Search

In recent years, Internet traffic has increased due to its widespread use. This can be attributed to the growth of social games on smartphones and video distribution services with increasingly high image quality. In these situations, a routing mechanism is required to control congestion, but most existing routing protocols select a single optimal path. This causes the load to be concentrated on certain links, increasing the risk of congestion. In addition to the optimal path, the network has redundant paths leading to the destination node. In this study, we propose a multipath control with multi-commodity flow problem. Comparing the proposed method with OSPF, which is single-path control, and OSPF-ECMP, which is multipath control, we confirmed that the proposed method records higher packet arrival rates. This is expected to reduce congestion.

This paper provides a detailed tutorial to develop a sandbox to emulate coexistence scenarios for road and railway services in terms of sharing telecommunication infrastructure using software-defined network (SDN) capabilities. This paper provides detailed instructions for the creation of network topology using Mininet–WiFi that can mimic real-life coexistence scenarios between railways and roads. The network elements are programmed and controlled by the ONOS SDN controller. The developed SDN application can differentiate the data traffic from railways and roads. Data traffic differentiation is carried out using a VLAN tagging mechanism. Further, it also provides comprehensive information about the different tools that are used to generate the data traffic that can emulate messaging, video streaming, and critical data transmission of railway and road domains. It also provides the steps to use SUMO to represent the selected coexistence scenarios in a graphical way.

Software-Defined Networking (SDN) provides a programmable framework for multi-tenant cloud network management and orchestration. The end-to-end packet processing induced by virtual network functions (VNFs) like stateless firewall, load balancer, intrusion detection, and prevention system (IDPS) in a network involves the processing of network traffic through security policies matching the traffic pattern defined in security rules of individual VNF. The conflicting rules in terms of traffic match and conflicting actions can lead to a) violation of security requirements (authentication and authorization bypass) b) mission requirements - the presence of redundant rules (increased latency, reduced throughput). We present a new object-oriented policy conflict detection and resolution framework (OOPC), which analyzes the rule dependency relationships between the rules of heterogeneous virtual network functions (VNFs) and creates a VNF-Graph. The rules are analyzed using object-oriented dependencies between the address space and actions of VNF rules. OOPC utilizes a compact VNF-Graph, which leads to a reduction in search complexity when analyzing new security policies. Our security policy composition in our framework OOPC achieves 37% lower latency in policy graph composition than previous work. The proposed solution performs 20% faster security policy conflict detection on a cloud network with 60k OpenFlow rules than prior frameworks that serve a similar purpose.

The network function virtualization paradigm replaces dedicated hardware appliances with software running on virtual machines in commodity servers. However, to overcome performance and scalability issues on virtual network functions (VNFs) demanding intensive packet processing, we propose implementing these VNFs as programmable rules distributed among software-defined networking (SDN) switches. Our approach allows infrastructure providers to combine hardware-based and software-based SDN switches, exploring the tradeoff between the packet processing speed and instantiation flexibility. Our proposal includes a scalable mechanism, which decides the type and number of switches to meet network demand, along with a load balancing mechanism to distribute flows among switches, considering their singularities. We first evaluate our proposal in a small testbed with real equipment, confirming its effectiveness. Then, we evaluate our proposal with simulations to further investigate its scalability. Our results show that, even under high traffic loads, the joint operation of both mechanisms improves VNF capacity and saves virtualization resources.

The Software Defined Networking (SDN) paradigm decouples the network control functions from the data plane and offers a set of software components for flexible and controlled management of networks. SDN has promised to provide numerous benefits in terms of on-demand provisioning, automated load balancing, streamlining physical infrastructure, and flexibility in scaling network resources. In order to realize these network service offerings, there is an important need for developing an efficient, robust, and secure execution platform. As a primary contribution, we present a novel virtual execution platform for the OpenFlow controller using Network Function Virtualization (NFV). Theoretically, NFV can apply to any network function, which can simplify the managing of the heterogeneous data plane. The characteristics of our proposed architecture include pipe-lined processing of network traffic, virtualized and replicated execution of network functions, isolation between task nodes, and random mapping of traffic to task nodes. The proposed architecture has two major components: a Network Packet Schedulers (NPS) and a Task Engine (TE). The TE consists of Task Nodes (TNs) which are responsible for executing different network functions on various traffic flows and each TN is realized as a virtual machine. Upon receiving traffic from the data plane, NPS analyses the functional requirements of the traffic and different controller performance parameters. Then it allocates the traffic to appropriate TNs for executing necessary network functions. In this respect, it provides performance benefits, robustness, fine-grained modularity, and strong isolation security in the processing of traffic flows on the SDN platform. Efficacy of our proposed architecture has been demonstrated with a case study.

The availability of Software Defined Network’s (SDNs) flow rule entry in the flow table is considered a key factor in the timely delivery of a certain flow. The controller is approached for instructions on how to deal with the flow when the rule for such flow is missing. The controller then updates the flow table accordingly at the switch so that flow could be dealt with locally. It becomes problematic when no rule is defined yet at the controller by the application plane. In most of these cases, such a situation is handled by programming the controller with wildcard rules. However, handling many flows at once under wildcard rules severely hampers the network performance. Flow rules formation by the application plane is sometimes critical and time-consuming which increases the latency ratio by creating a bottleneck at the switch level. To avoid the bottlenecks due to rule absence, in this paper, rather than waiting for the application plane’s response and putting the pending traffic flows in the buffer, which may be dropped, the controller is programmed in a way that has the built-in mechanism of self-flow rule formation. This atomized mechanism is based on the previously available traces of the same flows when they were forwarded on the network using the wildcard rules. To assess the performance of the proposed work, it is emulated and benchmarked with the latest research. The results show considerable performance achievement.

Distributed denial of service (DDoS) attacks have always been a nightmare for network infrastructure for the last two decades. Existing network infrastructure is lacking in identifying and mitigating the attack due to its inflexible nature. Currently, software-defined networking (SDN) is more popular due to its ability to monitor and dynamically configure network devices based on the global view of the network. In SDN, the control layer is accountable for forming all decisions in the network and data plane for just forwarding the message packets. The unique property of SDN has brought a lot of excitement to network security researchers for preventing DDoS attacks. In this article, for the identification of DDoS attacks in the OpenFlow controller, a probabilistic technique with a central limit theorem has been utilized. This method primarily detects resource depletion attacks, for which the DARPA dataset is used to train the probabilistic model. In different attack scenarios, the probabilistic approach outperforms the entropy-based method in terms of false negative rate (FNR). The emulation results demonstrate the efficacy of the approach, by reducing the FNR by 98% compared to 78% in the existing entropy mechanism, at 50% attack rate.

