Programmability Of Software Defined Networking Research Articles

Blockchain empowerment: Investigating integration with software-defined networks and its impact on IoT privacy

The swift expansion of Internet of Things (IoT) devices has brought forth exceptional prospects for automation and data-driven decisions. Software-Defined Networking (SDN) is an instance of network architecture that divides network devices into a control plane and a data plane. SDN provides a dynamic and adaptable method of managing the growing complexity of IoT devices with its programmable design and centralized control. A network's capacity to handle an increasing number of IoT devices is facilitated by SDN's improved scalability. Custom network policies and services that are suited to the distinctive requirements of various IoT applications it can be established because of SDN's programmability. SDN and blockchain integration can improve network transaction and configuration security. Here, blockchain technology is decentralized. There is not just one point of failure, which lowers the possibility of malicious attacks and illegal access. The study demonstrates that IoT environments can be enhanced more efficiently, transparently and safely by integrating blockchain technology with SDN. A summary of SDN is presented and then block-chain technologies are examined with a focus on consensus protocols. After that, it explores the difficulties of implementing blockchain-based SDN into practice, concentrating on security issues. Furthermore, this study explores the mutual effects of IoT and blockchain, emphasizing the complementary relationship between the two developing technologies. This review highlights that block-chain as well as SDNs could work together to strengthen IoT privacy and establish a more robust digital future.

Adaptive Partial Task Offloading and Virtual Resource Placement in SDN/NFV-Based Network Softwarization

Edge intelligence brings the deployment of applied deep learning (DL) models in edge computing systems to alleviate the core backbone network congestions. The setup of programmable software-defined networking (SDN) control and elastic virtual computing resources within network functions virtualization (NFV) are cooperative for enhancing the applicability of intelligent edge softwarization. To offer advancement for multi-dimensional model task offloading in edge networks with SDN/NFV-based control softwarization, this study proposes a DL mechanism to recommend the optimal edge node selection with primary features of congestion windows, link delays, and allocatable bandwidth capacities. Adaptive partial task offloading policy considered the DL-based recommendation to modify efficient virtual resource placement for minimizing the completion time and termination drop ratio. The optimization problem of resource placement is tackled by a deep reinforcement learning (DRL)-based policy following the Markov decision process (MDP). The agent observes the state spaces and applies value-maximized action of available computation resources and adjustable resource allocation steps. The reward formulation primarily considers task-required computing resources and action-applied allocation properties. With defined policies of resource determination, the orchestration procedure is configured within each virtual network function (VNF) descriptor using topology and orchestration specification for cloud applications (TOSCA) by specifying the allocated properties. The simulation for the control rule installation is conducted using Mininet and Ryu SDN controller. Average delay and task delivery/drop ratios are used as the key performance metrics.

Mitigation Services on SDN for Distributed Denial of Service and Denial of Service Attacks Using Machine Learning Techniques

Software-Defined Networking (SDN) offers an innovative model over the separation of the data plane, control plane and management plane. This separation would result in more effective network management, including cost reductions for hardware and manpower, and the ability to deliver on-demand solutions using programmable SDN approaches. As network policy and on-demand services become more impartial, SDN is becoming more popular. However, there are safety risks associated with the SDN network due to malicious floods such as Distributed Denial of Service (DDoS) attacks and Denial of Service (DoS) attacks directed at the SDN Controller, OpenFlow Virtual Switch (OVS), and end nodes, which must be addressed. Because of these assaults, network throughput is reduced, resulting in a lapse in the availability of network services and a reduction in business operations. The main emphasis of this study is on the detection and mitigation of DDoS and DoS assaults in the SDN network, which is accomplished by the use of both unsupervised and supervised learning approaches. The use of the Dynamic Access Control List (DACL) allows for the performance of mitigation operations in the SDN network, which has been implemented using the mininet. The outcome of the experiment demonstrates that malicious (DDoS and DoS) flood is reduced as a consequence of the mitigation technique.

