Software Defined Networking Switches Research Articles

Request Dispatching Over Distributed SDN Control Plane: A Multiagent Approach.

Software-defined networking (SDN) allows flexible and centralized control in cloud data centers. An elastic set of distributed SDN controllers is often required to provide sufficient yet cost-effective processing capacity. However, this introduces a new challenge: Request Dispatching among the controllers by SDN switches. It is essential to design a dispatching policy for each switch to guide the request distribution. Existing policies are designed under certain assumptions, including a single centralized agent, global network knowledge, and a fixed number of controllers, which often cannot be satisfied in practice. This article proposes MADRina, Multiagent Deep Reinforcement Learning for request dispatching, to design policies with high dispatching adaptability and performance. First, we design a multiagent system to address the limitation of using a centralized agent with global network knowledge. Second, we propose a Deep Neural Network-based adaptive policy to enable request dispatching over an elastic set of controllers. Third, we develop a new algorithm to train the adaptive policies in a multiagent context. We prototype MADRina and build a simulation tool to evaluate its performance using real-world network data and topology. The results show that MADRina can significantly reduce response time by up to 30% compared to existing approaches.

TITAN: Combining a bidirectional forwarding graph and GCN to detect saturation attack targeted at SDN.

The decoupling of control and forwarding layers brings Software-Defined Networking (SDN) the network programmability and global control capability, but it also poses SDN security risks. The adversaries can use the forwarding and control decoupling character of SDN to forge legitimate traffic, launching saturation attacks targeted at SDN switches. These attacks can cause the overflow of switch flow tables, thus making the switch cannot forward benign network traffic. How to effectively detect saturation attack is a research hotspot. There are only a few graph-based saturation attack detection methods. Meanwhile, the current graph generation methods may take useless or misleading information to the attack detection, thus decreasing the attack detection accuracy. To solve the above problems, this paper proposes TITAN, a bidirecTional forwardIng graph-based saturaTion Attack detectioN method. TITAN defines flow forwarding rules and topology information, and designs flow statistical features. Based on these definitions, TITAN generates nodes of the bi-forwarding graph based on the flow statistics features and edges of the bi-forwarding graph based on the network traffic routing paths. In this way, each traffic flow in the network is transformed into a bi-directional forwarding graph. Then TITAN feeds the above bidirectional forwarding graph into a Graph Convolutional Network (GCN) to detect whether the flow is a saturation attack flow. The experimental results show that TITAN can effectively detect saturation attacks in SDNs with a detection accuracy of more than 97%.

SDN candidate and protection path selection for link failure protection in hybrid SDNs

Software-Defined Networks (SDNs) have emerged as significant frameworks for enhancing the network flexibility. Currently, the migration from legacy IP networks to pure SDNs promotes the development of hybrid SDNs. However, the inevitable link failures will damage the network reliability. Therefore, this paper focuses on upgrading the legacy routers to SDN switches with minimal deployment overhead for protecting against all link failures, and selecting appropriate protection paths with the routing flexibility of these switches, thus improving the network performance and resilience. Firstly, we propose the heuristic SCS_LN algorithm for SDN Candidate Selection (SCS) that narrows the selection range of SDN candidate nodes through the link protection difficulty and selects the upgraded nodes based on the node protection capability. Secondly, we develop PPS_PM algorithm with the weight-based selection rule for adaptive Protection Path Selection (PPS), which takes interactive path parameters into account, such as Protection Path Length (PPL) and Maximum Link Utilization (MLU). Finally, extensive simulation experiments on diverse network topologies with various parameters are conducted to demonstrate that our proposed algorithms save up to 12.58% of the SDN switch deployment, and gain up to 12.15% and 7.34% improvement of the average PPL and MLU over existing algorithms, respectively.

Reducing CPU Utilization & Improving Failover Time in Dual Controller SDN (Software Defined Network) Environment

A salient component of the network is failover. Largely, customers are accessing dual path controller software defined network (SDN) environment. Subsequently, when one controller fizzles out the network communication can persist as a result of the other controller. There will be no interruption in the network communication due to the failover setup which will be effective in case of failure of a controller. In the absence of failover, the network communication will be obstructed. This could be by cause of the system resources, system itself or routing policies or Distributed Denial of Services. Generally, controller will support many switches. When SDN controller collapses controller will not be in sync with switches. After few attempts switches will failover to the secondary SDN controller. During this shutdown time the network communication will be obstructed. Failover algorithm is the key to solve this issue and will facilitate the synchronization of the information with SDN controllers and enhance failover time. Apparently, communication between both SDN controllers and switches is enhanced as well as reinforces the time of synchronization due to multiple SDN controllers. CPU utilization is another problem in SDN environment as the new inflow packets need to be forwarded to control plane to find the action that need to be taken. Processing at both ends and having one to one mapping between new incoming connection requests and the packet from data plane to control plane increases the CPU utilization and there by more power consumption.

