Software Defined Networking Paradigm Research Articles

Q-SR: An extensible optimization framework for segment routing

Segment routing (SR) combines the advantages of source routing powered by software-defined networking (SDN) paradigm and hop-by-hop routing in legacy network infrastructure. The recent applications of SR in multi-domain network and service function chaining (SFC) entail the efficient use of multiple segments. However, because of the computation inefficiency, it is nearly impossible to accurately evaluate whether and to what extent various types of networks will benefit from SR with multiple segments using conventional approaches. In this paper, we propose a flexible Q-SR framework as well as its formulation in order to fully explore the potential of SR from an algorithmic perspective. The framework is highly extensible to design and evaluate algorithms that can be adapted to various network topologies and traffic matrices. For the offline setting, we develop a fully polynomial time approximation scheme (FPTAS) which can find a (1+ω)-approximation solution for any specified ω>0 in time that is a polynomial function of the network size. To the best of our knowledge, the proposed FPTAS is the first algorithm that can compute arbitrarily accurate solution. For the online setting, we develop an online primal–dual algorithm that is proven to be O(1)-competitive and violates link capacities by a factor of O(logn), where n is the node number of the network. For the proposed approximation algorithms, we prove theoretical performance bounds and conduct extensive simulations on synthetic and realistic networks to analyze SR related and algorithmic parameters and validate the computation efficiency in both offline and online scenarios.

Efficient topology control of blockchain peer to peer network based on SDN paradigm

Blockchain allows to securely store, using cryptography functions, validated transactions and other data across its peer to peer (P2P) network. This P2P network is generated and maintained by the participating peers in a distributed manner through peer discovery, neighbor selection and managing inbound/outbound connections. As these tasks require extra consumption of network bandwidth, energy, memory and CPU usage, resource-limited devices may not support inherent blockchain applications. Further, changes in the topology control functions or reconfiguration should be considered by all peers to fully benefit from the new performance, which can take time. The aim of this paper is to build a blockchain network in a manner that greatly reduce topology control overhead while guaranteeing the properties such as high flexibility, fast reconfigurability, connectivity, small diameter and clustering. For this, we propose to use the Software-Defined Networking (SDN) paradigm to manage the blockchain P2P network. This way, the topology control tasks are moved off the peers to a secure overlay layer composed of multiple servers having synchronized databases. This new layer is responsible for building and managing the topological structure of the P2P network layer based on random r-out digraphs. Next, we mathematically discuss r-out digraphs generation using binomial distribution and preferential attachment models. Then, and in order to reduce the number of connections per peer, we establish lower and minimum upper bounds on outbound and inbound connections respectively that still guarantee the P2P network feasibility and connectivity. Further, we investigate topological properties of blockchain P2P network such as connectivity, diameter and clustering. Finally, we provide extensive simulation and numerical results to verify the efficiency of our approach and illustrate the effects of centralized topology control on network performance.

Machine learning based malicious payload identification in software-defined networking

Deep packet inspection (DPI) has been extensively investigated in software-defined networking (SDN) as complicated attacks may intractably inject malicious payloads in the packets. Existing proprietary pattern-based or port-based third-party DPI tools can suffer from limitations in efficiently processing a large volume of data traffic. In this paper, a novel OpenFlow-enabled deep packet inspection (OFDPI) approach is proposed based on the SDN paradigm to provide adaptive and efficient packet inspection. First, OFDPI prescribes an early detection at the flow-level granularity by checking the IP addresses of each new flow via OpenFlow protocols. Then, OFDPI allows for deep packet inspection at the packet-level granularity: (i) for unencrypted packets, OFDPI extracts the features of accessible payloads, including tri-gram frequency based on Term Frequency and Inverted Document Frequency (TF–IDF) and linguistic features. These features are concatenated into a sparse matrix representation and are then applied to train a binary classifier with logistic regression rather than matching with specific pattern combinations. In order to balance the detection accuracy and performance bottleneck of the SDN controller, OFDPI introduces an adaptive packet sampling window based on the linear prediction; and (ii) for encrypted packets, OFDPI extracts notable features of packets and then trains a binary classifier with a decision tree, instead of decrypting the encrypted traffic to weaken user privacy. A prototype of OFDPI is implemented on the Ryu SDN controller and the Mininet platform. The performance and the overhead of the proposed solution are assessed using the real-world datasets through experiments. The numerical results indicate that OFDPI can provide a significant improvement in detection accuracy with acceptable overheads.