The Internet of Things (IoT) aims to create a digital world where any information system can expose, discover, understand and consume data and services for analysis, diagnosis, decision support and task automation in various domains such as healthcare, transportation, energy, industry, agriculture, etc. Faced with this diversity of applications and rapid evolution, infrastructures must be able to achieve high levels of security and confidentiality while being open, sustainable, and agile to adapt to the multiple requirements of applications. To meet these needs, new paradigms are emerging. These include the Software Defined Networks (SDN) paradigm, which offers the ability to dynamically program different applications and devices to provide end-to-end service chains. In parallel, the Blockchain paradigm is increasingly used in the Internet of Things, making distributed transactions between connected objects such as financial transactions or "smart contracts" possible. Although the combination of these two paradigms (Blockchain/SDN) is a major issue for the success of the Internet of Things, paving the way for new business models and management/control of communication networks, there is not yet a specified/formalized architecture allowing the use of the "Blockchain" in SDN. In this research, a new architecture for a system combining blockchain and SDN for IoT security is proposed

Cloud Computing provides an auto-scaling feature for dynamic resource utilization to cope with their customers’ requirements and charge as ‘pay-per-use’. Attackers get the benefit of this auto-scaling feature by flooding DDoS attacks on the VMs or instances in the cloud environments. Such DDoS attacks give financial damages to the customers because of massive amount of resource utilization, known as the Economic Denial of Sustainability (EDOS) attack. Transmission Control Protocol (TCP) SYN flooding attack is known to be the most challenging attack resulting EDOS attack. Software Defined Network (SDN) being a cost-efficient solution for cloud service providers, uses the OpenFlow switches and flow tables to make rules for each incoming flow. In SDN, it is feasible to classify an incoming flow as an attack and block forwarding of this flow to the targeted VM. This research work proposes an SDN based fast and computationally cost-efficient statistical anomaly detection model, named EDOS-TCP SYN mitigation model (EDOS-TSM) to mitigate TCP SYN flooding attack from a single user and spoofed IPs. EDOS-TSM uses binomial probability, TTL field value of IP packet header and multi-TCP SYN requests to detect source-based and spoofing based attacks. The proposed model is implemented, and the performance is evaluated on an OpenStack production-based cloud with real-time traffic and attack generation. The attack mitigation results are compared with existing models in the literature. The results show a large number of false negatives in existing models and efficiency of EDOS-TSM is proved in both source based and spoofing attacks.

Low-rate Denial of Service (LDoS) attacks cause severe destructiveness to network security. Consequently, the implementation of detection and defense against them is a concern among the research communities. But it is formidable to deploy extension modules to detect and mitigate attacks online in traditional networks, because devices are deficient of flexibility and scalability. To address the problem, we design and implement an online attack detection and mitigation system (ADMS) framework via the scalable and programmable Software Defined Networking (SDN). ADMS is installed on SDN controllers and conforms to the OpenFlow policy without extra devices. ADMS consists of two modules: the two-phase detection module and the mitigation module. The two-phase detection module combines the new port traffic feature and the Lightgbm classifier based on flow table statistics traffic to precisely detect LDoS attacks. The mitigation module utilizes the novel Sequence Matching based Dynamic Series Analysing (SMDSA) algorithm to locate the attacker, and efficiently mitigates attack traffic by packet filter. The SMDSA algorithm distinguishes the victim port from benign ports by calculating the anomaly score of each port. Our evaluation on a prototype implementation of ADMS shows that the framework is able to precisely identify and efficiently mitigate LDoS attacks in real-time.

Software-Defined Networking (SDN) is becoming a native networking model for next-generation networks. However, with its decoupled architecture, SDN is susceptible to reconnaissance through time inference attacks. Attackers can use probing-based measurements and gather information such as network type and flow table size. In this paper, an automated attacker tool called RAFA is proposed to infer network type (SDN or traditional) and flow rule timeout values (hard and idle). Moreover, a lightweight defense mechanism to randomize rule timeouts with respect to network status is described. A comprehensive simulation setup with different network conditions shows that the proposed methods achieve a superior success rate in diverse settings.

Развитие сетей передачи данных не стоит на месте и сопровождается неизбежной сменой протоколов и технологий, стремящихся повысить качество передачи данных, быстродействие и надежность сетей, а также упростить и автоматизировать их управляемость. Традиционная сетевая архитектура, построенная на автономных устройствах передачи данных, требует огромных ресурсов для передачи экспоненциально растущих объемов информации, а существующие сетевые протоколы имеют ограниченные возможности по управлению трафиком и оптимизации полосы пропускания. Для повышения качества передачи мультимедийной информации требуется внедрение более эффективных методов и принципов маршрутизации. Программно-конфигурируемые сети – это новая парадигма построения и эксплуатации сетей передачи данных, позволяющая обеспечить должную безопасность и гибкость в управлении потоками. Архитектура программно-конфигурируемых сетей отделяет сетевые функция контроля и передачи данных, что позволяет сделать контроль над сетью напрямую программируемым. При таком подходе управляющие функции перенесены на отдельное устройство – контроллер, а сеть программируется посредством реализованных на нем приложений, которые позволяют в реальном времени гибко и быстро вносить изменения в конфигурацию сети в соответствии с динамически изменяющимися потребностями конечного пользователя и администратора сети, тем самым существенно снизив нагрузку на сетевые коммутаторы и маршрутизаторы. В данной статье рассматриваются основные понятия и архитектура программно-конфигурируемых сетей, ключевые отличия, преимущества и недостатки в сравнении с распределенной моделью построения сетей. Затрагивается вопрос сетевой безопасности, а также возможность миграции существующих традиционных систем к программно-конфигурируемым., The development of data transmission networks does not stand still and is accompanied by an inevitable change in protocols and technologies, seeking to improve the quality of data transmission, speed and reliability of networks, as well as to simplify and automate their manageability. The traditional network architecture built on autonomous data transmission devices requires huge resources to transmit exponentially growing amounts of information, and existing network protocols have limited traffic control and bandwidth optimization capabilities. To improve the quality of the transmission of multimedia information requires the introduction of more efficient methods and principles of routing. Software-Defined Networks (SDNs) is a new paradigm for building and operating data transmission networks that allows for proper security and flexibility in flow control. The architecture of the SDN separates the network control and communication functions, making network control directly programmable. With this approach, control functions are transferred to a separate device the controller, and the network is programmed using applications implemented on it, which allow you to flexibly and quickly make changes to the network configuration in real time in accordance with the dynamically changing needs of the end user and network administrator, thereby significantly reducing load on network switches and routers. This article discusses the basic concepts and architecture of software-defined networks, key differences, advantages and disadvantages in comparison with a distributed networking model. The issue of network security is touched upon, as well as the possibility of migrating existing traditional systems to software-defined ones.

