Software Defined Networking Research Articles

Online Service Function Chain Planning for Satellite–Ground Integrated Networks to Minimize End-to-End (E2E) Delay

The combination of software-defined networking (SDN) and satellite–ground integrated networks (SGINs) is gaining attention as a key infrastructure for meeting the granular quality-of-service (QoS) demands of next-generation mobile communications. However, due to the unpredictable nature of end-user requests and the limited resource capacity of low Earth orbit (LEO) satellites, improper Virtual Network Function (VNF) deployment can lead to significant increases in end-to-end (E2E) delay. To address this challenge, we propose an online algorithm that jointly deploys VNFs and forms routing paths in an event-driven manner in response to end-user requests. The proposed algorithm selectively deploys only the essential VNFs required for each Service Function Chain (SFC), focusing on minimizing E2E delay—a critical QoS parameter. By defining a minimum-hop region (MHR) based on the geographic coordinates of the routing endpoints, we reduce the search space for candidate base stations, thereby designing paths that minimize propagation delays. VNFs are then deployed along these paths to further reduce E2E delay. Simulations demonstrate that the proposed algorithm closely approximates the global optimum, achieving up to 97% similarity in both E2E delay and CPU power consumption, with an average similarity of approximately 90%.

SDN-controlled multi-user NOMA-OFDM VLC system based on a resource allocation algorithm.

We propose a novel, to our knowledge, resource allocation algorithm (RAA) for a multi-user non-orthogonal multiple access orthogonal frequency division multiplexing (NOMA-OFDM) visible light communication (VLC) system. The proposed algorithm considers both the interference between users and their channel diversity. Bit allocation to users in each iteration is based on the ratio between the already allocated number of bits and the demanded number of bits of users, rather than their channel gains. In this way, the inherent issue of prioritizing strong users in a conventional RAA is avoided. We implement a software-defined-network (SDN)-controlled VLC system with real-time signal generation to validate the proposed RAA. The allocation results in the SDN platform are used to configure a FPGA-based transmitter. Experiments of a two-user NOMA-OFDM system with 115-191 Mbit/s throughput show that the system can dynamically react to the change of data demand and channel responses of users. We further demonstrate that the proposed algorithm outperforms conventional RAAs regardless of the data demand, receiving angles, and distances of users.

Simulation of DOS Attacks Mitigation in Software Defined Network Architecture using Load Balancing Algorithm

Simulation of DOS Attacks Mitigation in Software Defined Network Architecture using Load Balancing Algorithm

SD-Meta: The Software-Defined Network of Human-Centric Metaverse for Multi-Lead or Multi-Media Data in Spread Spectrum Communications

In this paper, the novel adjacent two-end link or network multi-end link concept of software-defined network is presented to support the data transmission of electroencephalogram, audio and video streaming in spread spectrum communications. Instead of solving the problem of software-defined prioritization scheme in networking calculation and communication, the southbound-northbound structure of existing neural or information network is found in control and perceptual interactions. The proposed framework of multi-lead and multi-media structures allow the human-centric Metaverse to execute different operations for local and global planning schemes with the high-speed lead or media data transmission of spread spectrum streaming, depending on the kind of brain-computer interaction, and similar to the system of multi-modal perception in the routing or switching. Firstly, this research designed the filed programmable gate array for conventional routing nodes in the computation of different neural networks. Secondly, this study demonstrates its enhanced applicability with software core for multiple routers in the computing power network of the Internet of brains in different brain-computer smart terminals. Experiment results also show the benefits of proposed model and structure, and exposing the different running indicators in the simulation.

A Systematic Literature Review on Cyber Attack Detection in Software-Define Networking (SDN)

The increasing complexity and sophistication of cyberattacks pose significant challenges to traditional network security tools. Software-defined networking (SDN) has emerged as a promising solution because of its centralized management and adaptability. However, cyber-attack detection in SDN settings remains a vital issue. The current literature lacks comprehensive assessment of SDN cyber-attack detection methods including preparation techniques, benefits and types of attacks analysed in datasets. This gap hinders the understanding of the strengths and weaknesses of various detection approaches. This systematic literature review aims to examine SDN cyberattack detection, identify strengths, weaknesses, and gaps in existing techniques, and suggest future research directions in this critical area. A systematic approach was used to review and analyse various SDN cyberattack detection techniques from 2017--2024. A comprehensive assessment was conducted to address these research gaps and provide a comprehensive understanding of different detection methods. The study classified attacks on SDN planes, analysed detection datasets, discussed feature selection methods, evaluated approaches such as entropy, machine learning (ML), deep learning (DL), and federated learning (FL), and assessed metrics for evaluating defense mechanisms against cyberattacks. The review emphasized the importance of developing SDN-specific datasets and using advanced feature selection algorithms. It also provides valuable insights into the state-of-the-art techniques for detecting cyber-attacks in SDN and outlines a roadmap for future research in this critical area. This study identified research gaps and emphasized the importance of further exploration in specific areas to increase cybersecurity in SDN environments.