Heterogeneous SDN controller placement problem—The Wi-Fi and 4G LTE-U case

The widespread deployment of 5G wireless networks has brought about a radical change in the nature of mobile data consumption. It requires the deployment of Long Term Evolution to the unlicensed spectrum (LTE-U) to alleviate the shortage of available licensed spectrum while Wi-Fi is the most dominant radio access technology in the unlicensed spectrum. This has led to suggestions concerning the coexistence of multi radio access technologies such as Wi-Fi and LTE-U. Clearly, Software Defined Networks (SDN) can utilize the LTE-U radio bandwidth efficiently. The SDN paradigm decouples the network’s control logic from the underlying routers and switches, which promotes centralization of network control. The controller placement problem is crucial to SouthBound interface optimization and involves the location of the controllers, their number and the assignment function of switches to controllers. In this paper, a novel strategy is presented to address the wireless controller placement problem, which improves the throughput, link failure probability and the transparency on the SouthBound interface in cases where hybrid providers choose either LTE-U or Wi-Fi as link layer technologies. The problem of determining the placement of LTE-U and Wi-Fi based controllers is modeled and two heuristic solutions are proposed. Simulations show that the proposed algorithms provide a fast and efficient solution.

Towards the Quantum Internet: Satellite Control Plane Architectures and Protocol Design

The creation of the future quantum Internet requires the development of new systems, architectures, and communications protocols. As a matter of fact, the optical fiber technology is affected by extremely high losses; thus, the deployment of a quantum satellite network (QSN) composed of quantum satellite repeaters (QSRs) in low Earth orbit would make it possible to overcome these attenuation problems. For these reasons, we consider the design of an ad hoc quantum satellite backbone based on the Software-Defined Networking (SDN) paradigm with a modular two-tier Control Plane (CP). The first tier of the CP is embedded into a Master Control Station (MCS) on the ground, which coordinates the entire constellation and performs the management of the CP integrated into the constellation itself. This second tier is responsible for entanglement generation and management on the selected path. In addition to defining the SDN architecture in all its components, we present a possible protocol to generate entanglement on the end-to-end (E2E) path. Furthermore, we evaluate the performance of the developed protocol in terms of the latency required to establish entanglement between two ground stations connected via the quantum satellite backbone.

An SDN-based traffic handover control procedure and SGD management logic for EHF satellite networks

Smart Gateway Diversity (SGD) is a fundamental concept introduced to maintain high service availability in High Throughput Satellites (HTS) working at frequency bands above Ka-band. This paper proposes a novel approach for the SGD management logic that takes into account the “graceful degradation” of the link for triggering a handover of traffic among gateways (GWs.) Moreover, the paper proposes a Software Defined Network (SDN) implementation of the handover control procedure and an algorithm for building the flows matrices of the SDN switches that guarantees a fair balancing of traffic among the gateways, thus allowing a better exploitation of resources and maximization of the overall operational capacity of the HTS system. The SDN paradigm, by allowing efficient network programmability and real time re-configuration of the flow tables, enables the possibility to implement dynamic and granular resource allocation; this is a fundamental requirement for the proposed novel SGD network management approach, where re-configuration is triggered by smaller and more frequent signal-to-noise ratio (SNR) fluctuations. The performance of the proposed handover control procedures have been evaluated over real Q/V band link by using the experimental data collected through the TDP5 “Aldo Paraboni” payload embarked on the Alphasat satellite. Performance results show a gain of 40% in terms of aggregated capacity of the system with respect to the case of using an on–off SGD management logic.