Toward Flexible and Predictable Path Programmability Recovery Under Multiple Controller Failures in Software-Defined WANs

Software-Defined Networking (SDN) promises good network performance in Wide Area Networks (WANs) with the logically centralized control using physically distributed controllers. In Software-Defined WANs (SD-WANs), maintaining path programmability, which enables flexible path change on flows, is crucial for maintaining network performance under traffic variation. However, when controllers fail, existing solutions are essentially coarse-grained switch-controller mapping solutions and only recover the path programmability of a limited number of offline flows, which traverse offline switches controlled by failed controllers. In this paper, we propose () to provide predictable path programmability recovery under multiple controller failures in SD-WANs. The key idea of is to approximately realize flow-controller mappings using hybrid SDN/legacy routing supported by high-end commercial SDN switches. Using the hybrid routing, we can recover programmability by selecting a routing mode for each offline flow at each offline switch in a fine-grained way to fit the given control resource from active controllers and release a few control resource of active controllers by reasonably configuring some normal flows under legacy routing mode. Thus, can promise ample control resource to improve the recovery efficiency and further effectively map offline switches to active controllers. Simulation results show that outperforms existing switch-level solutions by maintaining balanced programmability and increasing the total programmability of recovered offline flows up to 660% under topology and 590% under topology.

Secure Multi-Path Selection with Optimal Controller Placement Using Hybrid Software-Defined Networks with Optimization Algorithm

The Internet's growth in popularity requires computer networks for both agility and resilience. Recently, unable to satisfy the computer needs for traditional networking systems. Software Defined Networking (SDN) is known as a paradigm shift in the networking industry. Many organizations are used SDN due to their efficiency of transmission. Striking the right balance between SDN and legacy switching capabilities will enable successful network scenarios in architecture networks. Therefore, this object grand scenario for a hybrid network where the external perimeter transport device is replaced with an SDN device in the service provider network. With the moving away from older networks to SDN, hybrid SDN includes both legacy and SDN switches. Existing models of SDN have limitations such as overfitting, local optimal trapping, and poor path selection efficiency. This paper proposed a Deep Kronecker Neural Network (DKNN) to improve its efficiency with a moderate optimization method for multipath selection in SDN. Dynamic resource scheduling is used for the reward function the learning performance is improved by the deep reinforcement learning (DRL) technique. The controller for centralised SDN acts as a network brain in the control plane. Among the most important duties network is selected for the best SDN controller. It is vulnerable to invasions and the controller becomes a network bottleneck. This study presents an intrusion detection system (IDS) based on the SDN model that runs as an application module within the controller. Therefore, this study suggested the feature extraction and classification of contractive auto-encoder with a triple attention-based classifier. Additionally, this study leveraged the best performing SDN controllers on which many other SDN controllers are based on OpenDayLight (ODL) provides an open northbound API and supports multiple southbound protocols. Therefore, one of the main issues in the multi-controller placement problem (CPP) that addresses needed in the setting of SDN specifically when different aspects in interruption, ability, authenticity and load distribution are being considered. Introducing the scenario concept, CPP is formulated as a robust optimization problem that considers changes in network status due to power outages, controller’s capacity, load fluctuations and changes in switches demand. Therefore, to improve network performance, it is planned to improve the optimal amount of controller placements by simulated annealing using different topologies the modified Dragonfly optimization algorithm (MDOA).