In this article, we revisit the problem of how to provide "native" IP multicast support to enterprise distributed applications in today's clouds, without touching either the application implementation or the underlying network hardware. We propose SDM, Software-Defined IP Multicast, to explore the idea of performing Multicast-to-Unicast (M2U) and Unicast-to-Multicast (U2M) translations at the virtualized network edge. At the data plane, with novel architecture designs, SDM achieves efficient M2U and U2M translations by only using Open vSwitch (OVS), an OpenFlow-compatible open-source software switch widely deployed in modern clouds. At the control plane, SDM dynamically adopts multicast trees respecting the join and leave of receivers with flexible cost-based algorithms. SDM is very easy to deploy and use, as its required features are already supported by off-the-shelf OVS software (version ≥ 2.3) and the OpenFlow protocol (version ≥ 1.1). Performance evaluations of its control-plane algorithms also imply that SDM is flexible to construct throughput and latency/height optimized multicast trees respecting task requirements.

The inappropriate distribution of traffic in high workload areas leads to congestion, packet loss, and poor service quality provided by data center networks (DCNs). In this paper, we have proposed a new method for traffic engineering (TE) as a modular approach. Based on this algorithm, depending on the type of traffic, when enough resources are not available for routing, the best path for that flow would be chosen. In the proposed algorithm, the less loaded paths for conduction of current are selected with regard to the present conditions as soon as a current is generated between two hosts, their position is identified in the DCN, and the paths between the two are obtained. We have simulated our algorithm by Mininet emulator. The results demonstrated that the SEMTE method performed an average of 30% better in energy consumption and 70% better in increasing maximum link utilization (MLU) compared to the conventional equal cost multi-path (ECMP) algorithm; however, there was some overhead on the system in terms of time of reading information from OpenFlow switches.

Software Defined Networking (SDN) is a new networking paradigm where forwarding hardware is decoupled from control decisions. It promises to dramatically simplify network management and enable innovation and evolution. In SDN, network intelligence is logically centralized in software-based controllers (the control plane), while network devices (OpenFlow Switches) become simple packet-forwarding devices (the data plane) that can be programmed via an open interface (OpenFlow protocol). Such decoupling of the control plane from the data plane introduces various challenges that include security, reliability, load balancing, and traffic engineering. Dreadful security challenges in SDNs are denial of service (DoS) and distributed denial of service (DDoS) attacks. For instance, in SDNs, DoS/DDoS attacks could flood the control plane, the data plane, or the communication channel. Attacking the control plane could result in failure of the entire network, while attacking the data plane or the communication channel results in packet drop and network unavailability. In this paper we deliver several contributions that shed light on the field of DoS/DDoS attacks in SDNs, providing a complete background about the area, including attacks and analysis of the existing solutions. In particular, our contributions can be summarized as follow: we review and systematize the state-of-the-art solutions that address both DoS and DDoS attacks in SDNs through the lenses of intrinsic and extrinsic approaches. Moreover, the discussed countermeasures are organized accordingly to their focus, be it on detection, mitigation, prevention, or graceful degradation. Further, we survey the different approaches and tools adopted to implement the revised solutions. Finally, we also highlight possible future research directions to address DoS/DDoS attacks in SDNs.

In recent years, the huge expansion of Datacenters (DC) to execute billions of end-user applications in real-time leads to a large amount of energy consumption across the globe. So, the traditional TCP/IP-based networks which are being used for DC inter-connections are facing challenges of managing stringent Quality-of-Service (QoS) requirements of different applications of the end-users and service providers. Moreover, the existing solutions rely on distributed architecture and do not scale for large scale data centers. The issue of high power consumption at DC arises with the increase in the number of nodes and links in the network. Also, it becomes problematic on the DC whenever the underlying network resources (switches and routers) are not efficiently utilized at the time of peak data traffic resulting in high operational cost of energy utilization. However, Software-Defined Networking (SDN) emerges as one of the leading technologies to address the aforementioned issues using the programmable switches and controllers. Inspired from these facts, in this paper, we have formulated the Energy-Aware Routing (EAR) problem of DCs as a Mixed Integer Non-Linear Programming (MINLP) for which an Energy-Efficient Fast Flow Forwarding (EnFlow) scheme is designed. The EnFlow scheme uses the power-saving mode of the network to solve the EAR problem. It has three modules namely– priority scheduling , routing , and re-routing . The first module works according to the First-in-First-Out Push Out Priority (FIFO-POP) scheduling using the multiple OpenFlow switches. The FIFO-POP is designed to save the energy usage of multiple switches by reducing the average waiting time of incoming packets in the queue buffers. The second module is based upon an efficient flow re-routing for a new node and link adaptation to provide the maximum bandwidth to the wired links. The third module is based upon the meta-heuristic Ant Colony Routing (ACR) to execute the stochastic decision policy on the network controller for computation of the shortest path of the forwarding nodes. The proposed EnFlow scheme is simulated using the data traces of 34 cities of NorthAmerica zone with Omnet++ 5.1 using various performance evaluation metrics. The results obtained demonstrated that the proposed EnFlow scheme is 24.55% and 71.15% more energy-efficient in comparison to the RE-FPR and ILP-EAR schemes. Also, it consumes 9.72% and 40.83% lower energy in comparison to the FFHA and EXR schemes respectively.

The scalability issue hinders the deployment of Software-Defined Networking (SDN) in the Wide Area Networks (WANs). Existing solutions have two issues: (1) network performance relies on complicated controller synchronization, which increases the complexity of network control; (2) fine-grained flow processing enables flexible flow control at the cost of high processing load on the controllers and high flow table occupancy on switches. In this paper, we propose a scalable routing solution named HybridFlow, which achieves a good load balancing performance using a single controller with low control overhead (i.e., flow routing and rerouting overhead). HybridFlow mainly employs two techniques: hybrid routing and crucial flow rerouting . Hybrid routing enabled by commercial SDN switches gives us opportunities to reduce the processing load of the controller by routing flows with the hybrid OpenFlow/OSPF mode. Thus, the majority of flows can be routed by OSPF without involving the controller. Crucial flow rerouting realizes load balancing by dynamically identifying crucial flows based on a new metric called Variation Slope and rerouting these flows with the hybrid OpenFlow/OSPF mode. The simulation based on the real traffic traces and network typologies shows that compared with the optimal solution, HybridFlow can achieve 87% of the optimal load balancing performance by rerouting 36% less flows on average.

Software Defined Networking (SDN) has developed tremendously in the recent years. This paper addresses different flow installation mechanisms. The idea of a programmable network which is the foundation of SDN ensures dynamic network management by separating the control plane from data and management planes. In SDN the control plane resides in SDN Controller, which is responsible for the installation of flows on the data plane. Whenever a flow enters into an SDN switch, flow tables are generated for those flows and installed at data plane from the control plane. These flows have their own properties because of their relevant protocols which are attached to them. A flow consists of a matching pattern, actions, and counter. Based on the respective flow, data communication takes place. This paper investigates three kinds of flow installation mechanisms, reactive, proactive and hybrid. Based on these three flow installation mechanisms, we have analysed the performance of SDN by using different performance metrics. We have used the Mininet and POX controller to evaluate the performance analysis in Ubuntu and Windows-based environments. Finally, we have drawn conclusions

We expose the state of the art in the topic of one-way delay measurement in both traditional and software-defined networks. A representative range of standard mechanisms and recent research works, including OpenFlow and Programming Protocol-independent Packet Processors (P4)-based schemes, are covered. We classify them, discuss their advantages and drawbacks, and compare them according to their application environment, accuracy, cost, and robustness. The discussion extends to the reuse of traditional schemes in software-defined networks and the benefits and limitations of the latter with respect to reducing the overhead of network wide measurements. We conclude with a summary of learned lessons and open challenges for future work.