Cloud-Based Zero Trust Access Control Policy: An Approach to Support Work-From-Home Driven by COVID-19 Pandemic.

The ubiquitous cloud computing services provide a new paradigm to the work-from-home environment adopted by the enterprise in the unprecedented crisis of the COVID-19 outbreak. However, the change in work culture would also increase the chances of the cybersecurity attack, MAC spoofing attack, and DDoS/DoS attack due to the divergent incoming traffic from the untrusted network for accessing the enterprise’s resources. Networks are usually unable to detect spoofing if the intruder already forges the host’s MAC address. However, the techniques used in the existing researches mistakenly classify the malicious host as the legitimate one. This paper proposes a novel access control policy based on a zero-trust network by explicitly restricting the incoming network traffic to substantiate MAC spoofing attacks in the software-defined network (SDN) paradigm of cloud computing. The multiplicative increase and additive decrease algorithm helps to detect the advanced MAC spoofing attack before penetrating the SDN-based cloud resources. Based on the proposed approach, a dynamic threshold is assigned to the incoming port number. The self-learning feature of the threshold stamping helps to rectify a legitimate user’s traffic before classifying it to the attacker. Finally, the mathematical and experimental results exhibit high accuracy and detection rate than the existing methodologies. The novelty of this approach strengthens the security of the SDN paradigm of cloud resources by redefining conventional access control policy.

Adversarial Deep Learning approach detection and defense against DDoS attacks in SDN environments

Over the last few years, Software Defined Networking (SDN) paradigm has become an emerging architecture to design future networks and to meet new application demands. SDN provides resources for improving network control and management by separating control and data plane, and the logical control is centralized in a controller. However, the centralized control logic can be an ideal target for malicious attacks, mainly Distributed Denial of Service (DDoS) attacks. Recently, Deep Learning has become a powerful technique applied in cybersecurity, and many Network Intrusion Detection (NIDS) have been proposed in recent researches. Some studies have indicated that deep neural networks are sensitive in detecting adversarial attacks. Adversarial attacks are instances with certain perturbations that cause deep neural networks to misclassify. In this paper, we proposed a detection and defense system based on Adversarial training in SDN , which uses Generative Adversarial Network (GAN) framework for detecting DDoS attacks and applies adversarial training to make the system less sensitive to adversarial attacks. The proposed system includes well-defined modules that enable continuous traffic monitoring using IP flow analysis, enabling the anomaly detection system to act in near-real-time. We conducted the experiments on two distinct scenarios, with emulated data and the public dataset CICDDoS 2019. Experimental results demonstrated that the system efficiently detected up-to-date common types of DDoS attacks compared to other approaches.

Future Technology: Software-Defined Network (SDN) Forensic

The software-defined networking (SDN) paradigm has recently emerged as a trend to build various protocols, develop more reliable networks, enhance the data flow controlling, and provide security in a much simpler and flexible way. SDN helps to ease management and handle asymmetric connectivity across various nodes. It solves the problems of network and cloud security and hence provides the best solution for the safety of data on the network. Therefore, we feel the urge to research more and provide the basics of SDN forensics, mention its advantages in network especially in the cloud, and present its elaborate prospects in context with Network Forensic (NF) and Cloud Forensic (CF). In this research article, we explained in detail the NF and CF with emphasis on Network security (NS) and Cloud Security (CS). The paper also provided the various security approaches and categories. Then, an overview of the software-defined networking (SDN) is mentioned. We also discussed the use of SDN in Network Forensic and Cloud Forensic. Furthermore, to aid the SDN forensic, we presented the advantages, challenges, and issues along with future research directions of SDN in network forensic and cloud forensic, and at last, we thus express and explore the need for security in forensic based on the SDN paradigm in the form of a set of suggested recommendations.