FTODefender: An efficient flow table overflow attacks defending system in SDN

Software-Defined Networking (SDN) is a promising architecture that disentangles the control plane from the data plane. A mainstream southbound protocol for controller-to-switch communication in SDN is OpenFlow. In an OpenFlow-enabled network, SDN switches are connected to the logically centralized control plane, which issues control messages to direct packet forwarding and processing in the data plane. Given that the finite capacity of physical flow tables of switches, typically implemented with ternary content addressable memory (TCAM), attackers have the ability to carry out Denial-of-Service (DoS) attacks aimed at depleting the TCAM’s resources and causing an overflow of the flow table. In this paper, we propose FTODefender, a method combining eviction and cut-off attack sources to detect Low-rate Flow Table Overflow (LFTO) attacks and mitigate this kind of attacks in time. FTODefender consists of two modules: Detector and Mitigator. Detector periodically examines the flow table and extract four specific detection features. It then employs the trained CRITIC weights to calculate the detection score based on these extracted features to verify if the LFTO attack has happened. Mitigator computes the features for each flow and utilizes the LightGBM-LR classification model to identify attack flows among all flows. Then, the module evicts the malicious rules to mitigate attacks. Finally, Mitigator counts the occurrence of each source IP address in the eviction list, determines the attacker IP based on a predefined threshold, and issues a flow rule to drop all packets originating from the attacker’s IPs to sever the attack sources. Simulations show the effectiveness of FTODefender in mitigating the LFTO attacks, which proves that FTODefender is a practical solution to flow table overflow attacks.

USAGE : Uncertain flow graph and spatio-temporal graph convolutional network-based saturation attack detection method

With the development of Software-Defined Networking (SDN), its security problems have attached interests from academia. The saturation attack targeted at the SDN switch is one of the most destructive problems in SDN. The saturation attack can destroy SDN networks by depleting the computation and storage resources of SDN switches. Currently, graph neural networks have already been used for detecting saturation attacks in SDN. When constructing the graph based on K-Nearest Neighbors (KNN) algorithm, the number of edges in the graph is fixed. That may fail on accurately representing the relationship among different nodes. In addition, when using the Graph Convolutional Network (GCN) to detect saturation attack against SDN, only a partial graph structure and node features will be learned, causing the flow graph nodes information cannot be fully utilized. To overcome these issues, in this work, we propose USAGE, an uncertain flow graph and spatio-temporal graph neural network-based saturation attack detection method. More specifically, USAGE designs the CRAM algorithm and EGG model. The CRAM algorithm is proposed to generate an uncertain flow graph for each network traffic flow, which can represent the uncertain relationship among different nodes. EGG is a spatio-temporal graph convolutional network model, which is proposed to detect saturation attacks. The evaluation results demonstrate that USAGE can generate a better graph than KNN and achieve high detection performance. Meanwhile, USAGE outperforms other methods in terms of TPR, TNR, accuracy, precision, recall, F-score, confusion matrix, ROC curves, and PR curves.

An End-Host-Importance-Aware Secure Service-Enabled Hybrid SDN Deployment

Security is critical to networks, but TCP/IP-based legacy networks are difficult to advance new security functions due to the use of costly inflexible hardware devices and error-prone network configurations. Recent literature explores the paradigm of consolidating security services with the forwarding functionality using Software-defined Networking (SDN). Existing full SDN deployment, replacing all legacy network devices with SDN devices, is cost-prohibitive. Whereas the hybrid SDN that only upgrades partial legacy devices to SDN switches is considered practical. However, the challenge is to minimize threats and deployment expenses simultaneously under heterogeneous end-host businesses that have various importance. In this paper, we study the challenge and propose the (EASON) problem. We mathematically formulate the EASON problem as an integer programming problem, prove its non-polynomial time complexity, and propose a heuristic algorithm called BonSéc. We conduct rigorous simulations on real-world topologies and traces. Experimental results show that BonSéc achieves comparable security and cost performances to the optimal solution on small topologies. Meanwhile, it is scalable on larger topologies.

Quantum Networks for Resilient Power Grids: Theory and Simulated Evaluation

Quantum networks are considered to be the future of secure communication in the coming quantum era. However, significant efforts are lacking on developing practical quantum networks for power grids. This paper establishes a quantum network-based power grid (QNetGrid) framework and develops a real-time, reliable, flexible, programmable, and cost-effective QNetGrid software testbed containing repeater-based quantum communication, quantum routing, real software-defined networking (SDN) switches, and real-time networked microgrids (NMs) operations. It makes the following contributions: 1) a repeater and routing based quantum network simulator (QNSim) is developed, 2) repeaters with and without quantum memories are respectively simulated in QNSim, 3) different routing scenarios in QNetGrid are investigated, 4) a real-time QNetGrid software testbed is built in RTDS incorporating QNSim and real SDN switches, and 5) various test cases are designed, and experimental results produced with the QNetGrid testbed provide valuable insights for building quantum networks in power grids.