Detecting and Mitigating DDoS Attacks in SDN Using Spatial-Temporal Graph Convolutional Network

With the development of data plane programmable Software-Defined Networking (SDN), Distributed Denial of Service (DDoS) attacks on the data plane increasingly become fatal. Currently, traditional attack detection methods are mainly used to detect whether a DDoS attack occurs and it is difficult to find the path that the attack flow traverses the network, which makes it difficult to accurately mitigate DDoS attacks. In this article, we propose a detection method based on Spatial-Temporal Graph Convolutional Network (ST-GCN) over the data plane programmable SDN, which maps the network into a graph. It senses the state of switches through In-band Network Telemetry (INT) with sampling, inputs the network state into the spatial-temporal graph convolutional network detection model, and finally finds out the switches through which DDoS attack flows pass. Based on this, we propose a defense method combined with an enhanced whitelist and a precise dropping strategy, which can effectively mitigate DDoS attacks and minimize the impact on legitimate network traffic. The evaluation results show that our detection method can accurately detect the path that the DDoS attack flows pass through, and can effectively mitigate the DDoS attack. Compared to classic methods, our method improves the detection accuracy by nearly 10%. At the same time, the southbound interface load and CPU overhead brought by our detection and defense process are much lower than the classic methods.

Software-Defined Networking: Categories, Analysis, and Future Directions.

Software-defined networking (SDN) is an innovative network architecture that splits the control and management planes from the data plane. It helps in simplifying network manageability and programmability, along with several other benefits. Due to the programmability features, SDN is gaining popularity in both academia and industry. However, this emerging paradigm has been facing diverse kinds of challenges during the SDN implementation process and with respect to adoption of existing technologies. This paper evaluates several existing approaches in SDN and compares and analyzes the findings. The paper is organized into seven categories, namely network testing and verification, flow rule installation mechanisms, network security and management issues related to SDN implementation, memory management studies, SDN simulators and emulators, SDN programming languages, and SDN controller platforms. Each category has significance in the implementation of SDN networks. During the implementation process, network testing and verification is very important to avoid packet violations and network inefficiencies. Similarly, consistent flow rule installation, especially in the case of policy change at the controller, needs to be carefully implemented. Effective network security and memory management, at both the network control and data planes, play a vital role in SDN. Furthermore, SDN simulation tools, controller platforms, and programming languages help academia and industry to implement and test their developed network applications. We also compare the existing SDN studies in detail in terms of classification and discuss their benefits and limitations. Finally, future research guidelines are provided, and the paper is concluded.

A Software-Defined Networking Roadside Unit Cloud Resource Management Framework for Vehicle Ad Hoc Networks

Roadside unit (RSU) cloud and its vehicle-to-infrastructure (V2I) connectivity can enable various security, entertainment, and shared mobility applications for vehicles in intelligent transportation systems (ITS) through wireless communications. In this article, the deep programmability of software-defined networking (SDN) is employed to dynamically reconfigure network hosting services and their data forwarding information for effectively meeting the basic shared mobility applications’ needs in vehicle ad hoc networks (VANETs). Multipath is also enabled to forward data flow for balancing network links utilization rate and SDN is thus utilized to achieve the minimum cloud delay with the least number of hosts, which can be summarized as a mixed-integer linear programming (MILP) problem. The joint optimization (JO) algorithm is proposed and in contrast to the two single-objective algorithms which are the delay optimization (DO) algorithm and host optimization (HO) algorithm, respectively. Results show that, for the single-threading instance, the JO and DO algorithms are the same in essence. For the multithreading instance, the JO algorithm generally outperforms the two single-objective optimization algorithms, respectively, under given demands. Furthermore, results also demonstrate that the services should be deployed globally in a distributed manner rather than in the centralized manner for achieving the minimized cloud delay in designing an RSU cloud.