The Internet of Things (IoT) is a key developing innovation aimed at linking objects via the Internet. While, Software Defined Networking (SDN) is another modern network- ing domain intelligence innovation that increases network effi- ciency and enhances security, reliability, and protection through dynamic software programs. In this paper, we proposed a distributed secure SDoT-NFV architecture for smart cities with Network Function Virtualization (NFV) implementation. We integrated highly protected SDN that delivers better network ef- ficiency, protection, and privacy results. It also secures metadata within each layer as well as payload. In addition, this architecture attempted to implement a more efficient method for constructing a cluster via SDN. Moreover, SDN-IoT with the NFV ideas brings benefits in terms of energy conservation and load balancing to the relevant fields. In addition, several distributed controllers have suggested enhancing accessibility, integrity, anonymity, con- fidentiality, and so on. We also implemented an energy-efficient Cluster Head Selection (CHS) algorithm to make use of our proposed architecture. The network offers greater protection of each network layer as opposed to the traditional network in the proposed architecture. Lastly, we analyze the efficiency of the proposed architecture with different network parameters (throughput, RTT, and Time sequence) for smart cities. GUB JOURNAL OF SCIENCE AND ENGINEERING, Vol 7, Dec 2020 P 27-35

2In Software Defined Network based Internet of Things (SDN-IoT), the path selected for forwarding the packets as per rules, should be Quality of Service (QoS) effective. Since SDN based IoT involves dynamic heterogeneous flows, handling caching in terms of rules becomes challenging. Hence in this paper, we propose QoS aware Optimum Path Selection and Rule Caching Policy (QOPS-RCP) for SDN based IoT. In this technique, the optimum path is determined that satisfies the QoS constraints: Rule Caching (RC) cost, packet loss probability and delay. A RC policy is designed that matches the requirements of SDN based IoT architecture such that the cost of RC is minimized. The proposed research methodology is implemented in OpenFlow module and the performance is evaluated in terms of throughput and end-to-end delay.

Проблематика. Принципи побудови і функціонування мереж SDN суттєво відрізняються від традиційних телекомунікаційних мереж. Для визначення чисельних значень показників функціонування такого типу мереж та перевірки їх відповідності вимогам, консорціумом OpenNetworkingFoundation розроблений мережевий емулятор Mininet. Елементи мережевого емулятора є у відкритому доступі. Однак, побудова імітаційної моделі і порядок визначення показників функціонування мережі SDN з використанням Mininet має ряд особливостей,які розглянуті в роботі. Мета дослідження. Створення імітаційної моделі на базі мережевого емулятору Mininet і визначення показників функціонування мереж SDN різної структури. Методика реалізації. Визначення показників функціонування мережі SDN у режимі перевантаження напрямків зв'язку. Результати дослідження. Проведено моделювання мереж SDN складної структури і визначені наступні показники функціонування: RTT (RoundTripTime) для кожного напрямку зв'язку, пропускна здатність гілок і напрямків зв'язку, величина затримки на мережевих елементах, завантаження портів OpenFlowSwitch, елементи мережі з найбільшою затримкою, число обслугованих і втрачених пакетів. Висновки. Використання мережевого емулятора Mininet є досить зручним інструментом для визначення показників функціонування мереж SDN. Однак, є і проблеми. По-перше, налаштування працездатності системи вимагає написання програм для забезпечення взаємодії стандартних елементів з бібліотеками Mininet. По-друге, при виникненні перевантажень в напрямках зв'язку, FloodlightController не забезпечує автоматичного балансування трафіку по обхідним шляхам. Цю задачу доводиться вирішувати в ручному режимі шляхом внесення змін до таблиці маршрутизаціїOpenFlowSwitch. Background. The implementation of the new modern services on existing networks requires replacement or modernization of the old equipment. This negatively affects the efficiency of providing users with new types of services and their cost. Therefore, the issues/tasks of implementing SDN technology in the construction of networks are in the center of attention of representatives of science-research organizations and telecom operators. SDN networks have the advantages of flexible scaling of the system without replacing existing server and network equipment, eliminating operator dependence on specific vendor solutions, and rapid implementation of the new network technologies and services. To determine the numerical values of indicators of the functioning of SDN networks and check their compliance with the requirements, it is proposed to use in working process simulation modelling. For these goals, the Open Networking Foundation consortium developed the Mininet network emulator, the elements of that are published publicly. The formation of the simulation model and the procedure for determining the performance indicators of the SDN network that uses Mininet has a number of features that are considered in the work. Objective. The purpose of the article is to build a simulation model based on the Mininet network emulator and to determine the performance indicators of SDN networks of various structures/topologies. Methods. Creation of a SDN network segment for testing process of its functioning in the overload mode of various communication routes. Results. The Mininet network emulator allows simulating SDN networks of a rather complex structure, change the performance of network branches and the amount of load in communication routes, to create a network-wide overload mode. During the simulation, it is possible to determine a number of indicators of network performance, such as the RTT (Round Trip Time) parameter for each route of communication, the bandwidth of branches and routes of communication, the amount of delay on network elements, loading of OpenFlow Switch ports/interfaces, network elements with the highest delay, the number of served and lost packets. Conclusions. Use of the Mininet network emulator is a fairly convenient tool for determining the performance indicators of SDN networks. However, there are also some problems. First of all, setting up the system's operability requires writing programs to ensure the interaction among standard elements from the Mininet library. Secondone, is when congestion occurs in the communication routes, the Floodlight Controller does not automatically balance traffic along the work-around route. This task has to be solved manually by making changes to the OpenFlow Switch routing tables.

Software defined networks (SDN) creates an environment for designing customized networks based on consumer needs. SDN can effectively apply the decoupling methods on the forwarding plane and the control plane. The SDN controller will forward the traffic information to northbound API and controller obtain the traffic information from openflow virtual switch. SDN routes data and control packets to their destinations based on flow labels, but it lacks protection features to prevent malicious traffic. The SDN environment faces denial of service (DoS) attacks and distribute denial of service attacks, it leads to service unavailability. This paper is mainly focused on dynamically configuring the firewall to identify DoS attacks and decrease malevolent traffic. Virtual networks are simulated using mininet with dynamic access control list rules, and the result show that the suggested solution has improved attack alleviation time bins.

