Search

Integrating Software-Defined Networking (SDN) with the Internet of Things (IoT) simplifies the management of IoT devices; however, it introduces security challenges. Adversaries may manipulate forwarding rules to redirect communication, compromising user security. Additionally, the centralized nature of SDN-enabled IoT networks poses a single point of failure during master controller failure. To address these issues, we present SDBlock-IoT, a distributed SDN architecture based on blockchain technology. This ensures increased resiliency in the event of master controller failure. Our proposed model considers response time and resource utilization of equal controllers, ensuring the most suitable controller assumes the role of master controller. We enhance the integrity of OpenFlow forwarding rules through the Smart Agent and SC, which validate whether a flow is registered on the blockchain or not. The Smart Agent verifies forwarding rules for every new flow request. We conducted experiments on hardware SDN switches using a Ryu OpenFlow controller and a private blockchain, demonstrating the effectiveness of our approach. Evaluation results indicate that SDBlock-IoT outperforms existing solutions in terms of flow verification time, controller recovery time, CPU utilization, and transaction costs. [ABSTRACT FROM AUTHOR]

The significant adoption of the Internet of Things (IoT) has increased the challenges in providing adequate IoT infrastructures meeting essential requirements, such as dynamicity networks and low latency. In this context, the Software-Defined Networking (SDN) paradigm and the OpenFlow protocol provide new possibilities for IoT networks. Based on the global view of network elements enabled by the Controller, SDN allows the programmability and control of the infrastructure according to the actual demands of applications. The OpenFlow protocol defines the exchange of messages between controllers and switches, enabling communication and network control. OpenFlow implements three operation modes: proactive, reactive, and hybrid. Due to the dynamic characteristic of the IoT data stream, the reactive mode is mainly used and indicated for IoT environments. As the OpenFlow controller installs rules dynamically, there is no need to know the network’s sources, destinations, and paths in advance. Although reactive mode introduces dynamicity, it can generate additional delay due to switch-controller communication. This delay increases the response time of the IoT data stream. We propose an SDN-IoT scheduler based on Deep Neural Networks (DNN) to predict the time between data stream changes from IoT devices and install rules in advance, suppressing the existing delay in reactive mode. The proposal automatically uses previous data from the IoT data stream to calculate the time of the following communication from IoT devices. Our results indicate that predicting IoT data stream changes and installing OpenFlow rules in advance reduced about 51% of communications response time. [ABSTRACT FROM AUTHOR]

Abstract The significant adoption of the Internet of Things (IoT) has increased the challenges in providing adequate IoT infrastructures meeting essential requirements, such as dynamicity networks and low latency. In this context, the Software-Defined Networking (SDN) paradigm and the OpenFlow protocol provide new possibilities for IoT networks. Based on the global view of network elements enabled by the Controller, SDN allows the programmability and control of the infrastructure according to the actual demands of applications. The OpenFlow protocol defines the exchange of messages between controllers and switches, enabling communication and network control. OpenFlow implements three operation modes: proactive, reactive, and hybrid. Due to the dynamic characteristic of the IoT data stream, the reactive mode is mainly used and indicated for IoT environments. As the OpenFlow controller installs rules dynamically, there is no need to know the network’s sources, destinations, and paths in advance. Although reactive mode introduces dynamicity, it can generate additional delay due to switch-controller communication. This delay increases the response time of the IoT data stream. We propose an SDN-IoT scheduler based on Deep Neural Networks (DNN) to predict the time between data stream changes from IoT devices and install rules in advance, suppressing the existing delay in reactive mode. The proposal automatically uses previous data from the IoT data stream to calculate the time of the following communication from IoT devices. Our results indicate that predicting IoT data stream changes and installing OpenFlow rules in advance reduced about 51% of communications response time.

Both academics and the IT industry are now researching the Internet of Things and software-defined networks. They have received a number of criticisms in the SD-IoT due to their novelty. One of the 5 G technologies that makes it possible to construct complex, controllable, economical, and adaptive networks is software-defined networking (SDN). In contrast, edge computing (EC) uses data from sensors, network switches, or other devices to automatically do analytical computing rather than waiting for the data to be sent back to a centralised data repository. This article offers a study on feature selection using an ensemble of filter methods to create a lightweight IDS for SD-IoT edge devices that support OpenFlow in order to defend against such attacks. To create the ensemble of filter methods, three filter-based methods, namely Pearson's correlation coefficient (PCC), mutual information (MI), and Fisher's score, have been used. The features selected by this ensemble is sent to the ensemble of classifiers called stack of the classifiers that comprises of support vector machine (SVM) and K-nearest neighbour (KNN) at level '0' and logistic regression (LR) at level '1'. To check the effectiveness of the selected features, stack of the classifiers and individual classifiers are trained and tested with 'All' and 'Selected' features, and then their performances are compared. Two datasets, the BoT-IoT dataset and the TON-IoT dataset, were utilised to complete this work. The performance is compared under some performance measuring metrics, namely recall, accuracy, FAR, F1, precision, CKC, and prediction time. It has been discovered that classifiers perform better when trained with selected features rather than all the features. Also, it is discovered that stack of the classifiers with chosen features outperforms all individual classifiers, hence it is chosen for deployment in OpenFlow enabled edge devices of the SD-IoT data plane where it can identify and counteract threats in real-world settings. This offers the SD-IoT distributed attack detection approach. [ABSTRACT FROM AUTHOR]