Enhancing Software-Defined Networks with Intelligent Controllers to Improve First Packet Processing Period

Software-Defined Networking (SDN) has a detailed central model that separates the data plane from the control plane. The SDN controller is in charge of monitoring network security and controlling data flow. OpenFlow-enabled routers and switches work as packet-forwarding devices in the network system. At first, OpenFlow forwarding devices like routers and switches do not know how to handle the data packets transmitted by the host. This is because they do not have any security controls, policies, or information. These packets are sent to their destination. In this situation, the OpenFlow forwarding device sends the first data packet of a host to the SDN controller, which checks the control packets for the data packet and creates flow entries in the switch flow table to act on the following categories of data packets coming from the host. These activities at the SDN controller and switch levels are time-intensive, and the first data packet from the host always takes a longer time to reach its destination. In this article, we suggest an SDN controller with instant flow entries (SDN-CIFE) to reduce the amount of time it takes for the host to transmit its first data packet. Before traffic comes from the host, our method adds the necessary flow entries to the flow table of the OpenFlow switch. The technique was made in Python and tested on a Mininet network emulator using the RYU controller. The results of the experiment show that the time it takes to process the first data packet is reduced by more than 83%.

ProbD: Faulty Path Detection Based on Probability in Software-Defined Networking

With the increasing number of switches in Software-Defined Networking (SDN), there are more and more faults rising in the data plane. However, due to the existence of link redundancy and multi-path forwarding mechanisms, these problems cannot be detected in time. The current faulty path detection mechanisms have problems such as the large scale of detection and low efficiency, which is difficult to meet the requirements of efficient faulty path detection in large-scale SDN. Concerning this issue, we propose an efficient network path fault testing model ProbD based on probability detection. This model achieves a high probability of detecting arbitrary path fault in the form of small-scale random sampling. Under a certain path fault rate, ProbD obtains the curve of sample size and probability of detecting arbitrary path fault by randomly sampling network paths several times. After a small number of experiments, the ProbD model can correctly estimate the path fault rate of the network and calculate the total number of paths that need to be detected according to the different probability of detecting arbitrary path fault and the path fault rate of the network. The final experimental results show that, compared with the full path coverage test, the ProbD model based on probability detection can achieve efficient network testing with less overhead. Besides, the larger the network scale is, the more overhead will be saved.

Time-Based Moving Target Defense Using Bayesian Attack Graph Analysis

The moving target defense (MTD) is a proactive cybersecurity defense technique that constantly changes potentially vulnerable points to be attacked, to confuse the attackers, making it difficult for attackers to infer the system configuration and nullify reconnaissance activities to a victim system. We consider an MTD strategy for software-defined networking (SDN) environment where every SDN switch is controlled by a central SDN controller. As the MTD may incur excessive usage of the network/system resources for cybersecurity purposes, we propose to perform the MTD operations adaptively according to the security risk assessment based on a Bayesian attack graph (BAG) analysis. For accurate BAG analysis, we model random and weakest-first attack behaviors and incorporate the derived analytical models into the BAG analysis. Using the BAG analysis result, we formulate a knapsack problem to determine the optimal set of vulnerabilities to be reconfigured under a constraint of SDN reconfiguration overhead. The experiment results prove that the proposed MTD strategy outperforms the full MTD and random MTD counterparts in terms of the maximum/average of attack success probabilities and the number of SDN reconfiguration updates.

Detection Collision Flows in SDN Based 5G Using Machine Learning Algorithms

The rapid advancement of wireless communication is forming a hyper-connected 5G network in which billions of linked devices generate massive amounts of data. The traffic control and data forwarding functions are decoupled in software-defined networking (SDN) and allow the network to be programmable. Each switch in SDN keeps track of forwarding information in a flow table. The SDN switches must search the flow table for the flow rules that match the packets to handle the incoming packets. Due to the obvious vast quantity of data in data centres, the capacity of the flow table restricts the data plane’s forwarding capabilities. So, the SDN must handle traffic from across the whole network. The flow table depends on Ternary Content Addressable Memorable Memory (TCAM) for storing and a quick search of regulations; it is restricted in capacity owing to its elevated cost and energy consumption. Whenever the flow table is abused and overflowing, the usual regulations cannot be executed quickly. In this case, we consider low-rate flow table overflowing that causes collision flow rules to be installed and consumes excessive existing flow table capacity by delivering packets that don’t fit the flow table at a low rate. This study introduces machine learning techniques for detecting and categorizing low-rate collision flows table in SDN, using Feed Forward Neural Network (FFNN), K-Means, and Decision Tree (DT). We generate two network topologies, Fat Tree and Simple Tree Topologies, with the Mininet simulator and coupled to the OpenDayLight (ODL) controller. The efficiency and efficacy of the suggested algorithms are assessed using several assessment indicators such as success rate query, propagation delay, overall dropped packets, energy consumption, bandwidth usage, latency rate, and throughput. The findings showed that the suggested technique to tackle the flow table congestion problem minimizes the number of flows while retaining the statistical consistency of the 5G network. By putting the proposed flow method and checking whether a packet may move from point A to point B without breaking certain regulations, the evaluation tool examines every flow against a set of criteria. The FFNN with DT and K-means algorithms obtain accuracies of 96.29% and 97.51%, respectively, in the identification of collision flows, according to the experimental outcome when associated with existing methods from the literature.