A Detailed Inspection of Machine Learning Based Intrusion Detection Systems for Software Defined Networks

The growing use of the Internet of Things (IoT) across a vast number of sectors in our daily life noticeably exposes IoT internet-connected devices, which generate, share, and store sensitive data, to a wide range of cyber threats. Software Defined Networks (SDNs) can play a significant role in enhancing the security of IoT networks against any potential attacks. The goal of the SDN approach to network administration is to enhance network performance and monitoring. This is achieved by allowing more dynamic and programmatically efficient network configuration; hence, simplifying networks through centralized management and control. There are many difficulties for manufacturers to manage the risks associated with evolving technology as the technology itself introduces a variety of vulnerabilities and dangers. Therefore, Intrusion Detection Systems (IDSs) are an essential component for keeping tabs on suspicious behaviors. While IDSs can be implemented with more simplicity due to the centralized view of an SDN, the effectiveness of modern detection methods, which are mainly based on machine learning (ML) or deep learning (DL), is dependent on the quality of the data used in their modeling. Anomaly-based detection systems employed in SDNs have a hard time getting started due to the lack of publicly available data, especially on the data layer. The large majority of existing literature relies on data from conventional networks. This study aims to generate multiple types of Distributed Denial of Service (DDoS) and Denial of Service (DoS) attacks over the data plane (Southbound) portion of an SDN implementation. The cutting-edge virtualization technology is used to simulate a real-world environment of Docker Orchestration as a distributed system. The collected dataset contains examples of both benign and suspicious forms of attacks on the data plane of an SDN infrastructure. We also conduct an experimental evaluation of our collected dataset with well-known machine learning-based techniques and statistical measures to prove their usefulness. Both resources we build in this work (the dataset we create and the baseline models we train on it) can be useful for researchers and practitioners working on improving the security of IoT networks by using SDN technologies.

A proactive defense method against eavesdropping attack in SDN-based storage environment

The integration of Software-Defined Networking (SDN) in storage centers aims to enhance storage performance. However, this integration also introduces new concerns, particularly the potential eavesdropping attacks that pose a substantial risk to data privacy. By issuing flow tables (e.g., via compromised SDN switches), attackers can conveniently collect target traffic and extract confidential information with session reassembly methods. To proactively mitigate such attacks by preventing session reassembly, various moving target defense methods, such as end hopping, have been proposed. However, this study uncovers several deficiencies within existing end hopping methods. To address these deficiencies, we propose a novel linkage-field-based self-synchronizing end hopping method, which obfuscates end information (e.g., IP, Port) and linkage fields (e.g., sequence number and ID number) without third-party assistance. Furthermore, to counter the potential invalidation of end hopping methods resulting from brute-force reassembly of a small number of sessions, we propose a fake segment injection method. Extensive experiments have been conducted both in simulation and real-world environment to evaluate the effectiveness of our proposed methods. The results demonstrate that our proposed methods can effectively defend against eavesdropping attacks with acceptable performance overhead.

A novel Distributed Denial of Service attack defense scheme for Software-Defined Networking using Packet-In message and frequency domain analysis

Software-Defined Networking (SDN) enhances network management by improving adaptability, flexibility, and scalability. However, its centralized controller is vulnerable to Distributed Denial of Service (DDoS) attacks that can disrupt network availability. This study introduces a novel real-time DDoS detection scheme integrated into the SDN controller. The scheme uses a two-step process to analyze Packet-In messages in both time and frequency domains. A time-series is generated by sampling the number of Packet-In messages at specific time intervals, which is compared against a predefined threshold. If exceeded, frequency domain analysis is applied to extract features, which are then used by Machine Learning (ML) algorithms to identify DDoS attacks. The scheme achieves 99.85% accuracy in distinguishing normal traffic from attack traffic, demonstrating its effectiveness in safeguarding SDN environments from DDoS threats.