In order to support a variety of Internet of Things (IoT) and smart city applications, it is necessary to provide computing and networking resources at cloud, fog and edge levels. Fortunately, evolution of Network Function Virtualization (NFV) and Software Defined Networking (SDN) technologies are greatly supporting operators to deploy their data centers at reduced expenditures by integrating cloud, fog and edge (Cloud-Fog-Edge) platforms. Although Cloud-Fog-Edge environments provide economic platforms, due to their multi-tenant sharing platforms customer applications could face a variety of security issues in terms of networking and computing resources. For instance, in cloud environments Intrusion Detection Systems (IDS) and authentication mechanisms are useful for enforcing security policies and improving operational security, but internal malicious users can do Address Resolution Protocol (ARP) spoofing attacks by exploiting shared networking environments. Mainly, ARP spoofing attacks could lead to VLAN-ID spoofing, Denial of Service (DoS) and distributed DoS (DDoS), Man in the Middle (MITM) and session hijack attacks in the network. In this work we are proposing a Denial of ARP Spoofing (D-ARPSpoof) approach to prevent ARP spoofing in SDN and NFV enabled Cloud-Fog-Edge platforms. Unlike existing IDS and anomaly detection systems, D-ARPSpoof prevents ARP spoofing attacks by reducing overhead towards the centralized controllers and OpenFlow switches. In this work, D-ARPSpoof performance is compared with recent ARP spoofing mitigation approaches and anomaly detection systems using important metrics like number of successful connections, controller processing messages overhead and number of flow rules installed in OpenFlow switches. In results, we found that in comparison with existing approaches D-ARPSpoof successfully prevents all malicious connections at reduced overhead towards controllers and switches.

Software-defined networking (SDN) has predominantly become the defacto network standard for next generation networking due to its flexibility features; through a single-phase full deployment is unlikely owing to obvious tedious substitution and economic reasons. This has paved the path for hybrid SDN (h-SDN) as a practical alternative with a centralized SDN controller that connects a slow of OpenFlow switches (OFSs) and Legacy switches (LSs). However, such h-SDN imposes fresh challenges since the existing SDN solutions for key functions like topology discovery are rendered futile since LSs do not respond to the controller in the same way OFSs do. State-of-the-art SDN topology protocols, hence, leave out LSs undetected resulting in suboptimal performance. This article presents a novel indirect controller to legacy forwarding (ICLF) scheme that sets out by the controller sending a solitary PACKET_OUT ( P $_{\text{out}}$ ) to an OpenFlow device, which then percolates through the slow of OFSs and LSs; by exploiting the way OFSs and LSs react to the forwarded P $_{\text{out}}$ , the controller can discover the network topology, except for terminal LSs configurations if any. Experiments performed on Mininet shows that the proposed scheme shows an improvement amounted between 34.6%–97.9% in the number of ports detected and reduction in number of messages of about 25%–58.9% under varying degree of legacy device densities, albeit at a slightly overhead of messages forwarded.

OpenFlow discovery protocol (OFDP) is the standard protocol for discovering network topologies for OpenFlow. Each controller generates and receives OFDP messages for each switch to yield a network topology. However, for a network with a large number of switches, the controller may suffer from high overhead to perform OFDP even though the network topology remains unchanged. In this article, we improve the efficiency of network topology discovery by implementing a delegated function in OpenFlow switches. Our mechanism can reduce controller’s overhead for topology discovery to shorten the time of discovering a network topology. It also provides with the interoperability with switches which only perform OFDP. The experimental results demonstrate that the proposed scheme can improve the time for discovering a new network topology by decreasing the number of messages. Our scheme also eliminates unnecessary Packet-Out and Packet-In messages when the network topology remains unchanged. As a result, the controller overhead, including CPU usage and traffic load, is greatly reduced to shorten the response latency of controllers. Hence, the proposed scheme improves the feasibility of achieving scalable OpenFlow networking.

International audience; For audiovisual network operators, end-users satisfaction is a major issue. This is the case for TDF who operates a nationwide network in France whose main purpose is to carry Digital Terrestrial Television streams. Such audiovisual content is forwarded through multicast real-time streams which require continuity of service. Therefore, the main goal of this work is to define a new architecture to prevent impact during network healing time. The proposed architecture aims to use a pair of redundant multicast trees, and ensure their seamless resiliency. This architecture called “Seamless Multicast” takes advantage of the network-end equipment’s ability to receive and combine two identical streams, complete or not. The main contribution of this paper is the development and evaluation of an algorithm for the computation of a pair of multicast trees and the associated hitless deployment scheme. Implementation requires an Software-Defined Networking architecture, in which performance knowledge and bandwidth management are centralized in a controller. A proof of concept controller has been used for validation of the architecture’s global behaviour using a virtualized environment in multiple scenarios.

Network traffic monitoring is vital for enhancing the overall network performance and for optimizing the traffic flows. However, an emerging growth of use in cloud services, internet-of-things, block-chain and data analytics, demand the hardware-based-network-controller to provide more features for expanding network architecture. Therefore, Software Defined Networking (SDN) offers a new solution in terms of scalability, usability and programmable software-based-network-controller for the legacy network infrastructure. In fact, SDN provides a dynamic platform for the network traffic monitoring using international standard. In this study, SDN setup and installation method uses a Mininet emulator containing a controller Ryu with switching hub component, OpenFlow switches, and nodes. The number of nodes is adding until reaches to 16 nodes and evaluated through different network scenarios (single, linear and tree topology). Findings show that the single topology gives a winning criterion compared to other topologies. SDN implementation is measured with performance parameters such as Throughput, Jitter, Bandwidth and Round-Trip Time between scenarios using the Ryu controller. Future research explores on the performance of SDN in larger network and investigates the efficiency and effectiveness of SDN implementation in mesh topology.

Software Defined Networks (SDN) concept reduces the complexity of the traditional network. The decentralization of controlling issues of the traditional networks in SDN increases the popularity of ...

Software-Defined Networking (SDN) continues to be deployed spanning from enterprise data centers to cloud computing with the proliferation of various SDN-enabled hardware switches and dynamic control plane applications. However, state-of-the-art SDN-enabled hardware switches have rather limited downlink message processing capability, especially for Flow-Mod and Statistic Query , which may not suffice the huge need of dynamic control plane applications. In this paper, we systematically study the interactions between the control plane applications and the data plane switches, and present two new attacks, namely Control Plane Reflection Attacks, to exploit the limited processing capability of SDN-enabled hardware switches. The reflection attacks adopt direct and indirect data plane events to force the control plane to issue massive expensive downlink messages towards SDN switches. Moreover, we propose a two-phase probing-triggering attack strategy, which makes the reflection attacks much more efficient and powerful. Experiments on a testbed with 3 different physical OpenFlow switches demonstrate that the attacks can lead to catastrophic results such as hurting the establishment of new flows and even disruption of connection between SDN controller and switches. To mitigate such attacks, we present several countermeasures from different perspectives. In particular, we propose a novel, systematical defense framework, SwitchGuard, to detect anomalies of downlink messages and prioritize these messages based on a novel monitoring granularity, i.e., host-application pair (HAP). Implementations and evaluations demonstrate that SwitchGuard can effectively reduce the latency for legitimate hosts and applications under the control plane reflection attacks with only minor overheads.