Linking handover delay to load balancing in SDN-based heterogeneous networks

Software-Defined Networking (SDN) paradigm provides the ability to handle mobility more efficiently due to its programmability and fine granularity. However, in this emerging setting, the handover procedure still suffers delay due to exchanging and processing handover signaling messages. In this paper, we study the relevancy between an SDN controller’s load and handover delay. We show that an over-loading state can prolong handover delay, so as a countermeasure, reaching that state is mitigated by applying a load balancing mechanism. Our primary metric is the controller’s response time, as it directly affects the completion of any mobility-related procedure. We propose a load balancing management framework that deploys two concepts: network heterogeneity and context-aware vertical mobility. Our proposal is composed of three main aspects. First, we identify candidate users based on their context information. Second, we reduce the frequency of load dissemination between multiple controllers, and hence, reducing processing and communication overhead. Third, after the candidate users are determined, we optimize the decision problem on the selection among heterogeneous candidate networks. Through simulation, our framework has shown as much drop as a 28% drop in response time compared to previous proposals.

An architecture for power substations communication networks based on SDN and virtualization paradigms

The deployment of infrastructures related to the Smart Grid concept introduces data communication networks in the grid operation systems (control, communication, and monitoring). The implementation of data communication networks facilitates and improves the efficiency of the tasks related to the generation, transmission, and distribution of electrical energy. In turn, network management is being permeated by new technologies such as Software Defined Networking (SDN) and network virtualization, that promote automation and innovation of communication networks aiming to overcome the lack of flexibility and the difficulties to evolve that are present in current communication networks. In this context, this paper proposes a reconceptualization of the power substations communications network architecture based on the IEC 61850 standard. Here, we present a complete view of the Smart Solution for Substation Networks (S3N) architecture, which allows modeling the future power substations communication networks taking advantage of the benefits introduced by SDN and virtualization technologies. In addition, in order to provide a better understanding of the challenges arising in this area, and to generate new research interest in this field, a review of several studies oriented to determine the feasibility of incorporating SDN as a key element to improve the management and operation of the power substations communication networks is presented.

Towards an Efficient Resource Allocation based on Software-Defined Networking approach

Quality of Service (QoS) provisioning in a converged network is a particularly difficult and yet extremely important task. With the coexistence of different types of services, it is challenging to manage and guarantee a good level of performance through manual customization of QoS policies. The Software-Defined Networking (SDN) paradigm can manage the QoS policies and network resources in an automatic and dynamic way through a controller. SDN orchestrates the equipment that supports the OpenFlow protocol. The Hybrid SDN approach provides the ability to manage SDN and legacy equipment. This paper introduces a new intelligent and flexible QoS management model based on the principle of SDN called “Efficient Resource Allocation” (ERA). Experiment comparisons between different QoS mechanisms demonstrate the effectiveness of our proposed model by minimizing delay, latency, jitter, and reducing loss rate.

Programmable disaggregated multi-dimensional S-BVT as an enabler for high capacity optical metro networks

To meet the requirements of 5G high capacity optical metro networks, a programmable disaggregated multi-dimensional sliceable bandwidth/bitrate variable transceiver (S-BVT) is proposed. Specifically, transceiver multi-dimensionality is presented exploiting spatial, polarization, and spectral information as a solution to support network capacity and bandwidth scaling 5G requirements. Space division multiplexing is implemented by considering a 19-core multicore fiber enabling capacity scaling with the number of cores, whereas polarization division multiplexing is assessed enabling 50% spectral saving by considering two orthogonal polarization components. Finally, by the implementation of multi-band transmission systems, the optical bandwidth can be increased by a factor of 10, compared to a conventional C-band system. In these last two cases, the existing spectrum and network infrastructure can be reused, bringing new capabilities. In particular, in this work, multi-band transmission is assessed by exploiting the C-band and L-band. Additionally, disaggregation is also addressed at the transceiver level to enhance network flexibility, avoiding vendor lock-in while achieving efficiency and cost reduction. Disaggregation enables assembling open components, devices, and sub-systems into optical infrastructures and networks. On the other hand, the adoption of the software defined networking paradigm enables system/network programmability and reconfigurability, promoting an efficient use of the multi-dimensional network resources. Therefore, in this work, we analyze and experimentally demonstrate different S-BVT advanced functionalities suitable to support the stringent network requirements of 5G. These capabilities include rate/distance adaptability, programmability/configurability, disaggregation, and multi-dimensionality. Different network scenarios have been considered to assess the S-BVT functionalities, enabling Tb/s optical transmission.