Detection of Incidents and Anomalies in Software-Defined Network – Based Implementations of Critical Infrastructure Resulting in Adaptive System Changes

Detection of Incidents and Anomalies in Software-Defined Network – Based Implementations of Critical Infrastructure Resulting in Adaptive System Changes

End-to-end latency upper bounds and service chain deployment algorithm based on industrial internet network

The diverse service requests in industrial Internet networks require flexible and efficient service chain deployment to ensure the quality of service (QoS). However, current deployment algorithms for service chains are primarily designed to guarantee only low end-to-end latency; they often overlook the amount of service chains that can be accommodated by the network and could lead to severe network load imbalances, significantly reducing service efficiency and causing serious network congestion issues. To address the above issues, we develop a mathematical model of the network topology and service request chains by integrating Network Function Virtualization (NFV) and Software Defined Networking (SDN). Utilizing network calculus theory, we derive the upper bound of end-to-end delay for service chain routing and analyzed the relationship between the upper bound of service chain routing delay and the resource allocation of Virtual Network Function (VNF) nodes. Based on the aforementioned model, we propose a novel service chain deployment algorithm named the Delay-Aware Load-Balanced Routing Algorithm (DLBRA). DLBRA comprehensively considers network traffic load balancing and end-to-end latency of service chains, rationally allocating VNF node resources to complete the determined service chain routing deployment. Experimental results indicate that, compared to the shortest path and load balancing algorithms, DLBRA not only ensures that the end-to-end delay of the service chain meets its QoS requirements, but also effectively reduces network load imbalance, significantly increasing the number of service chain requests that the network can accommodate. Additionally, DLBRA provides tailored deployment guidance for different types of service chains, such as latency-sensitive and data-intensive service chains, ensuring optimal utilization of network resources. This algorithm enhances the efficiency of service chain deployment in industrial internet scenarios and possesses broad application potential in other network environments where delay optimization and load balancing are critical, such as intelligent transportation, cloud computing, and 5G networks.

Hybrid Optimization With Deep Spiking Equilibrium Neural Network for Software Defined Network Based Congestion Prevention Routing

ABSTRACTIn the Internet of Things (IoT) network, within a period of time it constructs a huge network of millions and billions of things that incorporate with each other, leading to various technical and application problems. Also, on‐time delivery of packets is significant in software‐defined networks. In the current software‐defined network, the bandwidth overhead is not considered when an enormous amount of traffic enters the network; this may lead to network congestion. To overcome this issue, a novel method is proposed to detect network congestion based on hybrid optimization, namely, the Hybrid Gannet with Pelican Optimization (HGPO) algorithm. The node‐level congestions and the link‐level congestions, which means the buffer overflow and the multiple nodes trying to utilize the channel at the same time, must be controlled efficiently. Once the network congestion gets controlled, the shortest route path selection and congestion prevention are performed perfectly with the aid of the proposed Deep Spiking Equilibrium Neural Network (DSENN). A few route discovery frequency vectors, such as the interroute discovery time and route discovery time of each node, are determined to prevent congestion. Finally, it is implemented in the Python platform successfully, and the achieved throughput, delay, packet loss ratio, packet delivery ratio, end‐to‐end delay, and performance measures of the proposed method are 140 Mbit/s, 17 ms, 3.8%, 0.35 s, and 100%, respectively, which outperforms the other compared traditional algorithms.

Self-adjusting resilient control plane for virtual software-defined optical networks

Optical networks must promptly respond to failures and efficiently handle dynamic traffic in order to fulfill their role as a critical infrastructure. Leveraging network softwarization and virtualization, virtual software-defined networks offer sufficient flexibility towards this goal by sharing the physical infrastructure among multiple tenants whose traffic must traverse the network hypervisor. In a resilient optical control plane each switch must be assigned to a primary and backup hypervisor instance through short control paths, which challenge will be addressed in this paper. First, we propose an intelligent greedy hypervisor placement heuristic which maximizes acceptance ratio for current, and preparedness for future requests. Secondly, we introduce a graph neural network model that can be seamlessly integrated with either our integer linear program or heuristic method to yield high-quality placements in significantly less time compared to our prior solutions. This enhancement renders our approach applicable to larger networks, significantly expanding its practical utility. Finally, we propose a self-adjusting hypervisor migration strategy, which continuously adapts the placement to the dynamically changing virtual network requests, thus, ensuring service continuity by avoiding frequent control plane reconfigurations. Through simulations we show that our hypervisor placement and migration strategies provide a balanced control load while they can handle a wide variety of changes.