International audience; Traditional IP networks lack the flexibility to respond to faults, network reconfiguration, and load changes in an ever-evolving digital society, which we call the Internet. To make matters worse, implementation of network policies requires configuration of each network device in which the control and data planes are coupled together using vendor specific commands. Software defined networking (SDN) is an emerging technology, which decouples the control plane from the data plane to provide flexibility in configuring/reconfiguring a network. In this manuscript, we present a SDN testbed using off-the-shelf components, write and deploy network applications onto the testbed, and demonstrate the functioning of the network application using a free space optical link.

It is widely recognized that connected vehicles have the potential to further improve the road safety, transportation intelligence and enhance the in-vehicle entertainment. By leveraging the 5G enabled Vehicular Ad hoc NETworks (VANET) technology, which is referred to as 5G-VANET, a flexible software-defined communication can be achieved with ultra-high reliability, low latency, and high capacity. Many enabling applications in 5G-VANET rely on sharing mobile data among vehicles, which is still a challenging issue due to the extremely large data volume and the prohibitive cost of transmitting such data using 5G cellular networks. This article focuses on efficient cooperative data sharing in edge computing assisted 5G-VANET. First, to enable efficient cooperation between cellular communication and Dedicated Short-Range Communication (DSRC), we first propose a software-defined cooperative data sharing architecture in 5G-VANET. The cellular link allows the communications between OpenFlow enabled vehicles and the Controller to collect contextual information, while the DSRC serves as the data plane, enabling cooperative data sharing among adjacent vehicles. Second, we propose a graph theory based algorithm to efficiently solve the data sharing problem, which is formulated as a maximum weighted independent set problem on the constructed conflict graph. Specifically, considering the continuous data sharing, we propose a balanced greedy algorithm, which can make the content distribution more balanced. Furthermore, due to the fixed amount of computing resources allocated to this software-defined cooperative data sharing service, we propose an integer linear programming based decomposition algorithm to make full use of the computing resources. Extensive simulations in NS3 and SUMO demonstrate the superiority and scalability of the proposed software-defined architecture and cooperative data sharing algorithms.

In Software Defined-Content Delivery Networks (SD-CDN), the policies of tenants such as Youtube, Netflix, Office 365, etc. are not the same due to having different 5G traffic requirements for such contents as enhanced Mobile Broadband (eMBB), ultra-reliable low-latency (URLLC) and massive machine-type communication (mMTC). This leads SD-CDN multi-tenant slicing to provide different services with limited network resources, where each tenant can functionally manage their own virtual slice of a physical component according to service level agreements (SLAs). However, they are not permitted to dynamically configure their own components. Therefore, the physical end-to-end configuration of all edge devices causes extra hardware and bandwidth costs. Although software as a service (SaaS) is more preferred to handle cost-efficiency on a switch configuration that increases forwarding throughput (Mbps) with a less number of physical components in SD-CDN, the edge devices can be only served as infrastructure as a service (IaaS) currently. This motivation leads us to serve the switch as a service that includes both IaaS and SaaS characteristics. Therefore, we propose an OpenFlow as a service (OFaaS) design where each tenant has flow management and switch configuration permissions on their own virtual slice. In flow management, we define a novel Service Oriented Architecture (SOA) to orchestrate OFaaS driven topology by isolating each tenant from physical complexity. Here, each tenant can dynamically alter QoS on a flow and load balance between a sub-set of contents via OpenFlow protocol. In switch configuration; a novel OFaaS Management Algorithm for a multi-tenant slicing increases the number of tenants served per OpenFlow switch thanks to OFaaS design. It enables an end-to-end configuration via the NETCONF protocol with a novel YANG model of OFaaS. According to performance evaluation; OFaaS has the same forwarding throughput as conventional IaaS based OpenFlow switch for a homogenous content, whereas it has 71% more forwarding throughput (Mbps) and it has 40% more cost-efficient than conventional one for a heterogeneous content with $17 savings per tenant.

Software Defined Networking (SDN) is a promising technology that provides flexibility, programmability, and network automation by shifting the network intelligence to the logically centralized controller. In SDN architecture, the controller maintains the global view of network topology; therefore the network management is efficient as compared to the traditional networks. Moreover, the cost of SDN devices is less due to the use of open source network operating system instead of proprietary and vendor-specific software. In spite of the flexibility offered by the SDN, OpenFlow enabled switches have a fixed behavior as specified in the datasheet of switch ASIC. They recognize fixed set of header fields according to the support of OpenFlow version. In addition, SDN is suffering from scalability and performance issues because SDN switches heavily dependent on the control plane to forward the packets which increases the data-control communication overhead. To resolve these issues, P4-Programmable data plane switches can be used. The analysis of review articles about SDN suggests insufficient focus on the data plane programmability. Therefore, this paper provides the comprehensive overview of domain-specific language (P4) for the programmability of the data plane. We have discussed the problems in the traditional SDN architecture and then, how these problems can be managed by the data plane programmability. Further, this study critically analyze the research articles based on the P4 programming language for network traffic monitoring, DDoS attack detection, load balancing, and packet aggregation and disaggregation. Finally, we have identified the research gaps and highlighted the open research challenges in the field of data plane programmability for the future directions.

Software-Defined Networking (SDN) is a growing network technology that has brought significant benefits to a wide range of disciplines, from science to technology to various fields. This structure can be used in network-based environments, data centers and various research sites. OpenFlow is one of the most widely used protocols for interaction between a controller and a switch in a Software-Defined Networking. Understanding the performance and limitations of the network defined by open source software, including bottlenecks and security vulnerabilities due to the centralized network structure, are important prerequisites for the efficient deployment of these systems. These points of view led researchers to examine various related mathematical models to address these issues. Queueing theory provides the most important and accurate model for evaluating the performance of the SDN networks affected by these restrictions, which has attracted the attention of researchers recently. Regarding to extensive mathematical modeling, this theory has also been used to improve network efficiency. Researchers have used this theory to investigate operational power and improve time consumption and control of data planes due to the nature of classification and storage of packets in SDN buffers. These methods overcome controller performance bottlenecks and increase SDN control capacity, especially for large distributed networks. In this paper, we examine the queueing models for different applications in different layers of SDN, in which researchers use these methods to monitor network loads, evaluate and predict performance changes due to diversity in network traffic. We introduce and review a collection of articles that explore, different applications of Queueing theory in SDN networks. In addition, in order to increase the efficiency of this research, detailed comparisons are performed in terms of structure, mathematical models and the final simulation results.

