics, datasets, and other remarks such as benchmarks, strengths, and weaknesses are discussed. The CIC-DDoS 2019 dataset was utilized to evaluate the performance of a set of classification algorithms that are widely used in machine learning-based DDoS attack detection in the SDN environment. Finally, challenges and future directions in the development of machine learning-based detection schemes in SDN are discussed.

Enhancing the security of blockchain-based software defined networking through trust-based traffic fusion and filtration

With the rapid development of Internet-of-Things (IoT), more smart devices can be connected to the Internet, resulting in a dramatic increase of data transmission and communication. Software-Defined Networking (SDN), which separates the control planes and data planes, is considered as a promising solution to provide the scale and versatility necessary for IoT. However, SDN still suffers from several challenges, i.e., the centralized control plane would be a single point of failure. With the wide adoption of blockchain applications, such technologies can have a positive impact on SDN’s performance, i.e., blockchains allow non-confident individuals to interact with each other without the need for a central authority. However, attackers can still inject traffic to influence blockchain nodes from normal operations. Motivated by the recent development of blockchains and SDN, in this work, we focus on blockchain-based SDN and develop BSDNFilter, an IDS-based security mechanism that builds a trust-based filtration by using traffic fusion and aggregation to handle and reduce malicious traffic. Through collaborating with an IT organization, our evaluation in a real blockchain-based SDN environment demonstrates that our BSDNFilter is able to achieve better filtration performance against flooding attacks than similar approaches.

Performance analysis of a data‐offloading approach based on software‐defined networking for heterogeneous networks

This study presents the performance evaluation of a data-offloading algorithm developed and implemented in the framework of a software-defined network (SDN). The algorithm senses the network congestion and takes into account the constraints imposed to the throughput and delay in order to command a data offloading operation from the current active interface to another one available in a given host. Both, emulation and experimental demonstration of the approach were implemented in the open network operating systems in which multimedia services were transported within the SDN environment and assessed in terms of the algorithm parameters configuration. The experimental demonstration confirms the feasibility of the proposed algorithm to offload the traffic of a given data stream to a less congested available interface or network.

SADM-SDNC: security anomaly detection and mitigation in software-defined networking using C-support vector classification

The inherent features of software-defined networking (SDN) architecture revolutionize traditional network infrastructure and provide the opportunity for integrated and centralized network monitoring. One of the shortcomings of SDNs is related to its high vulnerability to distributed denial of service attacks and other similar ones. In this paper, a novel multi-stage modular approach is proposed for detecting and mitigating security anomalies in SDN environment (SADM-SDNC). The proposed approach uses NetFlow protocol for gathering information and generating dataset and information gain ratio in order to select the effective features. Also, the C-support vector classification algorithm with radial basis function kernel, and features of Floodlight controller for developing a structure with desirable performance were used in the proposed scheme. The experimental results demonstrate that the proposed approach performs better than other methods in terms of enhancing accuracy and detection rate, and reducing classification error and false alarm rate, which were measured as 99.67%, 99.26%, 0.33%, and 0.08% respectively. Finally, thanks to utilizing REST API and Static Entry Pusher technologies in the Floodlight controller, it makes it possible to disconnect any communications with the attacking factors and remove destructive users.

DeepIDS: Deep Learning Approach for Intrusion Detection in Software Defined Networking

Software Defined Networking (SDN) is developing as a new solution for the development and innovation of the Internet. SDN is expected to be the ideal future for the Internet, since it can provide a controllable, dynamic, and cost-effective network. The emergence of SDN provides a unique opportunity to achieve network security in a more efficient and flexible manner. However, SDN also has original structural vulnerabilities, which are the centralized controller, the control-data interface and the control-application interface. These vulnerabilities can be exploited by intruders to conduct several types of attacks. In this paper, we propose a deep learning (DL) approach for a network intrusion detection system (DeepIDS) in the SDN architecture. Our models are trained and tested with the NSL-KDD dataset and achieved an accuracy of 80.7% and 90% for a Fully Connected Deep Neural Network (DNN) and a Gated Recurrent Neural Network (GRU-RNN), respectively. Through experiments, we confirm that the DL approach has the potential for flow-based anomaly detection in the SDN environment. We also evaluate the performance of our system in terms of throughput, latency, and resource utilization. Our test results show that DeepIDS does not affect the performance of the OpenFlow controller and so is a feasible approach.