Tracer: A Tool for Race Detection in Software Defined Network Models

Tracer: A Tool for Race Detection in Software Defined Network Models

Deep learning approaches for protecting IoT devices in smart homes from MitM attacks

The primary objective of this paper is to enhance the security of IoT devices in Software-Defined Networking (SDN) environments against Man-in-the-Middle (MitM) attacks in smart homes using Artificial Intelligence (AI) methods as part of an Intrusion Detection and Prevention System (IDPS) framework. This framework aims to authenticate communication parties, ensure overall system and network security within SDN environments, and foster trust among users and stakeholders. The experimental analysis focuses on machine learning (ML) and deep learning (DL) algorithms, particularly those employed in Intrusion Detection Systems (IDS), such as Naive Bayes (NB), k-Nearest Neighbors (kNN), Random Forest (RF), and Convolutional Neural Networks (CNN). The CNN algorithm demonstrates exceptional performance on the training dataset, achieving 99.96% accuracy with minimal training time. It also shows favorable results in terms of detection speed, requiring only 1 s, and maintains a low False Alarm Rate (FAR) of 0.02%. Subsequently, the proposed framework was deployed in a testbed SDN environment to evaluate its detection capabilities across diverse network topologies, showcasing its efficiency compared to existing approaches.

Safe load balancing in software-defined-networking

High performance, reliability and safety are crucial properties of any Software-Defined-Networking (SDN) system. Although the use of Deep Reinforcement Learning (DRL) algorithms has been widely studied to improve performance, their practical applications are still limited as they fail to ensure safe operations in exploration and decision-making. To fill this gap, we explore the design of a Control Barrier Function (CBF) on top of Deep Reinforcement Learning (DRL) algorithms for load-balancing. We show that our DRL-CBF approach is capable of meeting safety requirements during training and testing while achieving near-optimal performance in testing. We provide results using two simulators: a flow-based simulator, which is used for proof-of-concept and benchmarking, and a packet-based simulator that implements real protocols and scheduling. Thanks to the flow-based simulator, we compared the performance against the optimal policy, solving a Non Linear Programming (NLP) problem with the SCIP solver. Furthermore, we showed that pre-trained models in the flow-based simulator, which is faster, can be transferred to the packet simulator, which is slower but more accurate, with some fine-tuning. Overall, the results suggest that near-optimal Quality-of-Service (QoS) performance in terms of end-to-end delay can be achieved while safety requirements related to link capacity constraints are guaranteed. In the packet-based simulator, we also show that our DRL-CBF algorithms outperform non-RL baseline algorithms. When the models are fine-tuned over a few episodes, we achieved smoother QoS and safety in training, and similar performance in testing compared to the case where models have been trained from scratch.

Enhanced Performance Evaluation of Software-Defined Net-works with MMPP Traffic Modeling

Enhanced Performance Evaluation of Software-Defined Net-works with MMPP Traffic Modeling

DFRDRL: a dynamic fuzzy routing algorithm based on deep reinforcement learning with guaranteed latency and bandwidth for software-defined networks

Traditional routing algorithms have several limitations that become increasingly significant in the context of Software-Defined Networking (SDN). Firstly, these algorithms often have limited support for Quality of Service (QoS) requirements, making them less suitable for handling diverse traffic types efficiently. Moreover, current SDN controllers leverage a default shortest-path routing approach, which does not allow for more dynamic and flexible traffic management based on real-time network policies. To address these issues, this paper introduces a Dynamic Fuzzy Routing algorithm based on Deep Reinforcement Learning (DRL) for SDN that provides guaranteed latency and bandwidth (DFRDRL). DFRDRL provides intelligent and efficient routing that adapts to dynamic traffic by considering path-state criteria and using DRL. Fuzzy logic mainly performs online routing between an ingress-egress pair. To adapt to dynamic traffic changes, DFRDRL can predict the traffic matrix in real time. Meanwhile, DFRDRL reduces the routing reliance on network topology by weighting the network based on critical nodes. Additionally, when the network experiences congestion based on the traffic matrix, a deferral mechanism is applied to prioritize requests with lower resource demands. This mechanism helps ensure efficient resource allocation by temporarily postponing or queuing higher-demand requests, thereby optimizing overall network performance during periods of congestion. The simulation results show that the performance of DFRDRL is better than the equivalent algorithms in terms of latency and throughput. Also, DFRDRL is about 2.5% more efficient than the best existing algorithm in terms of admission rate of routing requests.