Leveraging Software-Defined Networking Approach for Future Information-Centric Networking Enhancement

Information-centric networking (ICN) has been developed as a potential candidate for future networks. In this model, users are provided with content rather than communication channels between the different hosts. The ICN network has several problems such as scalability issues and bandwidth consumption. However, software-defined networking (SDN) has been proposed to improve the networking architectures. The goal of our paper is to propose a new approach to named-data networking (NDN) based on the paradigm of SDN. Our work introduces various research studies carried out in the SDN and ICN contexts. We first present the SDN architecture. Then, we focus on work that combines ICN and SDN architectures. Finally, we show the effects of using the SDN architecture on the named-data network (NDN). Our experimental results show that the use of the SDN architecture has a positive effect on NDN network performance.

Guest Editors Introduction: Special Issue on Advanced Management of Softwarized Networks

The Softwarization of networks is enabled by the SDN (Software-Defined Networking), NV (Network Virtualization), and NFV (Network Function Virtualization) paradigms, and offers many advantages for network operators, service providers and data-center providers. Given the strong interest in both industry and academia in the softwarization of telecommunication networks and cloud computing infrastructures, a series of special issues was established in IEEE Transactions on Network and Service Management, which aims at the timely publication of recent innovative research results on the management of softwarized networks.

Detecting and mitigating cyberattacks using software defined networks for integrated clinical environments

The evolution of integrated clinical environments (ICE) and the future generations of mobile networks brings to reality the hospitals of the future and their innovative clinical scenarios. The mobile edge computing paradigm together with network function virtualization techniques and the software-defined networking paradigm enable self-management, adaptability, and security of medical devices and data management processes making up clinical environments. However, the logical centralized approach of the SDN control plane and its protocols introduce new vulnerabilities which affect the security of the network infrastructure and the patients’ safety. The paper at hand proposes an SDN/NFV-based architecture for the mobile edge computing infrastructure to detect and mitigate cybersecurity attacks exploiting SDN vulnerabilities of ICE in real time and on-demand. A motivating example and experiments presented in this paper demonstrate the feasibility of of the proposed architecture in a realistic clinical scenario.

A softwarized and MEC-enabled protocol architecture supporting consumer mobility in Information-Centric Networks

Information-Centric Networking emerged as a powerful enabling technology for the provisioning of scalable and efficient real-time services in Future Internet, mobile architectures, and multi-hop wireless mesh networks. To serve mobile consumers, most of scientific contributions suggest to extend the information-centric communication primitives by means of a pull-based methodology, according to which the mobile consumer issues pending requests every time it reaches a new network attachment point. This approach, however, generates two important shortcomings. First, the requests delivered before the handover will generate stale paths with wrong forwarding information in their network routers. As a consequence, some new contents will be delivered also to previous locations, thus wasting bandwidth. Second, during handovers, mobile consumers may miss some contents released in real-time and lose the synchronization with the remote producer. In order to solve these issues, this work conceives a novel protocol architecture that successfully integrates and properly customizes the key functionalities of Information-Centric Networking, Multi-access Edge Computing, and Software Defined Networking paradigms. Specifically, the designed approach envisages that (1) Multi-access Edge Computing assists mobile consumers in retrieving data, while transparently managing the information-centric communication primitives and recovering the synchronization with the remote producer after the handover, (2) Software-Defined Controllers dynamically configure forwarding functionalities, and (3) Information-Centric Networking enables efficient data dissemination and delivers network control instructions. The impact of the devised protocol architecture on the communication overhead is analytically formulated and evaluated in scenarios with different topology, mobility, application settings, and number of mobile consumers. The comparison with respect to the pure Information-Centric Networking deployment demonstrates that the proposed solution ensures a reduction of the communication overhead up to 99.99% on the data plane, an overall bandwidth saving up to 99.93%, and a not negligible memory saving in intermediary routers. At the same time, the adoption of information-centric communication primitives for the control plane achieves an overhead reduction ranging from 29.36% to 51.13% with respect to an implementation based on the conventional OpenFlow protocol.