Software-defined networking (SDN) is a modern paradigm leveraging software programmability to enhance communication networks, garnering significant attention and undergoing substantial development due to its diverse applications. One key challenge in SDN lies in managing increasing traffic while avoiding flow table overflow, particularly due to the limited capacity of Ternary Content Addressable Memory (TCAM) in OpenFlow switches. This paper presents a Systematic Literature Review (SLR) that analyzes various approaches to defending against flow table overflow in SDN. Employing a structured approach, we sift through a substantial corpus of research, distilling it into 44 noteworthy articles published from 2015 to the present. We provide an overview of strategies to mitigate flow table overflow attacks, including eviction strategies, dynamic timeout mechanisms, flow rerouting, and aggregated flow entries. Additionally, we analyze mitigation approaches based on deployment strategies, testbed environments, and traffic generation methods. In conclusion, we identify research gaps and challenges, laying the groundwork for future investigations in this domain. [ABSTRACT FROM AUTHOR]

With the ongoing digital transformation, the requirement for seamless & agile network connectivity has increased. This has necessitated the transformation from traditional networking to Software-Defined Network. With SDN, the network resources/infrastructure can be made more robust and programmable to accommodate the varying demand. Software-Defined Network (SDN) is now being used by data centers, cloud computing environments, and service providers for efficient handling of network requests. The objective of SDN can be achieved through the performance of the controllers. We have considered POX, Ryu, and ODL controllers to evaluate the performance using the Mininet tool and D-ITG (Distributed Internet Traffic Generator) script. Performance is evaluated using custom topology i.e. Fat tree topology. Several performance metrics (such as Delay, Jitter, Bitrate, Packet rate, Loss-burst size, and Percentage of Packets dropped) are considered and the behaviors of the controllers are monitored during experimentation by flooding the switches with several data packets. It has been observed that the POX controller performs better compared to Ryu and ODL for the Fat tree topology. From the experimental results, it is observed that the average delay of ODL is approximately 50% more than the POX controller and approximately 80% more delay occurred in the Ryu controller in comparison to the POX controller. Similarly average packet dropped percentage of POX is 20% less than Ryu and ODL controllers. Also, it has been observed that the average jitter in POX is almost 50% less in comparison to ODL and 90% less in comparison to the Ryu controller. [ABSTRACT FROM AUTHOR]

Packet classification is a core function of network devices for providing advanced services, with the key challenge being to optimize classification speed while maintaining low memory usage. So far, many have proposed software-based packet classification solutions, with most of them adopting a multi-classifier architectures to accommodate the distribution of rule sets. Unfortunately, the need to perform lookups on each classifier during the packet classification stage significantly increases overhead, severely limiting classification speed. To address this shortfall, an efficient packet classification framework based on decision tree algorithms named MultiSplit is proposed. By leveraging the relationships of coverage and priority within the rule set, a new attribute can be abstracted for each rule, termed equivalent priority. Through this preprocessing, MultiSplit significantly reduces redundant lookup overhead while supporting the multi-classifier framework. Additionally, MultiSplit introduces a novel decision tree algorithm that combines multiple splits and intra-level binary search, significantly improving rule separation efficiency. The experimental results show that MultiSplit reduces memory consumption by 49% and decreases memory access by 63%, on average, compared with state-of-the-art packet classification algorithms. [ABSTRACT FROM AUTHOR]

