SDN Controller Research Articles

Network Security Threats and Defense Mechanisms for 6G Multi‐Virtual Network Scenarios

ABSTRACTThe introduction of 6G networks presents substantial challenges for network security, particularly in multi‐virtual network topologies. The combination of network function virtualization (NFV) and software‐defined networking (SDN) in 6G is designed to increase scalability and flexibility; nevertheless, these advances complicate network security management. The goal is to identify risks to network security and develop defense solutions for 6G multi‐virtual network situations. SDN's virtualized network functions (VNFs) are utilized to provide stateful firewall services that provide scalable and dynamic threat prevention. The SDN controller is critical in developing a set of rules to prevent risky network connectivity and decrease possible risks. 6G multi‐virtual network domains—attacking threats that involve different socket addresses so complex that usually applicable protection measures hardly tackle that scenario, machine learning (ML) algorithms, and Intelligent Osprey Optimized Versatile Random Forest (IOO‐VRF) model—have been proposed for potentially harmful connection detection and predicting cyber threats accessing the network. Multiple open‐access sources can be exploited to gather diverse data for collecting valuable information on studying network traffic and cyber threats. The experimental results indicate that IOO‐VRF achieved prediction accuracy comparable to that of other traditional algorithms. The proposed model is assessed on various types of metrics, including accuracy (98%), precision (97.4%), recall (94%), and F1‐score (93%). The results emphasized the importance of ML in combination with SDN and NFV for security in the case of resilient, expandable, and flexible security measures for future multi‐virtual 6G network communications networks.

Empirical Evaluation of QUIC-Based Software-Defined Service Migration in Multi-access Edge Computing Over 5G Networks

Live Service Migration in Multi-Access Edge Computing (MEC) environments is essential to ensure seamless service continuity for users in dynamic network scenarios. While advances such as QUIC-based connection migration and CRIU-based container migration have improved reliability, they remain dependent on maintaining active connections with the source server, which is impractical in conditions of high mobility, unstable links, or server outages. Additionally, existing solutions lack a centralized mechanism to optimally manage migration paths. This study introduces the Software-Defined Service Migration (SDSM) paradigm, leveraging a centralized SDN controller, the QUIC protocol, and MEC technologies to enhance service migration. Our approach overcomes the limitations of traditional methods by preemptively coordinating container and connection migrations. Empirical evaluations on a 5G-based testbed and emulated environments demonstrate significant reductions in migration times and improved recovery in mobile scenarios. These results establish SDSM as a robust solution for next-generation network applications, ensuring consistent and adaptive service quality.

Comparison of distributed and centralized quantum key management systems for meshed QKD networks

Recent developments in quantum key distribution (QKD) demonstrate the maturity of securing sensitive data against the emerging quantum computing threat. For QKD-secured long-haul and meshed optical transport networks (OTNs), quantum key management systems (QKMSs) are essential to overcome current distance limitations of available QKD devices. In this work, we present and compare two implementations of QKMSs, analyzing their scalability with an emulated QKD network (QKDN) utilizing recorded performance metrics from deployed QKD devices. First, we use a state-of-the-art Internet routing scheme, i.e., open shortest path first (OSPF), demonstrating that key management entities (KMEs) can solve the key routing problem utilizing distributed routing. Second, we apply software-defined networking (SDN) to implement centralized routing with a SDN controller. This paper compares distributed with centralized key routing regarding scalability, throughput, and latency. Both schemes facilitate up to six key relays between any pair of nodes in parallel with average key relay durations per hop below 300 ms given the Nobel-Germany topology and any-to-any demand matrix. With a network-wide joint key routing optimization in the SDN controller, up to 16.7% higher demands can be served compared to distributed key routing. Within the inherent compatibility of our study to network-function virtualization (NFV), we guideline future integration of QKMSs into deployed OTNs.

Efficient and interactive fault tolerant, distributed SDN controller for a secured communication in a software defined network

Efficient and interactive fault tolerant, distributed SDN controller for a secured communication in a software defined network

Optimizing telemetry forwarding for distributed failure recovery in packet-optical networks

Fast network recoverability from hard and soft failures is crucial for network operators to deliver uninterrupted services. Streaming telemetry has been studied as a solution for enabling fast and accurate failure detection in optical networks. However, significant delay is incurred when relying on a centralized entity (e.g., software-defined network controller) to collect, process, and act on telemetry data. Programmable switches (e.g., P4-based) allow telemetry data to be processed at line speed, enabling local on-device (distributed) decisions. These devices can be used to deploy quick and local mitigation to failures while a global solution is being computed on a longer time scale. However, designing network-wide streaming telemetry with distributed decisions remains an open challenge. In this work, we specify the joint optimization of packet-optical networks with on-device failure recovery, considering multiple aspects of the problem. The problem is modeled using linear programming and solved for multiple network realizations. The solutions can be used to program each switch in the network to detect failures and quickly recover the traffic. Results show that the proposed model decreases the required number of register entries to store telemetry data while assuring high recoverability and a minimized number of wavelengths.