Mitigating DDoS Attacks in SDN-Based IoT Networks Leveraging Secure Control and Data Plane Algorithm

Software-Defined Networking (SDN) and Internet of Things (IoT) are the trends of network evolution. SDN mainly focuses on the upper level control and management of networks, while IoT aims to bring devices together to enable sharing and monitoring of real-time behaviours through network connectivity. On the one hand, IoT enables us to gather status of devices and networks and to control them remotely. On the other hand, the rapidly growing number of devices challenges the management at the access and backbone layer and raises security concerns of network attacks, such as Distributed Denial of Service (DDoS). The combination of SDN and IoT leads to a promising approach that could alleviate the management issue. Indeed, the flexibility and programmability of SDN could help in simplifying the network setup. However, there is a need to make a security enhancement in the SDN-based IoT network for mitigating attacks involving IoT devices. In this article, we discuss and analyse state-of-the-art DDoS attacks under SDN-based IoT scenarios. Furthermore, we verify our SDN sEcure COntrol and Data plane (SECOD) algorithm to resist DDoS attacks on the real SDN-based IoT testbed. Our results demonstrate that DDoS attacks in the SDN-based IoT network are easier to detect than in the traditional network due to IoT traffic predictability. We observed that random traffic (UDP or TCP) is more affected during DDoS attacks. Our results also show that the probability of a controller becoming halt is 10%, while the probability of a switch getting unresponsive is 40%.

Actor-based model checking for Software-Defined Networks

Software-Defined Networking (SDN) is a networking paradigm that has become increasingly popular in the last decade. The unprecedented control over the global behaviour of the network it provides opens a range of new opportunities for formal methods and much work has appeared in the last few years on providing bridges between SDN and verification. This article advances this research line and provides a link between SDN and traditional work on formal methods for verification of concurrent and distributed software—actor-based modelling. We show how SDN programs can be seamlessly modelled using actors, and thus existing advanced model checking techniques developed for actors can be directly applied to verify a range of properties of SDNs, including consistency of flow tables, violation of safety policies, and forwarding loops. Our model checker for SDNs is available through an online web interface, that also provides the SDN actor-models for a number of well-known SDN benchmarks.

Trident: Toward Distributed Reactive SDN Programming With Consistent Updates

Software-Defined Networking (SDN) enables more dynamic and fine-grained network control. In particular, network operators can route traffic not only based on packet header fields, but also higher-level parameters such as user settings, traffic characteristics, and application-layer information extracted by virtualized network functions such as DPI, firewall and authentication servers. Integrating these higher-level parameters into an SDN programming framework brings substantial benefits but is still missing in the SDN community. In this paper, we articulate the challenges and then propose Trident, a novel unified SDN programming framework. Trident extends algorithmic SDN programming with a new abstraction called stream attribute , which integrates meta parameters into the match-action programming paradigm. Further, Trident adopts the idea of reactive value from function reactive programming, eliminating the complexity of manually handling dynamicity. To effectively and efficiently realize these novel ideas, Trident introduces reactive table as the basic processing unit and develops a domain-specific distributed update protocol to maintain consistency during updates. Evaluations show that Trident puts very little overhead on integrating existing network management tools and network functions, and can handle up to $O(10^{5})$ routing requests per second with $O(100)$ milliseconds latency.

Design and Evaluation of Reconfigurable SDN LEO Constellations

In the context of the 5G ecosystem, the integration between the terrestrial and satellite networks is envisioned as a potential approach to further enhance the network capabilities. In light of this integration, the satellite community is revisiting its role in the next generation 5G networks. Emerging technologies such as Software-Defined Networking (SDN) which rely on programmable and reconfigurable concepts, are foreseen to play a major role in this regard. Therefore, an interesting research topic is the introduction of management architecture solutions for future satellite networks driven by means of SDN. This anticipates the separation of the data layer from the control layer of the traditional satellite networks, where the control logic is placed on programmable SDN controllers within traditional satellite devices. While a centralized control layer promises delay reductions, it introduces additional overheads due to reconfiguration and migration costs. In this paper, we propose a method to quantify the overhead imposed on the network by the aforementioned parameters while investigating the use-case scenario of an SDN-enabled satellite space segment. We make use of an optimal controller placement and satellite-to-controller assignment which minimizes the average flow setup time with respect to varying traffic demands. Furthermore, we provide insights on the network performance with respect to the migration and reconfiguration cost for our proposed SDN-enabled architecture. Finally, we compare our proposed space segment SDN-enabled architecture with alternative solutions in the state-of-the-art given the aforementioned performance metrics.

