Software Defined Networking Network Research Articles

RDG-TE: Link reliability-aware DRL-GNN-based traffic engineering in SDN

The existing advanced machine learning approaches based on Graph Neural Networks (GNN) for efficient traffic engineering (TE) in Software Defined Networking (SDN) overlook consideration of link reliability values. Link reliability is a very important parameter, directly linked to end-to-end delay for data packet transmission, and can be used to improve the delivery performance. This research article proposes two versions of RDG-TE, a novel model that integrates Deep Reinforcement Learning (DRL) and GNN in order to solve efficiently network TE problems by considering link reliability in both model training and reward computation. The proposed model enables improved performance by more accurately predicting the SDN network behaviour in case of link failure.Testing results show that, in comparison to the closest state-of-art approach, our proposed approach reduces the number of disturbed flows by 24.19% and the hop count by 35.38%while also increases the reliable route prediction accuracy by 40.17%.

Comprehensive Performance Evaluation of Machine Learning Algorithms for detecting DDoS attacks in SDN

<div align="center">Software-Defined Networking (SDN) revolutionizes networking by separating control logic and data forwarding, enhancing security against threats like Distributed Denial of Service (DDoS) attacks. These attacks flood control plane bandwidth, causing SDN network failures. Recent studies emphasize the efficacy of machine learning and statistical approaches in identifying and mitigating these security risks. However, there has been a lack of focus on employing ensembling techniques, amalgamating diverse machine learning models, selecting pertinent features, and utilizing oversampling techniques to balance categorical data. Our study evaluates 20 machine-learning models, emphasizing feature engineering and addressing class imbalance using Synthetic Minority Oversampling TEchnique (SMOTE). The results indicate that Ensemble methods such as LGBM Classifier, Random Forest Classifier, XGB Classifier, Decision Tree Classifier attained near-perfect scores (almost 100%) across all metrics, suggesting potential overfitting. Conversely, models like AdaBoost Classifier, K-Neighbors Classifier, and SVC exhibited slightly lower (99%) but realistic performance, underscoring the intricacy of accurate prediction in cybersecurity. Simpler models, including Logistic Regression, Linear Discriminant Analysis, and Gaussian Naive Bayes, demonstrated moderate to low accuracy, approximately around 70%. These findings stress the imperative need for a nuanced approach in the selection and fine-tuning of machine learning models to ensure effective DDoS detection in SDN environments.</div>

Controller Placement Approach with Criteria Balance in SDN networks

Software Defined Network (SDN) is an emerging technology that centralizes network control and automates network management by separating the data plane from the control plane. The control plane is a set of controllers that manage the network switches. The crucial problem of positioning these controllers is known as the Controller Placement Problem (CPP). The optimal controllers positioning is very constrained and affects the different network performance parameters, such as, controller-to-switch latency, inter-controller latency, number of hops between controller and switch and inter-controller. In this paper, we study the impact of optimizing some parameters on the others, we have developed different approaches, and each considers one or two parameters. Moreover, we propose a balanced optimization approach that considers the various network performance parameters. We formulate the problem as an Integer Linear Programming model that considers all parameters using the Lexicographic Multi-objective optimization method. By ensuring a balance between all parameters, network performance is significantly improved. The obtained results reveal that our approach is more inclusive and provides very interesting results.

An adaptive multistage intrusion detection and prevention system in software defined networking environment

The advancements made in Software-Defined Networking (SDN) technology seem quite promising, with potential wide application in managing and controlling the latest network infrastructures. SDN technology decouples the control plane from the data plane, enabling effective and flexible network management. However, this dynamic phenomenon brings new security challenges. With the increasing dynamism and programmable nature of networks, conventional security protocols may not sufficient to protect against advanced and sophisticated attacks. Although Intrusion Detection Systems (IDSs) have been extensively applied for identifying and preventing security threats in traditional network environments, IDS models designed specifically for traditional network requirements may not be adequate for SDN environments. These issues may stem from the static nature of conventional networks, contrasting with the dynamicity of advanced SDN networks, and the traditional IDS’s inability to adapt to the dynamic nature of SDN. To address these challenges, the current research proposes a novel Deep Hybrid IDS model to enhance network security in SDN environments and prevent attacks using Scapy. The proposed model detects signature-based attacks by integrating Gated Recurrent Units (GRU) and Long Short-Term Memory (LSTM) for real-time simulated datasets, achieving an accuracy of 97.8%, which is comparatively better than existing models.