CWT-DPA: Component-wise waiting time for BC-enabled data plane authentication

Software-Defined Networking (SDN) is a promising networking paradigm that brings central management and network programmability to improve existing networking systems. However, SDN has several security threats due to its untrusted control and data planes. Blockchain (BC) technology has recently provided a fault-tolerant, decentralized, and immutable ledger among untrusted parties. While the integration between SDN and BC enhances the security, it suffers from performance degradation when applied to SDN’s data plane. In traditional BC-SDN approaches, such as our previous work DPSEC (Latah and Kalkan, 2020), every switch has to wait for the final commitment of each submitted transaction, which significantly decreases the performance of the BC-SDN model. In this work, we enhance the performance of BC-SDN data plane approaches by separating switch-related and host-related transactions and propose a different waiting strategy for each type of data plane transaction. We also propose a batching technique to enhance the average latency for high-load scenarios. In addition, SDN switches and controllers utilize lattice-based signatures and Key Encapsulation Methods (KEMs) to protect against quantum adversaries. We compare the performance of CWT-DPA with existing solutions such as SSL/TLSv1.3, DPSEC (Latah and Kalkan, 2020), and AuthFlow (Mattos and Duarte, 2016).

Latency control in service chaining using P4-based data plane programmability

Service chaining is becoming one of the most considered service deployment frameworks in the context of Network Function Virtualization (NFV) in edge and data center environments, conveniently supported by automatic connectivity configurations offered by Software Defined Networking (SDN). Current research on the topic is focusing on how to guarantee Quality of Service (QoS) in terms of guaranteed end-to-end latency for time critical services. Indeed, latency issues may depend on intra-server virtualization inefficiencies, leading to Virtual Network Function (VNF) delivery delays, or by congestion events occurring at intermediate network elements connecting VNFs. Latency control requires stateful information such as flow delay measurements at a per-packet level, typically not available at traditional SDN switches or inside the VNF. This paper proposes the adoption of SDN data plane programmability exploiting the P4 language and presents two P4 pipeline solutions, suitable for both intra-rack and inter-rack service chain deployments, to automatically check the path latency experienced by selected high priority flows, also resorting to the recent in-band telemetry applications. The programmable pipelines enforce proactive in-network functions, such as priority change or drop actions, in order to guarantee a bound SFC segment latency delivery, including both the network and the segment VNFs. The proposed solutions are implemented and evaluated in a network testbed employing programmable software switches showing their effectiveness in guaranteeing the configured end-to-end latency, and the limited effort in terms of additional processing at the P4 switch. The evaluation is carried out using the reference P4 software switch, i.e., BMv2. The aim is to validate the full P4 capabilities and the code feasibility in terms of scalability, load and resource impact and added intra-switch latency. The experimental results show the proposed approach scales with the number of forwarded flows and achieves per-segment latency control enforcement in both congested and non-congested scenarios with a very limited impact on the switch extra-latency, exploiting finer per-packet tuning of drop and priority change simply applicable through flow entry configuration. Applicability analysis on hardware switches guaranteeing line rate performance are provided.

SliceBlock: Context-Aware Authentication Handover and Secure Network Slicing Using DAG-Blockchain in Edge-Assisted SDN/NFV-6G Environment