IT and Multi-layer Online Resource Allocation and Offline Planning in Metropolitan Networks

Metropolitan networks are undergoing a major technological breakthrough leveraging the capabilities of software-defined networking (SDN) and network function virtualization (NFV). NFV permits the deployment of virtualized network functions (VNFs) on commodity hardware appliances which can be combined with SDN flexibility and programmability of the network infrastructure. SDN/NFV-enabled networks require decision-making in two time scales: short-term online resource allocation and mid-to-long term offline planning. In this paper, we first tackle the dimensioning of SDN/NFV-enabled metropolitan networks paying special attention to the role that latency plays in the capacity planning. We focus on a specific use-case: the metropolitan network that covers the Murcia - Alicante Spanish regions. Then, we propose a latency-aware multilayer service-chain allocation (LA-ML-SCA) algorithm to explore a range of maximum latency requirements and their impact on the resources for dimensioning the metropolitan network. We observe that design costs increase for low latency requirements as more data center facilities need to be spread to get closer to the network edge, reducing the economies of scale on the IT infrastructure. Subsequently, we review our recent joint computation of multi-site VNF placement and multilayer resource allocation in the deployment of a network service in a metro network. Specifically, a set of subroutines contained in LA-ML-SCA are experimentally validated in a network optimization-as-a-service architecture that assists an Open-Source MANO instance, virtual infrastructure managers and WAN controllers in a metro network test-bed.

A Novel Stealthy Attack to Gather SDN Configuration-Information

Software Defined Networking (SDN) is a recent network architecture based on the separation of forwarding functions from network logic, and provides high flexibility in the management of the network. In this paper, we show how an attacker can exploit SDN programmability to obtain detailed knowledge about the network behaviour. In particular, we introduce a novel attack, named Know Your Enemy (KYE), which allows an attacker to gather vital information about the configuration of the network. Through the KYE attack, an attacker can obtain information ranging from the configuration of security tools, such as attack detection thresholds for network scanning, to general network policies like QoS and network virtualization. Additionally, we show that the KYE attack can be performed in a stealthy fashion, allowing an attacker to learn configuration secrets without being detected. We underline that the vulnerability exploited by the KYE attack is proper of SDN and is not present in legacy networks. Finally, we address the KYE attack by proposing an active defense countermeasure based on network flows obfuscation, which considerably increases the complexity for a successful attack. Our solution offers provable security guarantees that can be tailored to the needs of the specific network under consideration.

Using Machine Learning to Provide Reliable Differentiated Services for IoT in SDN-Like Publish/Subscribe Middleware.

At present, most publish/subscribe middlewares suppose that there are equal Quality of Service (QoS) requirements for all users. However, in many real-world Internet of Things (IoT) service scenarios, different users may have different delay requirements. How to provide reliable differentiated services has become an urgent problem. The rise of Software-Defined Networking (SDN) provides endless possibilities to improve the QoS of publish/subscribe middlewares due to its greater programmability. We can encode event topics and priorities into flow entries of SDN switches directly to meet customized requirements. In this paper, we first propose an SDN-like publish/subscribe middleware architecture and describe how to use this architecture and priority queues supported by OpenFlow switches to realize differentiated services. Then we present a machine learning method using the eXtreme Gradient Boosting (XGBoost) model to solve the difficult issue of getting the queuing delay of switches accurately. Finally, we propose a reliable differentiated services guarantee mechanism according to the queuing delay and the programmability of SDN to improve QoS, namely, a two-layer queue management mechanism. Experimental evaluations show that the delay predicted by the XGBoost method is closer to the real value; our mechanism can save end-to-end delay, reduce packet loss rate, and allocate bandwidth more reasonably.