Ethernet Passive Mutual Authentication Scheme on Quantum Networks

In the context of increasing demand for secure and efficient communication networks, addressing the issue of mutual authentication in ethernet passive optical networks (EPONs) has become both valuable and practically significant. This paper proposes a solution based on ideal lattices. The proposed scheme leverages the security of the ring learning with errors (RLWE) problem to establish a robust public-key cryptosystem. By involving ONUs, OLTs, and an SDN controller in the authentication process, it enables mutual authentication through a series of message exchanges facilitated by the SDN controller. Utilizing approximate smooth projection hash functions for secure key exchange and verification, the scheme ensures robust security performance against various attacks, including man-in-the-middle, impersonation, replay, and known key secrecy attacks. Simulation results demonstrate that the proposed solution introduces minimal delay and maintains a high registration success rate compared to traditional authentication methods. Additionally, this paper explores the convergence of quantum network protocols with EPONs, highlighting their potential to achieve unprecedented levels of communication security. Integrating quantum technology with EPON networks, due to the unique security properties of quantum, can also better prevent man-in-the-middle attacks. Secure interception detection techniques based on fundamental quantum properties provide a fundamental security direction for future communication systems, aligning with the growing interest in quantum-resistant cryptographic protocols.

Distributed Denial of Services (DDoS) attack detection in SDN using Optimizer-equipped CNN-MLP.

Software-Defined Networks (SDN) provides more control and network operation over a network infrastructure as an emerging and revolutionary paradigm in networking. Operating the many network applications and preserving the network services and functions, the SDN controller is regarded as the operating system of the SDN-based network architecture. The SDN has several security problems because of its intricate design, even with all its amazing features. Denial-of-service (DoS) attacks continuously impact users and Internet service providers (ISPs). Because of its centralized design, distributed denial of service (DDoS) attacks on SDN are frequent and may have a widespread effect on the network, particularly at the control layer. We propose to implement both MLP (Multilayer Perceptron) and CNN (Convolutional Neural Networks) based on conventional methods to detect the Denial of Services (DDoS) attack. These models have got a complex optimizer installed on them to decrease the false positive or DDoS case detection efficiency. We use the SHAP feature selection technique to improve the detection procedure. By assisting in the identification of which features are most essential to spot the incidents, the approach aids in the process of enhancing precision and flammability. Fine-tuning the hyperparameters with the help of Bayesian optimization to obtain the best model performance is another important thing that we do in our model. Two datasets, InSDN and CICDDoS-2019, are utilized to assess the effectiveness of the proposed method, 99.95% for the true positive (TP) of the CICDDoS-2019 dataset and 99.98% for the InSDN dataset, the results show that the model is highly accurate.

Secured DDoS Attack Detection in SDN Using TS‐RBDM With MDPP‐Streebog Based User Authentication

ABSTRACTIn a Distributed Denial of Service (DDoS) attack, the attacker aims to render a network resource unavailable to its intended users. A novel Software Defined Networking (SDN)‐centered secured DDoS attack detection system is presented in this paper by utilizing TanhSoftmax‐Restricted Boltzmann Dense Machines (TS‐RBDM) with a Mean Difference of Public key and Private key based Streebog (MDPP‐Streebog) user authentication algorithm. Primarily, in the registration phase, the users have registered their device details. The two‐stage login process is performed after successful registration. Then, in the network layer, the nodes are initialized, and via the Gate/Router, the sensed data is transmitted to the SDN controller to enhance network energy efficiency. Later, by using the CIC DDoS 2019 dataset, the DDoS detection system is trained. This dataset undergoes preprocessing, and features are extracted from it. By employing the Adaptive Synthetic (ADASYN) technique, data balancing is achieved. Lastly, by using the TS‐RBDM technique, the data is trained. The sensed data is categorized as either attacked or non‐attacked data within this trained DDoS detection system. By employing the Entropy Binomial probability‐based Shanon‐Fano‐Elias (EB‐SFE) technique, the non‐attacked data will be encoded and transmitted to the receiving terminal. Lastly, the experiential assessment illustrated that the proposed DDoS detection system attained 98% accuracy with 37 485 ms minimal training time, thus outperforming all state‐of‐the‐art methods.