Challenge-based collaborative intrusion detection in software-defined networking: an evaluation

Software-Defined Networking (SDN) is an emerging architecture that enables a computer network to be intelligently and centrally controlled via software applications. It can help manage the whole network environment in a consistent and holistic way, without the need of understanding the underlying network structure. At present, SDN may face many challenges like insider attacks, i.e., the centralized control plane would be attacked by malicious underlying devices and switches. To protect the security of SDN, effective detection approaches are indispensable. In the literature, challenge-based Collaborative Intrusion Detection Networks (CIDNs) are an effective detection framework in identifying malicious nodes. It calculates the nodes’ reputation and detects a malicious node by sending out a special message called a challenge. In this work, we devise a challenge-based CIDN in SDN and measure its performance against malicious internal nodes. Our results demonstrate that such a mechanism can be effective in SDN environments.

Bringing Intelligence to Software Defined Networks: Mitigating DDoS Attacks

As one of the most devastating types of Distributed Denial of Service (DDoS) attacks, Domain Name System (DNS) amplification attack represents a big threat and one of the main Internet security problems to nowadays networks. Many protocols that form the Internet infrastructure expose a set of vulnerabilities that can be exploited by attackers to carry out a set of attacks. DNS, one of the most critical elements of the Internet, is among these protocols. It is vulnerable to DDoS attacks mainly because all exchanges in this protocol use User Datagram Protocol (UDP). These attacks are difficult to defeat because attackers spoof the IP address of the victim and flood him with valid DNS responses coming from legitimate DNS servers. In this paper, we propose an efficient and scalable solution, called WisdomSDN, to effectively mitigate DNS amplification attack in the context of software defined networks (SDN). WisdomSDN covers both detection and mitigation of illegitimate DNS requests and responses. WisdomSDN consists of: (1) a novel proactive and stateful scheme (PAS) to perform one-to-one mapping between DNS requests and DNS responses; it operates proactively by sending only legitimate responses, excluding amplified illegitimate DNS responses; (2) a machine learning DDoS detection module to detect, in real-time, illegitimate DNS requests. This module consists of (a) Flow statistics collection scheme (FSC) to gather the features of flows in an efficient and scalable way using sFlow protocol; (b) Entropy calculation scheme (ECS) to measure randomness of network traffic; and (c) Bayes Network based Filtering scheme (BNF) to classify, based on entropy values, illegitimate DNS requests; and (3) DNS Mitigation scheme (DM) to effectively mitigate illegitimate DNS requests. The experimental results show that, compared to state-of-art, WisdomSDN can effectively detect/mitigate DNS amplification attack quickly with high detection rate, less false positive rate, and low overhead making it a promising solution to mitigate DNS amplification attack in a SDN environment.

Security anomaly detection in software‐defined networking based on a prediction technique

SummaryNowadays, software‐defined networking (SDN) is regarded as the best solution for the centralized handling and monitoring of large networks. However, it should be noted that SDN architecture suffers from the same security issues, which are the case with common networks. As a case in point, one of the shortcomings of SDNs is related to its high vulnerability to distributed denial of service (DDoS) attacks and other similar ones. Indeed, anomaly detection systems have been considered to deal with these attacks. The challenges are related to designing these systems including gathering data, extracting effective features, and selecting the best model for anomaly detection. In this paper, a novel combined approach is proposed; this method uses NetFlow protocol for gathering information and generating dataset, information gain ratio (IGR), in order to select the effective and relevant features and ensemble learning scheme (Stacking) for developing a structure with desirable performance and efficiency for detecting anomaly in SDN environment. The results obtained from the experiments revealed that the proposed method performs better than other methods in terms of enhancing accuracy (AC) and detection rate (DR) and reducing classification error (CE) and false alarm rate (FAR). The AC, DR, CE, and FAR of the proposed model were measured as 99.92%, 99.83%, 0.08%, and 0.03%, respectively. Furthermore, the proposed method prevents the occurrence of excessive overload on the controller and OpenFlow.