Novel architectures and security solutions of programmable software-defined networking: a comprehensive survey

Nowadays, cyberspace has become a vital part of social infrastructure. With the rapid development of the scale of networks, applications and services have become enriched, and the bearing function of the underlying network devices (such as switches and routers) has also been extended. To promote the dynamics architecture, high-level security, and high quality of service of the network, control network architecture forward separation is a development trend of the networking technology. Currently, software-defined networking (SDN) is one of the most popular and promising technologies. In SDN, high-level strategies are deployed by the proprietary equipment, which is used to guide the data forwarding of the network equipment. This can reduce many complicated functions of the network equipment and improve the flexibility and operability of the implementation and deployment of new network technologies and protocols. However, this novel networking technology faces novel challenges in term of architecture and security. The aim of this study is to offer a comprehensive review of the state-of-the-art research on novel advances of programmable SDN, and to highlight what has been investigated and what remains to be addressed, particularly, in terms of architecture and security.

SDN Programming for Heterogeneous Switches with Flow Table Pipelining

High-level programming is one of the critical building blocks of the effective use of software-defined networking (SDN). Existing solutions, however, either (1) cannot utilize the state-of-the-art switches with flow table pipelining, a key technique to prevent flow rule set explosion or (2) force programmers to manually organize and manage hardware flow table pipelines, which is time-consuming and error-prone. This paper presents a high-level SDN programming framework to address these issues. The framework can automatically (1) generate rule sets for heterogeneous switches with different flow table pipelining designs and (2) update installed rules when the network state changes. As a result, the framework can not only generate efficient rule sets for switches but also provide programmers a centralized, intuitive, and hence easy-to-use programming API. Experiments show that the framework can generate compact rule sets that are 29–116 times smaller than those generated by other open-source SDN controllers. Besides, the framework is 5 times faster to recover from network link failures in comparison to other controllers.

Flow Caching in Protocol Oblivious Forwarding Switches

Protocol Oblivious Forwarding (POF) supports the arbitrary protocol processing, enhancing the programmability of Software Defined Networking (SDN). In order to improve the forwarding performance, a flow caching method is proposed. To parse the packet in advance, absolute positions of matching fields are obtained by identifying the dependency of matching and actions. To guarantee the acceleration effect of flow caching, flow tables are selected according to their matching types and number of entries. In addition, the single-flow table cache and multi-flow table cache are compared and an adaptive switching strategy is proposed based on the actual situation of network traffic. The POFSwitch is extended to implement the proposed method and it is validated under the real rules and backbone traces. The switch packet forwarding rate is increased by 220% after applying flow caching. Flow caching can provide higher forwarding performance for programmable data planes.

Software defined wireless sensor networks and efficient congestion control

To achieve greater performance in computing networks, a setup of critical computing aspects that ensures efficient network operation needs to be implemented. One of these computing aspects is quality of service (QoS). QoS capable of networking allows efficient control of traffic, especially for network critical data. However, to achieve this in wireless sensor networks (WSNs) is a serious challenge, since these technologies have computing limitations. It is even difficult to manage networking resources with ease in these types of technologies, due to their communication, processing and memory limitations. Even though this is the case with WSNs, they have been largely used in monitoring/detection systems, and by this proving their application importance. In this study, a resource-aware OpenFlow-based active network management QoS scheme that uses software defined networking (SDN) strategies is proposed and implemented to apply QoS requirements for managing traffic congestion in WSNs. This scheme uses SDN programmability strategies to apply network QoS requirements and perform traffic load balancing to ensure congestion control in software defined WSNs. The experimental results show that the developed scheme is able to provide congestion avoidance within the network. It also allows opportunities to implement flexible QoS requirements based on the system's traffic state.