Overview of SDN control of multiband over SDM optical networks with physical layer impairments [Invited Tutorial

This paper, an extended version of a tutorial presentation given at OFC’24, aims to provide an overview of key aspects in the design and development of a control plane for multiband over spatial division multiplexing optical networks following software defined networking principles. The tutorial will address system design considerations such as the systematic use of data modeling model-driven development; will detail selected, industry-adopted northbound and southbound interfaces for full and partially disaggregated networks; and will introduce advanced considerations such as accounting for physical layer impairments, externalizing path computation and path validation functions or the multilevel control when considering the management of network media channels over dynamically switched spatial channels. We show a prototype of an SDN controller with multigranular nodes combining flexigrid DWDM switching over SDM/core switching, including transport API extensions for the new protocol layer qualifier.

Generalized quantum-assisted digital signature service in an SDN-controlled quantum-integrated optical network

Digital signature (DS) is an essential application of cryptography, used to certify the provenance of a message and its authenticity, guaranteeing the non-repudiation, unforgeability, and transferability of messages. However, the forthcoming advent of quantum computation poses a significant threat to classical signature schemes. A possible solution could be the introduction of novel DS schemes based on the fundamental laws of quantum physics. Recently, several quantum DS (QDS) protocols have been proposed, even relying on the exploitation of off-the-shelf quantum key distribution (QKD) solutions. However, their efficiency and large signature size, uncorrelated to the size of the message to sign, represent the main limitation in their employment in a practical scenario. A trade-off solution could be a quantum-assisted DS (QADS), where the QKD technology is exploited together with classical cryptographic functions to achieve a stronger DS scheme, more resistant even to quantum attacks. We propose a generalized quantum-assisted digital signature (G-QADS) protocol based on a hybrid system, composed by the standard Wegman-Carter Message Authentication Code (WG-MAC) together with symmetric QKD keys, to enhance the security of the DS, allowing messages with arbitrary lengths to be signed while maintaining a suitable DS length. In this work, the G-QADS process is proposed for a three-party configuration (one signer and two verifiers), where the third participant is involved in the procedure just in the case of contention between the other two parties. The G-QADS protocol is then experimentally tested to prove its resilience to forging and non-repudiation attacks, demonstrating its capability in securing the message signature (with a success probability of the attacks <10−18). The performance is experimentally tested exploiting QKD prototypes based on standard BB84 protocol with decoy states and polarization encoding, in a software-defined network (SDN) infrastructure supervised by a single SDN controller, which provides the management of both classical and quantum communication channels. The proposed solution could push the practical exploitation of QKD into a new application domain, leading to a more pervasive integration of quantum technology in realistic scenarios.

Software-Defined Networking Controller with Enhanced Traffic Management

SDNs decouple control from data layers enabling simplified management and innovation in networking. These project describe the Network Management System(NMS) which can be implemented by the SDN concept, and in this we use Ryu controller as brain of our NMS. The Ryu controller decouples the control plane (decision-making) from the data plane (data forwarding), which allows for better traffic management capabilities. This approach provides performance and scalability due to the way SDN works, because in large networks we run into challenges such as flexibility, reliability, availability as well as changes in terms of security property which these days plays a critical role. The separation of the control and data planes makes it inherent to realize centralized, flexible, programmable control over network behavior entails new possibilities as well as challenges that the traditional SDN model, its architecture and challenges discussed in this study. The project shows the performance benefits of SDN vs traditional network management approaches by exploring what is possible using the capabilities of the Ryu controller and provides insight into network scalability, flexibility and security. Keywords :- Software-defined networking, SDN, network virtualization, OpenFlow

Optimized transmission of multi-path low-latency routing for electricity internet of things based on SDN task distribution.

With the continuous development of 5G network, how to further improve the routing and transmission efficiency of electric power IoT has become a popular research at present. Facing the current problems of high data transmission delay, low efficiency, and large task volume in the electric power IoT, this research combines software-defined networking to design a multi-path low-latency routing and transmission model under the concept of task allocation. First, the grid data communication network model and network slicing technology in 5G power IoT are introduced. On this basis, considering the data transmission in the core network in the power IoT, a multi-path low-latency routing optimization transmission model based on software-defined network task allocation is designed by combining the software-defined network controller and task allocation concept. The results indicated that the average delay of the designed model is only 15.78ms when the transmission task size is 10KB and 23.38ms when the transmission task size is 50KB. In addition, the designed model was able to achieve a throughput of 298bps in the local area network and the lowest jitter and packet loss in the wide area network, which are 0.13ms and 0.001%. It can be concluded that the constructed multi-path low-latency routing and transmission model can not only provide theoretical guidance for the optimization of data transmission in the power IoT, but also lay the foundation for the in-depth application and development of software-defined networking in the power IoT and other fields.