Network Traffic Feature Behaviour Augmentation Fusion based Attacks Classification for Intrusion Detection System in SDN Framework

The implementation of Software-Defined Network(SDN) across multiple data centers aims to simplify thecontrol and management of networks. However, the increasingpopularity of SDN has also attracted the attention of attackers.To tackle this problem, it is essential to have an intrusiondetection system (IDS) in place, which plays a crucial role incybersecurity by addressing external threats. The advantageof SDN’s centralized nature is that it facilitates the training ofan IDS based on machine learning. However, there is a scarcityof research specifically focused on intrusion detection in SDN.Existing literature often treats SDN intrusion detection assimilar to traditional computer systems and relies on intrusiondatasets generated for those systems. We explore the issueof intrusion detection in SDN using the most recent publicdataset (InSDN). However, InSDN is an imbalanced data set.In this paper, we have recommended a method to balance thedata as well as a method to find the best features to improvethe quality of IDS using Machine Learning. In addition, wealso suggest a method of classifying SDN network traffic andnormal network traffic. At the same time, we also evaluate theefficiency of the SDN system with the load balancing systemand without the load balancing system.

Classification of DDoS attack traffic on SDN network environment using deep learning

Distributed Denial of Service (DDoS) attack is a major threat to the Internet of Things (IoT), Software Defined Networks (SDN), and Cloud Computing Networks. Due to the tremendous applications of IoT networks, the number of DDoS attacks is increasing significantly, and most sophisticated DDoS attacks are generated through IoT botnets. An IoT botnet-based DDoS attack can disrupt the network quickly with a surge of malicious traffic. Especially in an SDN network, it is important to detect the DDoS attack before it occurs to the SDN controller. DDoS attacks on the centralized controller of the SDN can disrupt the whole network. So, identifying DDoS attacks at the earliest is a critical security measure for network experts and practitioners. In this paper, we analyze the DDoS attack on an SDN environment and develop a method to identify the DDoS attack using Deep Learning (DL). The proposed method converts the captured raw network traffic to image data and classifies the malicious data from normal data. The method is evaluated on our test-bed simulated dataset and two other benchmark datasets. The experimental comparison shows that the proposed method performs better on all three datasets, giving more than 99% classification accuracy.

Detection and mitigation of DDoS attacks in SDN based intrusion detection system

Software defined networks (SDN) have completely revolutionized the management and operation of networks. This novel technology entails a distinctive approach to management. Amidst the advancements, a notable security concern arises in the form of distributed denial of service (DDoS) attacks. To counteract this attack, the deployment of intrusion detection systems (IDS) assumes paramount importance. IDS plays a critical role in monitoring network traffic, promptly detecting irregularities that may signify a potential denial of service (DoS) assault. This study delves into a comprehensive exploration of a DDoS attack on an SDN network using the OpenDaylight controller and the Mininet emulator. Furthermore, the assessment extends to evaluating the DDoS attack's repercussions and the effectiveness of IDS in mitigating such risks. Various performance metrics, including throughput according to delay time, are monitored to gauge network performance under duress. The difference in throughput curves when comparing scenarios with and without IDS highlights the significant impact of intrusion detection. When the IDS was absent, there was a noticeable increase in oscillations, indicating greater network susceptibility. On the other hand, the presence of an IDS created a more regulated environment, reducing variances and promoting a more stable network.

Traffic data classification in SDN network based on machine learning algorithms

Traffic classification plays a crucial role in various domains of network management, including service measurement, architectural design, security monitoring, and advertising. Software-defined networks (SDN) is a new technology that has the potential to solve typical network problems by simplifying network management, the introduction of network programmability, and the provision of a global perspective of a network. In recent years, SDN has brought new opportunities to classify traffic. Traffic classification techniques in SDN have been investigated, proposed, and developed. This survey delves into traffic classification under SDN, which is a vital component for improving network services, administration, and security. We give an in-depth assessment of traffic categorization algorithms adapted for SDN, emphasizing the fresh opportunities and problems they present. We cover the many metrics for assessing the effectiveness of these traffic classification algorithms, such as accuracy, precision, recall, and F1 score, and we examine the numerous datasets that serve as performance benchmarks. The study also synthesizes the findings of existing research, revealing trends and the efficacy of various techniques in the context of SDN-enabled settings. This document serves as a resource for scholars and practitioners seeking to optimize traffic classification strategies by providing a complete review and assessment of existing traffic classification approaches