OpenFlow implements flow-based control over switches with improved network management performance. However, a packet may match more than one flow entry due to the intra-table dependency phenomenon among flow entries. Moreover, different packets may incur different conflicting flow entries under the intra-table dependency. Forwarding packets by the first-match scheme for prioritized flow entries may not always produce the best outcome. Thus, an online conflict detection procedure executed for each incoming packet is needed to flag the conflicts to network administrators. In addition, the SDN controller may frequently update the service provisioning policies that are specified in the flow entries and deliver them to the switches in a large OpenFlow-based environment. This needs a high-performance conflict detection mechanism to support real-time updating. However, performing conflict detection within a large flow table will be very time consuming. This paper first develops a graph-based multilevel redundancy reduction scheme to construct highly compact matching trees that will be used in conflict detection for a large flow table. Then, a conflict detection algorithm with higher performance and lower cost, the Compact Bit Vector algorithm (CBV), is proposed. The performance of the CBV has been validated through an extensive mathematical performance analysis followed by simulations, with good results in terms of requiring less time for the search, lower memory requirement and lower incremental updating time. Obviously, the CBV is very suitable for the conflict detection task of a large and frequently updated flow table.

SDN enables a new networking paradigm probable to improve system efficiency where complex networks are easily managed and controlled. SDN allows network virtualization and advance programmability for customizing the behaviour of networking devices with user defined features even at run time. SDN separates network control and data planes. Intelligently controlled network management and operation, such that routing is eliminated from forwarding elements (switches) while shifting the routing logic in a centralized module named SDN Controller. Mininet is Linux based network emulator which is cost effective for implementing SDN having in built support of OpenFlow switches. This paper presents practical implementation of Mininet with ns-3 using Wi-Fi. Previous results reported in literature were limited upto 512 nodes in Mininet. Tests are conducted in Mininet by varying number of nodes in two distinct scenarios based on scalability and resource capabilities of the host system. We presented a low cost and reliable method allowing scalability with authenticity of results in real time environment. Simulation results show a marked improvement in time required for creating a topology designed for 3 nodes with powerful resources i.e. only 0.077 sec and 4.512 sec with limited resources, however with 2047 nodes required time is 1623.547 sec for powerful resources and 4615.115 sec with less capable resources respectively.

© Copyright 2021, A. O. Nyanteh et al. Software-Defined Networking (SDN) is an innovative technology which provides a programmable network control which is decoupled from the physical infrastructure. Network Virtualization (NV) is the phenomenon where a given physical network infrastructure and its resources are abstracted to create multiple logical virtual network slices of the underlying substrate. NV enables independent virtual networks to co-exist on one or more shared physical network infrastructure. Edge computing makes use of the edge resources in close proximity to end-users to reduce service delay and the network traffic volume in the end-to-end networks. Similarly, network slicing which is a key enabling technology for 5G networks is designed to support different services from different platforms at different scales enables sharing of physical network infrastructure on many different virtual network layers. These innovative technologies and strategies have gained significant attention from both academia and industry as they have the potential to maximize network resource utilization and optimize end–to–end network service delivery in 5G solutions deployment. To enable continuous simulation and development of applicable 5G networking concepts using these technologies, there is a need for an accessible and easy-to-learn testbed which is able to efficiently measure the performance of physical and virtual network capacities, provisioning approaches and management of multiple architectural models using large-scale network slicing configurations in a repeatable and controllable manner. These tools and toolkits provide scalable, lightweight and controlled cloud simulation environments necessary to analyse network traffic flows, allocation capacities and policies and the behaviour of multiple heterogeneous networks at an extremely low cost as compared to the huge financial commitments involved in conducting similar experiments in a real-life event. Existing solutions do not support Network Slicing and end- to -end heterogenous network automation which are key enablers of 5G network implementation. Hence in this paper, the CloudSimHypervisor framework is developed in this based on CloudSimSDN-NFV. The complete architecture and features of the CloudSimHypervisor framework and some used cases are presented in this paper. We validate the CloudSimHypervisor framework with two use case experiments in the cloud computing environment: Joint compute and network resource utilization and network traffic prioritization. Results from these experiments display the efficiency of the CloudSimHypervisor in estimating and measuring processing speed, transmission speed, compute and network usage efficiency and energy consumption.

Scalable Video Coding (SVC) is a promising coding technique that enables flexible video transmission to support heterogeneous devices. However, the current best-effort delivery model characterized by the Internet cannot fully exploit the scalability feature of SVC because the network nodes are transparent for multimedia streaming applications. Software-defined networking (SDN) has emerged as an innovative network paradigm that decouples the control and forwarding planes while routing. This architecture with the OpenFlow protocol enables network operators to obtain per-flow QoS control in a more scalable, flexible, and finely granular manner compared to the conventional network architecture. Inspired by these facts, this paper designs a comprehensive QoS-aware multicast scheme for scalable video streaming over SDN networks. First, we present the designed multimedia streaming multicast system architecture and formulate the QoS-aware multicast routing problem as a non-linear programming model. We then propose a fundamental tree construction algorithm that decomposes the video streaming requests into subrequests and serves them in a bottom-up manner. Furthermore, we design a layer switching strategy based on the video distortion model to mitigate network-induced video quality distortion. Finally, the experimental results are presented to validate the performance of our methods in terms of scalability, network utility, video playout quality, and playback interruption ratio.

Industrial Cyber-Physical Systems (CPSs) require flexible and tolerant communication networks to overcome commonly occurring security problems and denial-of-service such as links failure and networks congestion that might be due to direct or indirect network attacks. In this work, we take advantage of Software-defined networking (SDN) as an important networking paradigm that provide real-time fault resilience since it is capable of global network visibility and programmability. We consider OpenFlow as an SDN protocol that enables interaction between the SDN controller and forwarding plane of network devices. We employ multiple machine learning algorithms to enhance the decision making in the SDN controller. Integrating machine learning with network resilience solutions can effectively address the challenge of predicting and classifying network traffic and thus, providing real-time network resilience and higher security level. The aim is to address network resilience by proposing an intelligent recommender system that recommends paths in real-time based on predicting link failures and network congestions. We use statistical data of the network such as link propagation delay, the number of packets/bytes received and transmitted by each OpenFlow switch on a specific port. Different state-of-art machine learning models has been implemented such as logistic regression, K-nearest neighbors, support vector machine, and decision tree to train these models in normal state, links failure and congestion conditions. The models are evaluated on the Mininet emulation testbed and provide accuracies ranging from around 91–99% on the test data. The machine learning model with the highest accuracy is utilized in the intelligent recommender system of the SDN controller which helps in selecting resilient paths to achieve a better security and quality-of-service in the network. This real-time recommender system helps the controller to take reactive measures to improve network resilience and security by avoiding faulty paths during path discovery and establishment.