Optimizing data transmission in 6G software defined networks using deep reinforcement learning for next generation of virtual environments

Data transmission of Virtual Reality (VR) plays an important role in delivering a powerful VR experience. This increasing demand on both high bandwidth and low latency. 6G emerging technologies like Software Defined Network (SDN) and resource slicing are acting as promising technologies for addressing the transmission requirements of VR users. Efficient resource management becomes dominant to ensure a satisfactory user experience. The integration of Deep Reinforcement Learning (DRL) allows for dynamic network resource balancing, minimizing communication latency and maximizing data transmission rates wirelessly. Employing slicing techniques further aids in managing distributed resources across the network for different services as enhanced Mobile Broadband (eMBB) and Ultra-Reliable and Low Latency Communications (URLLC). The proposed VR-based SDN system model for 6G cellular networks facilitates centralized administration of resources, enhancing communication between VR users. This innovative solution seeks to contribute to the effective and streamlined resource management essential for VR video transmission in 6G cellular networks. The utilization of Deep Reinforcement Learning (DRL) approaches, is presented as an alternative solution, showcasing significant performance and feature distinctions through comparative results. Our results show that implementing strategies based on DRL leads to a considerable improvement in the resource management process as well as in the achievable data rate and a reduction in the necessary latency in dynamic and large scale networks.

Rethinking max-min planning on energy-efficient software-defined networking for 5G networks.

Energy efficiency plays an important role in intelligent networking for 5G networks, which concerns environmental, financial, and performance aspects of intelligent networking for 5G networks. To this end, network designers propose energy-efficient approaches to reduce energy consumption of networks and to raise network performance by switching off the links/nodes with low loads or at idle status. The existing energy-efficient approaches can be formulated as a max-min optimal problem, namely maximizing network/node/port throughput via minimum energy consumption. The max-min planning investigates energy efficiency only from the links/nodes perspective. The max-min planning for energy-efficient networking, if not carefully designed from the network-wide standpoint, can lead to lower energy efficiency for the whole network due to lack of global planning, which in turn results in the degraded performance due to network un-connectivity after closing the nodes/links. In this paper we rethink the max-min planning framework on energy-efficient software-defined networking for intelligent networking of 5G networks, which takes in account combining network connectivity and maximum network flow with minimum energy consumption. Our framework aims at how to deliver dynamic end-to-end traffic demands with the appropriate network topology by building data forwarding plane with maximum network flow and control plane with network connectivity. We discuss the associated challenges and implementation issues. A dynamic max-min planning framework depending on dynamic end-to-end traffic demands is presented to achieve network-wide energy efficiency. Numerical results show the improved energy efficiency performance for the whole network.

Lightweight Flow‐Based Policy Enforcement for SDN‐Based Multi‐Domain Communication

ABSTRACTAlthough software‐defined networking (SDN) is commonly employed for intra‐domain communication, inter‐domain communication still heavily relies on conventional routing methods, specifically BGP‐based routers. The BGP router plays a crucial role in managing control and data planes, but this traditional approach hinders the exploitation of SDN advantages. Previous studies demonstrated the use of BGP for inter‐domain and end‐to‐end communication. This paper advocates for the adoption of a fully SDN‐based data plane packet switching strategy through the introduction of LPEES, a lightweight policy framework tailored for SDN‐based inter‐domain communication. LPEES strategically confines BGP's functionality to the control plane, preserving SDN benefits. Evaluation results confirm the effectiveness of LPEES compared to the BGP routing approach, as measured by throughput and various network quality of service (QoS) metrics. Additionally, LPEES streamlines inter‐domain communication by utilizing a trust‐based routing policy approach that can establish trust between communicating domains. The presented solution's main advantage is that it loosens the burden on the administrator by requiring less human interference to check the inter‐domain communication security and privacy. Our evaluations show LPEES outperform the BGP‐based in terms of throughput as LPEES achieves a 27 Gbps versus 22 Gbps in the traditional approach. Based on our experiments, LPEES also enhances the communication delay by an average of 17% compared to the traditional BGP‐based approach.