Improvement of the secure routing model in software-configured networks

Currently, the deployment of such network architectures as Software-Defined Networking (SDN) is facing new cyber security threats that require the development and research of new specialized solutions to increase the level of network security. Despite its high openness and programmability, the SDN architecture replaces the traditional network, but it increases the number of potential network attacks, which leads to new security problems. The growing interest in SDN and the widespread deployment of software-configured networks of various types allow identifying their shortcomings in the process of combating cyber security threats. Obviously, security issues are closely related to the characteristics of SDN networks themselves. Furthermore, security issues in SDN can be divided based on three layers: data plane, control plane, and application plane. At the same time, devices of different SDN levels can be among the objects of attacks. Therefore, according to the multilayer architecture of SDN, security threats can be classified at the data transmission, management and application layers. For its part, the data plane consists of switches and other network devices and is mainly responsible for data processing, forwarding, discarding, and collecting statistics. The data plane functions on the basis of flow rules provided by the network controller. While the main causes of security problems are the SDN architecture itself, external malicious attacks, insufficient access control and encryption tools. Today, an important place in the complex of means of increasing network security, including SDN networks, is given to routing protocols, which require the systematic and coordinated interaction of a number of network elements at the same time – SDN switches and network controllers during the formation (calculation) of paths and flow rules, along which the required level of security must be ensured according to selected indicators or criteria. The paper analyzes how to modify route metrics in such a way that the resulting model acquires the properties of secure QoS routing. It is shown that the improvement of the model and the choice of the route should be chosen taking into account the basic metrics of the criticality of vulnerabilities and the bandwidth of the communication channels that make up this route.

Distributed SDN Security Frameworks: A Survey

Software-Defined Networks (SDN) have recently received much attention and deployment as a new technology that offers more flexibility and efficiency than traditional networks. SDN is a paradigm shift that revolutionizes traditional network design and makes future networks programmable, manageable, and affordable. The use of the SDN in modern networks provides much needed flexibility and transparency to organize and deploy network solutions. It is a new model that separates forwarding & controlling planes, and centralized architecture designed to increase network speed and programming capability. However, from the current security point of view, the SDN still has some problems, especially for the advanced persistent attacks such as the DDOS, the side channel attacks in Clouds, the SDN stack control plane saturation attacks, and the switch flow table exhaustion attacks. Also, the existing SDN-based security systems are constrained by a central framework that provides significant overheads for the control plane, leading to the breakdown of vital control links. In this paper, we will present the vulnerabilities and security threats in the SDN network, define the various approaches to solve these problems, and deploy the SDN securely in the production environments. We will survey existing research on distributed SDN security frameworks, there is a number of security frameworks and applications that have been proposed previously, and each one of them builds on a selection of the SDN characteristics.

A novel link fabrication attack detection method for low-latency SDN networks

The application of Software-defined Networking (SDN) in low-latency scenarios, such as 6G, has received immense attention. Notably, our research reveals that SDN remains susceptible to link fabrication attacks (LFA) in low-latency environments, where existing detection methods fail to effectively detect LFA. To address this issue, we propose a novel detection method called Correlated Link Verification (CLV). CLV is composed of three phases. Firstly, we introduce a data processing method to mitigate measurement error and enhance robustness. Secondly, we present a multipath transmission simulation method to convert the measured performance disparity between correlated links into statistical features. Thirdly, we propose a dynamic threshold calculation method, which utilizes the statistical features to determine thresholds based on extreme value theory and probability distribution fitting. Finally, CLV identifies the fabricated link within correlated links based on the thresholds and current statistical features. Extensive experiments have been conducted to validate the feasibility, effectiveness, scalability and robustness of CLV. The experimental results demonstrate that CLV can effectively detect LFA in low-latency SDN networks.

MACHINE LEARNING-BASED INTRUSION DETECTION SYSTEMS FOR SDN: AN EMPIRICAL STUDY USING KNIME

Software-Defined Networking (SDN) is a revolutionary approach to designing and managing networks that simplifies the process by separating the control and data planes. Nevertheless, these attributes make SDN susceptible to security risks. As a result, it is critical to include a Network Intrusion Detection System (NIDS) as a response. This study suggests utilizing machine learning models to improve the efficiency of NIDS in SDN systems. More specifically, we use two benchmark datasets—NSL KDD and UNSW-NB15—to create and test machine learning models that aim to improve SDN network security and reduce potential threats.