Neural Network-Based Approach for Detection and Mitigation of DDoS Attacks in SDN Environments

Software defined networking (SDN) is a networking paradigm that allows for the easy programmability of network devices by decoupling the data plane and the control plane. On the other hand, Distributed Denial of Service (DDoS) attacks remains one of the major concerns for organizational network infrastructures and Cloud providers. In this article, the authors propose a Neural Network based Traffic Flow Classifier (TFC-NN) for live DDoS detection in SDN environments. This study provides a live traffic analysis method with a neural network. The training of the TFC-NN model is performed by a labelled dataset constructed from SDN normal traffic and an-under DDoS traffic. The study also provides a live mitigation process combined with the live TFC-NN-based DDoS detection. The approach is deployed and evaluated on an SDN architecture based on different performance metrics with different under-DDoS attack scenarios.

POX Controller and Open Flow Performance Evaluation in Software Defined Networks (SDN) Using Mininet Emulator

Growing popularity of Internet demands for the agility as well as the flexibility of computer networks. Traditional networking system is unable to satisfy recent computing needs. Proprietary devices configured manually create an error-prone situation in addition they are incapable to fully utilize the capability of physical network infrastructure. This has resulted in the paradigm shift in the networking industry and it is known as Software defined networking. Advantages such as programmability, task virtualization and easy management of the network can be provided by employing SDN platform, on the other hand POX is defined as a Python based open source OpenFlow SDN Controller mainly used for faster development and prototyping of new network applications basically comes pre-installed with the mininet virtual machine. POX controller can turn dumb OpenFlow devices into hub, switch, load balancer and firewall devices. In this paper Performance metrics such as service Delay, utilized bandwidth, received packets and bytes were measured and recorded using network monitoring tools like iperf and D-ITG in order to analyze the functionality of the POX controller as well as to evaluate the operation performance of POX controller for SDN environment. The results of this research were the recommendation of using POX controller in for rapid development and prototyping of network control systems as well as being the framework for the interaction with Open Flow switches.

Near real-time security system applied to SDN environments in IoT networks using convolutional neural network

The Internet of Things (IoT) paradigm brings new and promising possibilities for services and products. The heterogeneity of IoT devices highlights the inefficiency of traditional networks’ structures to support their specific requirements due to their lack of flexibility. Thus, Software-defined Networking (SDN) is commonly associated with IoT since this architecture provides a more flexible and manageable network environment. As shown by recent events, IoT devices may be used for large scale Distributed Denial of Service (DDoS) attacks due to their lack of security. This kind of attack is commonly detected and mitigated at the destination-end network but, due to the massive volume of information that IoT botnets generate, this approach is becoming impracticable. We propose in this paper a near real-time SDN security system that both prevents DDoS attacks on the source-end network and protects the sources SDN controller against traffic impairment. For this, we apply and test a Convolutional Neural Network (CNN) for DDoS detection, and describe how the system could mitigate the detected attacks. The performance outcomes were performed in two test scenarios, and the results pointed out that the proposed SDN security system is promising against next-generation DDoS attacks.

A New Flow Entry Replacement Scheme Considering Traffic Characteristics in Software-Defined Networks

The Software Defined Network (SDN) decouples control and data planes of the existing network architecture and a controller carries out centralized management and control of the network. This provides flexibility for the networks and enables efficient operation, depending on their condition. However, when the performance of switches comprising the SDN varies, any switches with low performance can cause flow table overflow and subsequent bottleneck with overhead concentrating in the controller. Besides, packet processing can be delayed, declining user QoS. The paper proposes a flow entry replacement scheme that takes into account the flow features to address the issue. The proposed Short Flow First (SFF) scheme discriminates the flow features based on the matching period of flow entry and determines a subject of the flow entry replacement with the features. For evaluation, the paper built the SDN environment using the Mininet emulator and compared the performance of the proposed SFF scheme with the representative flow entry replacement schemes. According to the results, the proposed scheme showed a good performance in the flow entry miss rate and packet delay due to failure of matching the flow entry.