Network slicing in a 6G environment is an important research area in the current years. However, satisfying the demands of network slice requests is a challenging task. Energy-efficient, secure, and Quality of Service (QoS) aware network slicing is important since network slices must share fewer amounts of resources. Further, implementing secure network slicing for software-defined networks (SDNs)/network function virtualization (NFV) is crucial. In this article, we tackle the issues, such as security, QoS, and resource consumption issues through network slicing and load balancing mechanisms in SDN/NFV assisted 6G environments. First, deep network slicing is implemented using generative adversarial network (GAN) for network slicing and management. Based on the slice capacity, slice priority, and QoS demands of network slices, GAN predicts the appropriate slice and links for data transmission. For each slice, the directed acyclic graph (DAG)-based blockchain technology is used in which traditional consensus is replaced by the Proof of Space (PoS) algorithm. A limitation of scalability and high resource consumption in the traditional blockchain is addressed in DAG-blockchain. To improve security, context-based authentication, and secure handover schemes are presented using the Markov decision making (MDM) and weighted product model, respectively. Then, higher load faced at the SDN controllers and switches are addressed by intruder packets classification and packets migration through hybrid neural decision tree (HyDNT) and Hybrid Political optimizer with a Heap-based Optimizer (HPoHO), respectively. To predict the load accurately, environment learning is implemented using the soft actor-critic (SAC) algorithm. Finally, the performance of the proposed SliceBlock model is evaluated.

SCOPE: Cost-Efficient QoS-Aware Switch and Controller Placement in Hybrid SDN

This article addresses the joint switch and controller placement problem in a hybrid software-defined network (SDN), which is an intermediate step of transforming a traditional backbone network into a pure SDN. For a hybrid SDN, the quality of service (QoS) is a primary concern for ensuring service guarantee of a traditional network, while providing additional benefits of softwarization. In the SDN, the positions of SDN controllers determine the QoS parameters, such as network throughput and flow processing delays. Many existing solutions determine the controller locations to optimize the latency of network links and control plane load. However, there is a need to address the problem considering additional aspects of the hybrid SDN, such as SDN switch placement and incremental upgrades. In this article, we propose a priority-based SDN switch placement approach and an incremental controller placement approach for the hybrid SDN. Simulation results depict that the proposed scheme increases programmable traffic by 9.90% compared to the existing MapFirst scheme when the switch upgrade budget is <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">${\$}$</tex-math></inline-formula> 400 K. The proposed scheme decreases QoS violation by 20.89% compared to the Greedy approach with 0.3 million flows.

Modeling and optimization of the data plane in the SDN-based DCN by queuing theory

Complicated management tasks and various functions of traditional Data Center Network (DCNs) motivate the research on Software-Defined Networking (SDN). However, the limited flow table space in the SDN switch has a significant impact on the data plane especially the availability. In this paper, we propose a theoretical model based on queuing theory to estimate the flow table states of SDN switches, providing operators insights into the requirements of flow table resources and guaranteeing the performance of the data plane. First, we analyze the lifecycle of a flow table entry and construct a queuing theory based estimation model to estimate flow table states in the data plane. Second, we observe the real workloads of DCNs and figure out the probability characteristics of routing strategies to calculate the key parameters in our model. Third, for achieving an optimally latency-aware data plane, we propose an auxiliary method, Amora, to maintain the availability of the data plane by improving routing decisions with the consideration of the optimal flow table states obtained by our model. Comprehensive experiments show that the relative estimation error of flow table states in our model is around 10%, which exposes the actual flow table states and benefits the selection of proper switches. Moreover, Amora efficiently eliminates the failure cases of establishing routing paths in the data plane, which further demonstrates the precision and practicability of our estimation model.

Path selection for link failure protection in hybrid SDNs

During the transition from traditional networks to pure Software-Defined Networks (SDNs), hybrid SDNs are derived to provide flexible services. Furthermore, developing effective failure protection algorithms is significantly urgent to improve the robustness and resilience of networks. In this paper, we propose several algorithms, including Straightforward Protection Path Selection with the Source and Destination-based Tunneling mechanism (S-PPSSDT), its simplification PPSSDT and Protection Path Selection with Load-Balancing (PPSLB) algorithms. Considering that the Protection Path Length (PPL) will affect the transmission delay of rerouted packets, S-PPSSDT leverages the source and destination-based tunneling mechanism to select optimum protection paths with the shortest length. Based on classification idea and optimization search, PPSSDT prunes unnecessary path searches in S-PPSSDT. Combining the tunneling mechanism with the priority-based Maximum Link Utilization (MLU) minimization approach, PPSLB also focuses on load balancing during failure protection to achieve potential congestion avoidance simultaneously. Besides, these algorithms redirect the traffic through various tunnels for affected paths by the non-shortest path routing capability of SDN switches. Extensive simulation results indicate that our proposed algorithms can effectively reduce the PPL and MLU of hybrid SDNs during failure protection, and have excellent performance under various network parameters compared with the state-of-the-art algorithms.