An ensemble-based approach for effective distributed denial of service attack detection in software defined networking

<p>Software defined networking (SDN) is a network framework that aims to redefine network characteristics through the programmability of network components, faster and larger network monitoring, centralized network operation, and effective detection of fraudulent traffic and special malfunctions. However, SDN networks are vulnerable to security threats that can cause complete network failure. To address this issue, in this paper, machine learning techniques are suggested for the swift detection of attacks. Various methods for detecting distributed denial of service (DDoS) attacks are evaluated, and the study identifies the most precise method for categorizing such attacks within a SDN network. The results indicate that the proposed system achieves high accuracy in detecting DDoS attacks, with ensemble learning achieving 99% accuracy. This indicates a remarkable improvement percentage in comparison to the approaches of decision tree (DT), k-nearest neighbors (KNN), and support vector machine (SVM).</p>

Detecting and mitigating security anomalies in Software-Defined Networking (SDN) using Gradient-Boosted Trees and Floodlight Controller characteristics

Cutting-edge and innovative software solutions are provided to address network security, network virtualization, and other network-related challenges in highly congested SDN-powered networks. However, these networks are susceptible to the same security issues as traditional networks. For instance, SDNs are significantly vulnerable to distributed denial of service (DDoS) attacks. Previous studies have suggested various anomaly detection techniques based on machine learning, statistical analysis, or entropy measurement to combat DDoS attacks and other security threats in SDN networks. However, these techniques face challenges such as collecting sufficient and relevant flow data, extracting and selecting the most informative features, and choosing the best model for identifying and preventing anomalies. This paper introduces a new and advanced multi-stage modular approach for anomaly detection and mitigation in SDN networks. The approach consists of four modules: data collection, feature selection, anomaly classification, and anomaly response. The approach utilizes the NetFlow standard to gather data and generate a dataset, employs the Information Gain Ratio (IGR) to select the most valuable features, uses gradient-boosted trees (GBT), and leverages Representational State Transfer Application Programming Interfaces (REST API) and Static Entry Pusher within the floodlight controller to construct an exceptionally efficient structure for detecting and mitigating anomalies in SDN design. We conducted experiments on a synthetic dataset containing 15 types of anomalies, such as DDoS attacks, port scans, worms, etc. We compared our model with four existing techniques: SVM, KNN, DT, and RF. Experimental results demonstrate that our model outperforms the existing techniques in terms of enhancing Accuracy (AC) and Detection Rate (DR) while simultaneously reducing Classification Error (CE) and False Alarm Rate (FAR) to 98.80 %, 97.44 %, 1.2 %, and 0.38 %, respectively.

A model transformation based security policy automatic management framework for software-defined networking

Software-defined networking (SDN) has been utilized to enforce the security of traditional networks. However, the existing SDN-based security enforcement mechanisms rely heavily on the security policies containing the underlying information of data plane, such as MAC address, IP address or switch ports. These security policies need to be specifically developed by network operators and loaded into the control plane manually. With increasing the scale of underlying network, the existing security policy management mechanisms confront more and more challenges. The security policy transformation for SDN networks is to research how to transform the high-level security policy without containing the underlying information into the practical flow entries used by Openflow switches automatically, thereby implementing the automatic management of security policies. To achieve this objective, we propose a model transformation based security policy automatic management framework for software-defined networking in this paper. Leveraging its functional modules, the framework can solve the problems of how to find a connected path for each access control rule of security policy model (SPM) in data plane, how to transform the connected path into the system model of flow entries, as well as how to generate the practical flow entries according to the system model of flow entries. In order to validate the effectiveness and performance of framework, we implement the framework by leveraging POX controller and Mininet emulator. The experimental results illustrate the framework can transform SPM into practical flow entries, synchronously perceive the modifications caused by cutting down one connected path or changing SPM, and continuously keep the data plane holding the security properties defined by SPM at runtime.

BCSDNCC: A Secure Blockchain SDN framework for IoT and Cloud Computing

Rapid progress can be observed in the field of computer network technologies. Blockchain technology(BCT) presents a potentially viable alternative for effectively mitigating performance and security issues encountered in distributed systems. Recent studies have focused on exploring a number of exciting new technologies, including BlockChain (BC), Software-Defined Networking (SDN), and the Internet of Things (IoT). Various technologies offer data integrity and secrecy. One such technology that has been utilized for a number of years is cloud computing (CC). Cloud architecture facilitates the flow of confidential information, enabling customers to access remote resources. CC is also accompanied with notable security dangers, concerns, and challenges. In order to tackle these difficulties, we suggest integrating BC and SDN into a CC framework designed for the IoT. The fundamental flexibility and centralized capabilities of SDN facilitate network management, facilitate network abstraction, simplify network evolution, and possess the capacity to effectively handle the IoT network. The utilization of BCT is widely acknowledged as a means to ensure robust security inside distributed SDN (DSDN) and IoT networks, hence enhancing the efficacy of the detection and mitigation procedures.