The SDN controller uses the OpenFlow Discovery Protocol (OFDP) to collect network topology status. OFDP detects the link between OpenFlow switches by generating Link Layer Discovery Protocol (LLDP) packets. However, OFDP is not a completely secure protocol and can be used by attackers to perform topology discovery injection attacks, topology discovery man-in-the-middle attacks, and topology discovery flood attacks, thereby confusing the network topology. This paper proposes a Correlation-based Topology Anomaly Detection (CTAD) mechanism to run in a software-defined network controller. Spearman’s rank correlation is used to analyze the correlation between network traffic between links and measure the time difference between the round trip time of each LLDP frame to determine whether the topology man-in-the-middle attack exists in the network. This paper also adds a dynamic authentication key and counting mechanism in the LLDP frame to prevent attackers from using the topology discovery injection attack to generate fake links and topology discovery flooding attacks, causing network routing or switching abnormalities.

Software-defined networking (SDN) is an emerging technology of efficiently controlling and managing computer networks, such as in data centres, wide-area networks, as well as in ubiquitous communication. In this study, the authors explore the idea of embedding the SDN components, represented by SDN controller and virtual switch, in end-hosts to improve network performance. In particular, the authors consider load balancing across multiple network interfaces on end-hosts with different link capacity scenarios. The authors have explored and implemented different SDN-based load-balancing approaches based on OpenFlow software switches, and have demonstrated the feasibility and the potential of this approach. The proposed system has been evaluated with MultiPath transmission control protocol (MPTCP). The proposed results demonstrated the potential of applying the SDN concepts on multi-homed devices resulting in an increase in achieved throughput of 55% compared to the legacy single network approach and 10% compared to the MPTCP.

Recent developments in networking include the interest in software‐defined networking, in which OpenFlow switches are in charge of forwarding traffic by matching incoming packets with forwarding rules in their flow tables. Flow tables are commonly implemented in ternary content addressable memories (TCAMs). Typically, this type of memory tends to be extremely expensive and to be power‐hungry devices. The price and power dissipation of TCAM depend on the capacity of the memory. A blind design of memory size can result in dramatic degradation in performance and power efficiency of the entire network. In this study, the authors clarify this impact and show how the optimum value of TCAM capacity is attainable. They also propose a power consumption model for TCAM‐based OpenFlow switches. Simulation results show that the proposed solution reduces the average power consumption by 24% compared to the minimum link on method and by 11.5% compared to the minimum node on (MNO) method and thus power efficiency is better achieved when each memory is supplied by appropriate TCAM size.

Link Flooding Attack (LFA) is a genre of Distributed Denial of Service (DDoS) attack. LFA can cut off a target area from the network, without directly attacking the target. The attacker chooses links which when cut off will disconnect the target area and instruct the bots to flood those links with small packets. Some of the existing solutions are suitable for specific routing methods like shortest path routing or need cooperation between Autonomous Systems (AS). To overcome certain hitches of existing solutions, we have proposed a novel mechanism named BALANCE. It detects and mitigates LFA via hybrid-Software-Defined Network (SDN). SDN splits the control and data plane using OpenFlow protocol. Hybrid SDN has both legacy and SDN nodes, with a controller in the control plane. We have used Service Based Hybrid SDN (SBHS), which is a type of hybrid-SDN. BALANCE begins with an algorithm that chooses nodes in an AS to be SBHS enabled in such a way that the controller can get statistics of all the links in the AS. Next, congestion detection and location algorithms are implemented in the controller to find the congested links. Finally, LFA bot detection and mitigation algorithms are implemented in the controller to mitigate LFA. BALANCE was evaluated in testbed and emulator. We compared the results with state-of-the-art solutions. BALANCE was able to detect LFA bots at a precision of 97.64% and had HTTP response time of 2 seconds during the LFA attack.

Packet classification is a key factor for choosing proper action for incoming packet and has to be done fast and effectively, especially in OpenFlow. But OpenFlow vSwitch technology doesn’t always allow to use some fast hardware technology for packet classification like TCAM (Ternary Content Addressable Memory). Instead of TCAM, decision tree methods are preferred solutions for fast classification in OpenFlow vSwitch in the literature. But most of these methods can cause the rule replication problem. As a result, while the duration of packet classification decreases, rule update duration increases. There are also rule partitioning methods in the literature to solve this problem, but the running time of these methods mostly depends on the number of rule fields. Also, some of these solutions don’t overcome the rule replication problem. At that point, the main question of this letter is that how can we make the rule partitioning fast by both preventing the rule replication and allowing fast packet classification and rule update in OpenFlow vSwitch? To solve the rule partitioning problem, we propose a greedy based interval partitioning strategy. Here, the running time of the partitioning algorithm only depends on the rule number. After partitioning, we propose to use HyperCuts to construct decision trees for fast packet classification and rule update. According to performance evaluation results, we do the rule partitioning and rule updates faster than the PartitonSort method with the percentage of 88, 15, respectively. Also, we classify packet faster than the TupleMerge method with the percentage of 40 for online and 50 for offline scenarios.

To ensure the quality of service of an end-to-end connection, current network solutions are mostly dependable on the differentiation between different classes of traffic. The Software-defined networking (SDN) architecture has emerged to offer network programmability, giving to network operators a programmatic control over their network. In SDN, network devices are programmed in many ways, having a standard, open, and vendor-agnostic interface, e.g., OpenFlow, enabling the control plane to instruct the forwarding behavior of network devices from different vendors. In this paper, we introduce the Programmable Labels (ProgLab) approach to support traffic differentiation with QoS guarantees as a low-cost alternative built over an SDN architecture. The idea relies on the simplification of a packet-forwarding operation which relies on the remainder of a division, instead of classical table lookup method. ProgLab computes programmable label at the control plane by solving a congruence system from Residue Number System and the co-prime numbers assigned to the switches in the path of an end-to-end connection. Such label has a meaning within this network that expresses the entire route, addressing the respective traffic class at each switch’s logical queue along the path. ProgLab approach has been implemented through the P4 language and evaluated through an emulation-based evaluation. The experiments demonstrated the feasibility of ProgLab and showed its ability in providing QoS differentiation on demand.

This paper introduces a sensor security and defense scheme based on Openflow in mobile Internet of Things system. Adopting the flexible network characteristics of the Openflow network structure, at the network level of the mobile internet of things system, the goal of protecting the sensor devices, routers, switches and other devices in the mobile internet of things system is achieved by simultaneously carrying out the double random digital transformation of the network IP address and the data transmission ports of the cross-region Openflow exchange equipment through each sensor device in the mobile internet of things system and each router device in the data transmission process. Compared with the existing security defense technology of mobile IoT system, this technical solution is compatible and relatively easy to deploy, and can protect the whole system data transmission of mobile IOT system. In the initial stage of network system sniffing, such as hacker attack, the maximum extent of active security protection is provided to the mobile Internet of Things system carrying public network data by hiding sensor information.