Performance analysis of SDN controllers in various network topologies

Performance analysis of SDN controllers in various network topologies

A Game Model and Fault Recovery Algorithm for SDN Multi-Domain

Software-defined networking (SDN) offers an effective solution for flexible management of Wireless Sensor Networks (WSNs) by separating control logic from sensor nodes. This paper tackles the challenge of timely recovery from SDN controller failures and proposes a game theoretic model for multi-domain controllers. A game-enhanced autonomous fault recovery algorithm for SDN controllers is proposed, which boasts fast fault recovery and low migration costs. Taking into account the remaining capacity of controllers and the transition relationships between devices, the target controller is first selected to establish a controller game domain. The issue of mapping the out-of-control switches within the controller game domain to the target controller is transformed into a linear programming problem for solution. A multi-population particle swarm optimization algorithm with repulsive interaction is employed to iteratively evolve the optimal mapping between controllers and switches. Finally, migration tasks are executed based on the optimal mapping results, and the role transition of the target controller is completed. Comparative experimental results demonstrate that, compared to existing SDN controller fault recovery algorithms, the proposed algorithm can balance the migration cost of switches and the load pressure on controllers while reducing propagation delay in SDN controllers, significantly decreasing the fault recovery time.

Load Balancing Based Intelligent Software Defined Networking (SDN) Controller

The data plane and the control plane are divided by the Software Defined Networking (SDN) paradigm, where an SDN controller governs the operation of the switches it controls while also receiving demand from associated switches. Switches are dynamically controlled by their respective reassigned to be able to distribute the volume of work among controls for SDN. The majority of creative solutions for assignments require a crucial component of collect data regarding switches that need to be reassigned in order to execute load balancing. An individual super controller is utilized data from all switches and gathers information for all controllers, there is a scalability issue that arises as the number of controller’s increases. When assigning switches to controllers in a big network, distances between them can occasionally be a problem. To solve the above problem, this study proposed an intelligent clustering network based on k-means clustering. Under the OpenFlow protocol, Forwarding Table Management Standard Flow Table, and Flow Management, the advantages demonstrate the intelligent network of control concentration. Therefore, the goals were to balance the load by adjusting the cluster node load method and comparing the performance with the traditional controller cluster and single controller. The experimental results reveal that the k-means clustering method proposed in this study can effectively reduce the packet loss rate or delay. And theoretical research shows that our approach delivers a close to ideal result. According to simulation results, our dynamic grouping enhances stable clustering by scaling factor of five, which is significant.

SDN-Based Integrated Satellite Terrestrial Cyber–Physical Networks with 5G Resilience Infrastructure: Future Trends and Challenges

This paper reviews the state-of-the art technologies and techniques for integrating satellite and terrestrial networks within a 5G and Beyond Networks (5GBYNs). It highlights key limitations in existing architectures, particularly in addressing interoperability, resilience, and Quality of Service (QoS) for real-time applications. In response, this work proposes a novel Software-Defined Networking (SDN)-based framework for reliable satellite–terrestrial integration. The proposed framework leverages intelligent traffic steering and dynamic access network selection to optimise real-time communications. By addressing gaps in the literature with a distributed SDN control approach spanning terrestrial and space domains, the framework enhances resilience against disruptions, such as natural disasters, while maintaining low latency and jitter. Future research directions are outlined to refine the design and explore its application in 6G systems.

Improved Performance of 5G Based Software Defined Networks

With the growth of processed data for wireless networks and the establishment of new applications and services, mobile operators keep searching for solutions to deal with the issues raised by nextgeneration networks (NGN). The fifth generation (5G) mobile networks, for example, should enhance their performance without consuming a lot of energy. For these reasons, software-defined networks (SDN) appear to be the promising technology that will make achieving the architectural agility required for the upcoming 5G mobile networks easier. SDN is a clever solution for providing innovation and enforcing the primary drivers in 5G mobile networks, such as flexibility, dependability, service-oriented management, and cost reduction through the control and management of the 5G core network. In this paper, the integration of SDN and multiple controllers with the 5G core network is investigated to determine how these two technologies can affect mobile IP network performance. An energy model suitable for the proposed network architecture has been developed. A widely used Diamond network is being considered for the core network. Open-Flow controllers were used to improve the routing performance by considering load balancing of IP traffic. According to such a model, reduced energy consumption is experienced with SDN. The addition of an SDN controller results in a 11% reduction in consumed energy. The results also show that the use of SDN and multi-controller with NGN can improve the performance further. Using SDN reduced the average delay of the network by 14%. A great reduction in packet error rate (PER) is also achieved when SDN is used.