Enhancing network resources utilization and resiliency in multi-domain bandwidth on demand service provisioning using SDN

This paper presents a solution to increase bandwidth utilization and to reduce the time necessary to recover from network failures in multi-domain bandwidth on demand service provisioning. The proposed solution is based on software-defined networking (SDN) in order to implement novel traffic engineering (TE) techniques. In fact, most standards development organizations and researchers agree that the logically centralized control plane and high programmability of SDN can revolutionize TE with novel and powerful strategies. In this context, the dynamic path computation (DynPaC) framework, relies on the OpenFlow SDN protocol to provide resilient layer 2 services with bandwidth guarantees within OpenFlow domains. In order to make DynPaC support multi-domain service provisioning, it has been extended with an additional operational mode and REST API calls, making it fully compliant with the Network Services Interface-Connection Service protocol. In this way, DynPaC can behave as a network resource manager (NRM) in the network services framework. As a result, the presented solution is the first OpenFlow-enabled NRM with resiliency capabilities that implements novel TE strategies that enhance the utilization of network resources. In order to validate the proposal, it has been implemented using the ONOS network operating systems and several tests have been conducted using diverse service demand patterns. The obtained results show that DynPaC is suitable to be used as an NRM and that the number of accepted services increases thanks to the flow reallocation mechanism included in the framework, achieving in this way a better utilization of network resources.

Programmable SDN-Enabled S-BVT Based on Hybrid Electro-Optical MCM

A programmable software-defined networking- enabled (SDN-enabled) sliceable bit rate variable transceiver based on hybrid electro-optical multicarrier modulation as a key enabler for superchannel generation in future 5G metro networks is proposed. Multiple discrete multitone signals can be multiplexed/demultiplexed with optical orthogonal transform processors such as spectral selective switches (SSSs). By implementing optical spectrally efficient transforms at the SSSs, we are able to generate a high-capacity superchannel to support the transmission targets envisioned in 5G networks. Specifically, the optimal transform can be programmed by the control plane through the corresponding SDN agents by suitably configuring the phase and attenuation of the SSS ports. Furthermore, with the adoption of multicarrier modulation formats, increased system/network flexibility is achieved. In this work, two different transceiver configurations have been proposed and assessed. They are based on intensity modulation with direct detection and amplitude modulation with coherent reception. A flexible receiver configuration selection is envisioned according to the target network requirements/condition.

Phishlimiter: A Phishing Detection and Mitigation Approach Using Software-Defined Networking

Phishing is one of the most harmful social engineering techniques to subdue end users where threat actors find a chance to gain access to critical information systems. A common approach in phishing is through the use of e-mail communication with an embedded hyperlink. The detection and mitigation of phishing attacks are a grand challenge due to the complexity of current phishing attacks. Existing techniques are often too time consuming to be used in the real world in terms of detection and mitigation time. Likewise, they employ static detection rules that are not effective in the real world due to the dynamics of phishing attacks. In this paper, we present PhishLimiter, a new detection and mitigation approach, where we first propose a new technique for deep packet inspection (DPI) and then leverage it with software-defined networking (SDN) to identify phishing activities through e-mail and web-based communication. The proposed DPI approach consists of two components: phishing signature classification and real-time DPI. Based on the programmability of SDN, we develop the store and forward mode and the forward and inspect mode to the direct network traffic by using an artificial neural network model to classify phishing attack signatures and design the real-time DPI so that PhishLimiter can flexibly address the dynamics of phishing attacks in the real world. PhishLimiter also provides better network traffic management for containing phishing attacks since it has the global view of a network through SDN. Furthermore, we evaluate PhishLimiter using a real-world testbed environment and data sets consisting of real-world e-mail with embedded links. Our extensive experimental study shows that PhishLimiter provides an effective and efficient solution to deter malicious activities.