Machine Learning-Based Multipath Routing for Software Defined Networks

Network softwarization has recently been enabled via the software-defined networking (SDN) paradigm, which separates the data plane from control plane allowing for a flexible and centralized control of networks. This separation facilitates implementation of machine learning techniques for network management and optimization. In this work, a machine learning-based multipath routing (MLMR) framework is proposed for software-defined networks with quality-of-service (QoS) constraints and flow rules space constraints. The QoS-aware multipath routing problem in SDN is modeled as multicommodity network flow problem with side constraints, that is known to be NP-hard. The proposed framework utilizes network status estimates, and their corresponding routing configurations available at the network central controller to learn a mapping function between them. Once the mapping function is learned, it is applied on live-inputs of network status and routing requests to predict a multipath routing solutions in real-time. Performance evaluations of the MLMR framework on real traces of network traffic verify its accuracy and resilience to noise in training data. Furthermore, the MLMR framework demonstrates more than 98.99% improvement in computational efficiency.

Defense Against Advanced Persistent Threat Through Data Backup and Recovery

Advanced persistent threat (APT) as a generic highly sophisticated cyber attack poses a severe threat to organizational data security. Since the conventional detection and repair (DAR)-based APT defense mechanism has several conspicuous drawbacks, it is imperative to develop a more effective and efficient APT defense mechanism. Based on the data backup and recovery (DBAR) techniques developed in the field of disaster recovery, we propose a novel APT defense mechanism referred to as DBAR-based APT defense mechanism, which can overcome the main drawbacks of the DAR-based APT defense mechanism and is expected to be implementable efficiently in the software-defined networking (SDN) paradigm. Under the new mechanism, we study the problem of finding a cost-effective DBAR strategy. Based on a novel dynamic model characterizing the evolution of the expected security status of the organizational network, we reduce the problem to a differential game-theoretic problem, which is aimed to seek a cost-effective DBAR strategy in terms of the Nash equilibrium solution concept. Next, we derive the optimality system of the problem. Extensive comparative experiments show that the DBAR strategy obtained from the optimality system is cost-effective in the sense of Nash equilibrium solution concept.

An SDN-based true end-to-end TCP for wireless LAN

Segment losses due to intermittent connectivity and mobility lead to sub optimal performance of the Transmission Control Protocol (TCP). This is due to the fact that segment loss is considered as a binary signal for triggering congestion control and retransmission mechanisms at the TCP sender. In wired networks, segments are dropped due to congestion at the routers and the strategy of taking missed acknowledgment as an implicit signal for congestion control performs well. However, in wireless networks, segment losses are primarily due to mobility and transmission errors. Unlike many previous efforts, this paper proposes the design and implementation of Software Defined Network (SDN) assisted TCP which does not require the wireless Access Points (APs) to be TCP-aware and preserves end to end semantics. Further, no changes are required to be done in TCP protocol implementation at the end-hosts. The proposed approach utilizes the programmability provided by the SDN paradigm to intelligently trigger the spurious timeout detection and response algorithms, already implemented in standard TCP. The proposed approach is compared with the standard TCP and SDN assisted Zero Window based approach on Linux kernels using virtual data-plane switches and APs provided by the Mininet-WiFi platform. The implementation results establish the applicability of the proposed approach.