Comparison of Open Source SDN Controllers and Cloud Platforms in Terms of Performance, Stability, and Infrastructure Flexibility

The IT industry is advancing rapidly, with virtually every branch of modern computing experiencing swift development. Concepts such as Cloud Computing and Artificial Intelligence no longer surprise anyone. Recently, Software Defined Networks (SDN) have been gaining significant popularity. This innovative approach to computer networks allows for greater flexibility and is, therefore, much more well-known in the world of cloud computing than in traditional network implementations. This paper introduces the concept of SDN and Network Functions Virtualization (NFV) and outlines all the challenges and security issues associated with the cloud environment. The dynamic nature of the IT landscape requires constant adaptation to emerging technologies, and SDN represents a noteworthy evolution in the realm of computer networking. Platforms such as SDN and open-source tools enabling the creation of private cloud environments such as OpenStack or OpenNebula were compared. At the same time, aspects like security, network performance, flexibility, and scalability were analyzed. Based on the prior analysis, a comprehensive cloud environment was built using the OpenStack solution and SDN - OpenDaylight was deployed. Additional tests conducted on the OpenStack cloud, both with and without SDN, demonstrated the superiority of SDN implementation in the cloud.

Hybrid Deep Learning Approach for Enhanced Detection and Mitigation of DDOS Attack in SDN Networks

The pervasiveness of (DDoS) Distributed Denial of Service attacks has intensified the demand for effective and dependable detection methods in Software-Defined Networks (SDNs). This proposed study introduces a hybrid Deep Learning framework designed to identify and address DDoS attacks in Software-Defined Networking (SDN) contexts. Due to the centralization of SDN control planes, these networks are especially susceptible to DDoS attacks, which can saturate system resources and disrupt critical services. Utilizing the CICDDoS2019 dataset, this research integrates Recurrent Neural Networks (RNN), Deep Belief Networks (DBN), and Adaptive Feature Dimensionality Learning (AFDL) to improve detection accuracy and efficiency. In order to appropriately differentiate between attack and normal traffic, the proposed hybrid model combines both temporal dependencies and feature correlations achieving an accuracy of 99.80%. This research enhances SDN security by offering a scalable and reliable DDoS detection solution capable of adapting to real-time network requirements, addressing the prospective of DL in protecting network infrastructures.

Intrusion detection in software defined network using deep learning approaches

Ensuring robust network security is crucial in the context of Software-Defined Networking(SDN). Which, becomes a multi-billion dollar industry, and it’s deployed in many data centers nowadays. The new technology provides network programmability, network centralized control, and a global view of the network. But, unfortunately, it comes with new vulnerabilities, and new attack vectors compared to the traditional network. SDN network cybersecurity became a trending research topic due to the hype of Machine Learning (ML) when a group of Machine Learning(ML) techniques called Deep Learning(DL) started to take shape in the setting of SDN networks. This paper focuses on developing advanced Deep Learning(DL) models to address the inherent new attack vectors. In this paper, we have built and compared two models that can be used for building a complete Intrusion Detection System(IDS) solution, one using a hybrid CNN-LSTM architecture and the other using Transformer encoder-only architecture. We specifically target the SDN controller where it represents a crucial point. We utilized the InSDN dataset for training and testing our models, this dataset captures real-world traffic within the SDN environment. For evaluation, we have used accuracy, precision, recall, and F1 Score. Our experiment results show that the Transformer model with 48 features achieves the highest accuracy at 99.02%, while the CNN-LSTM model achieves 99.01%. We have reduced the features to 6 and 4, which gave us varying impacts on the models’ performance. We have merged 4 poorly represented attacks in one class, which enhanced the accuracy by a significant score. Additionally, we investigate binary classification by merging all attack types into a single class, as a result, the accuracy increased for both models. The CNN-LSTM model achieves the best results with an accuracy of 99.19% for 6 feature sets, this enhances the state-of-the-art results.