A Qualitative and Comparative Performance Assessment of Logically Centralized SDN Controllers via Mininet Emulator

An alternative networking approach called Software Defined Networking (SDN) enables dynamic, programmatically efficient network construction, hence enhancing network performance. It splits a traditional network into a centralized control plane and a configurable data plane. Because the core component overseeing every data plane action is the controller in the control plane, which may contain one or more controllers and is thought of as the brains of the SDN network, controller functionality and performance are crucial to achieve optimal performances. There is much controller research available in the existing literature. Nevertheless, no qualitative comparison study of OpenFlow-enabled distributed but logically centralized controllers exists. This paper includes a quantitative investigation of the performance of several distributed but logically centralized SDN controllers in custom network scenarios using Mininet, as well as a thorough qualitative comparison of them. More precisely, we give a qualitative evaluation of their attributes and classify and categorize 13 distributed but logically centralized SDN controllers according to their capabilities. Additionally, we offer a comprehensive SDN emulation tool, called Mininet-based SDN controller performance assessment, in this study. Using six performance metrics—bandwidth, round-trip time, delay, jitter, packet loss, and throughput—this work also assesses five distributed but logically centralized controllers within two custom network scenarios (uniform and non-uniform host distribution). Our analysis reveals that the Ryu controller outperforms the OpenDayLight controller in terms of latency, packet loss, and round-trip time, while the OpenDayLight controller performs well in terms of throughput, bandwidth, and jitter. Throughout the entire experiment, the HyperFlow and ONOS controllers performed worst in all performance metrics. Finally, we discuss detailed research findings on performance. These experimental results provide decision-making guidelines when selecting a controller.

A review of SDN‐enabled routing protocols for Named Data Networking

AbstractNamed Data Networking is a novel network architecture for the future internet in which data is named rather than addressed. This enables routers to forward data more efficiently based on its name, outperforming IP‐based routing. Another networking architecture that divides the control plane and the data plane is software‐defined networking (SDN). In an SDN network, the control plane decides on routing while the data plane forwards data packets. This separation increases routing flexibility and scalability. Numerous techniques to improve routing can be achieved with NDN and SDN integration. This paper provides an in‐depth examination of routing approaches in NDN based on SDN, emphasizing design principles, algorithms, and performance measures. We begin by summarizing the NDN architecture and delving into its essential components. We next go into the core routing ideas in NDN and categorize and study several routing solutions based on Software Defined Networks. Finally, we highlight the need for scalable, effective, and secure routing systems that may satisfy the expanding requirements of the contemporary internet. We also suggest open research topics in NDN routing based on SDN. This review provides an extensive overview of current centralized routing approaches in NDN, including their limitations and future possibilities.

Machine-Learning-Based Traffic Classification in Software-Defined Networks

Many research efforts have gone into upgrading antiquated communication network infrastructures with better ones to support contemporary services and applications. Smart networks can adapt to new technologies and traffic trends on their own. Software-defined networking (SDN) separates the control plane from the data plane and runs programs in one place, changing network management. New technologies like SDN and machine learning (ML) could improve network performance and QoS. This paper presents a comprehensive research study on integrating SDN with ML to improve network performance and quality-of-service (QoS). The study primarily investigates ML classification methods, highlighting their significance in the context of traffic classification (TC). Additionally, traditional methods are discussed to clarify the ML outperformance observed throughout our investigation, underscoring the superiority of ML algorithms in SDN TC. The study describes how labeled traffic data can be used to train ML models for appropriately classifying SDN TC flows. It examines the pros and downsides of dynamic and adaptive TC using ML algorithms. The research also examines how ML may improve SDN security. It explores using ML for anomaly detection, intrusion detection, and attack mitigation in SDN networks, stressing the proactive threat-detection and response benefits. Finally, we discuss the SDN-ML QoS integration problems and research gaps. Furthermore, scalability and performance issues in large-scale SDN implementations are identified as potential issues and areas for additional research.

Application of SDN-IP hybrid network multicast architecture in Commercial Aerospace Data Center

Abstract The increasing amount of massive data generated by commercial spacecraft in orbit puts forward higher and higher requirements for the stability, reliability, and computing power of computer systems for commercial aerospace data center. Data center computer systems are gradually transforming from X86 architecture and IP network model to a platform model with cloud computing and software-defined network (SDN) technology. This article proposes a new network architecture based on a unicast/multicast protocol for data interaction between the SDN and IP network. There are three main contributions of this article. The first is that the architecture proposed in this article aims to reduce end-to-end transmission latency and packet loss. The second is to improve the flexibility of system configuration and precise control when the SND controller state changes. The third is to verify the feasibility of deploying network architecture in a real data center environment.