Adoption of Software-Defined Networks(SDN) as a new networking paradigm, promises solutions for Quality of Service(QoS) management issues raised at the service providers level due to the massive increase in connected devices (e.g., Servers, Mobile devices, M2M, Things, etc.), traffic in between, and the diverse user and service demands (e.g., delay, bandwidth, etc.). Although its advantage in network control flexibility compared to traditional networking, SDN still requires a design of robust and fast QoS guaranteeing routing algorithms due to its central control computation overhead. In this article, we present a new QoS-aware routing algorithm designed to work on top of SDN and serves delay-sensitive services that require certain delay requirements with low computation time. Such problems are usually modeled as Delay Constrained Least Cost (DCLC) problem which is a well-known NP-hard problem. We adopted the Lagrangian relaxation-based approach that incorporates the delay constraint into the objective cost function to solve the DCLC problem. Differently than existing Lagrangian relaxation-based algorithms, we designed our algorithm to reduce the solution search space by exploiting the problem lower-bound cost and delay paths. Moreover, we defined three different constraint tightness factors inferred from the problem current state to avoid extra non-useful Dijkstra calls. To improve the solution quality, we propose a novel approach that use state information obtained from previous optimization iterations to obtain a small-size network subgraph. Then it search the obtained subgraph for a better solution that the Lagrangian relaxation-based approach may miss. We performed an extensive python-based simulation to evaluate the performance of MODLARAC and compared it with two Lagrangian relaxation-based heuristic algorithms proposed in the literature to solve the DCLC problem, LARAC, and BiLAD algorithms. The obtained results showed improvement up to a 15% reduction in internal Dijkstra calls count with about a 2% increase in the total path cost compared to those obtained by the optimal solution. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) has transformed network management by introducing a centralized controller that simplifies network configuration. This separation of the control plane from the forwarding devices, while enhancing flexibility, also exposes vulnerabilities that can be exploited by adversaries to manipulate flow rules on SDN switches. Existing literature mainly focuses on using the switch version to preserve the integrity of flow rules, which does not provide complete security. In this work, we introduce FTISCON (Flow Table Integrity Through Smart Contract), a comprehensive OpenFlow security mechanism to preserve the integrity of the flow rules on SDN switches that leverage blockchain technology. We employ a specialized blockchain agent to verify flow rules through Smart Contracts before deployment. We implement our proof-of-concept using an Ethereum Private Blockchain and conduct a comparative analysis, based on a defined threat model. We evaluate their performance with a range of metrics such as delay, computation time, transaction cost, detection rate, and CPU overhead of the controller. Our proposed model successfully identifies all three types of attacks and achieves significant reductions in execution time compared to BlockFlow, BlockSDSec, and FRChain-specifically, by 52.36%, 48.62%, and 35.67% respectively. Overall, our findings affirm that the proposed model offers a practical and effective solution for safeguarding against malicious manipulation of flow rules in SDN networks. [ABSTRACT FROM AUTHOR]

Software Defined Network (SDN) which is labeled as a new network archetype that decouples the data plane and control plane is capable to solve today's network problems and improve network performance. Yet, among numerous challenges and research openings in software-defined networks, Controller Placement Problem (CPP) is supposed to be the most vital issue which can directly affect the whole network's performance. In this thesis, we deliver a comprehensive review of various metaheuristic CPP-optimized models in SDNs. In this regard, we propose a methodology named Ant Colony Optimization Controller Placement (ACO-CP), to solve the optimal controller location. Ant Colony Optimization is a population-based meta-heuristic algorithm proposed for the optimal location of the controllers, which takes a precise set of the objective function and returns the best potentially location out of the possible set of locations. The objective function is defined by considering, the average and maximum controller-to-controller, switch-to-controller latency, and load balance. By comparing the network performance our proposed algorithm, provides better performance compared with Pareto Simulated Annealing and k-medoid method, Specially on its overall global latency and controller-to-controller latency. [ABSTRACT FROM AUTHOR]

The proliferation of software-defined networks (SDN) increases the necessity of security and forensic research in this field. Network forensics is of particular importance considering the ever-increasing traffic density and variety of devices, and SDN has great potential for improved forensic processes thanks to its ability to provide a centralized view and control of the network. This article's motivation is the lack of a standard forensic process in SDN. The main objective of this study is to examine the differences in the forensic processes of different SDN controllers, whether the southbound interface data is sufficient for the forensic processes, and whether it is possible to choose the best controller in terms of forensics. Four of the most widely used controllers have been selected and tested under seven different scenarios to observe how the results were obtained in terms of forensics. During the tests, in addition to the routine data accesses, attack preparation tools and denial-of-service attack tools were used to expand the scope. Experiments in which each scenario was applied for four different controllers demonstrated that different controllers have different characteristics in network forensics parameters, such as attack type detection, attacker information, service interruptions, packet size, and the number of packets. Experiments proved that southbound interface data is sufficient for forensic processes, different controllers have different characteristics in forensic processes, none of the most used controllers is the best to cover all forensic processes, and a standard forensic method is required for software-defined network forensics. [ABSTRACT FROM AUTHOR]

Unlike traditional networks, Software-defined networks (SDNs) provide an overall view and centralized control of all the devices in the network. SDNs enable the network administrator to implement the network policy by programming applications on top of the SDN controller using generic APIs. One or more controller instances can be deployed to administer the data flow by maintaining unified control of the entire network. The controller is expected to respond quickly to queries from forwarding devices. Presuming quick responses from the controller while enforcing a complex security mechanism is unreasonable. In this paper, the authors propose a unique, adaptive, lightweight, yet efficient technique called ISOLATOR to mitigate the effect of insider attacks and malfunctioning of distributed applications in an SDN-enabled cloud. The proposed security application upon detecting any suspicious activity by a virtual machine, isolates it by removing the interface to its respective shared network and reconnects it through a restricted network operating in a highly selective mode. By subjecting the data traffic to deep packet inspection, the restricted network searches for a match with a known worm pattern. The application is programmed for the OpenDayLight controller and the results show a significant improvement in identifying malicious activities with minimal latency and computational cost. [ABSTRACT FROM AUTHOR]

Efficient monitoring systems that optimize resource allocation, reduce energy usage through machine learning and flow aggregation routing techniques, are needed due to the escalating power consumption of data center networks, which, as has been recently reported, account for up to eight percent of global energy consumption, posing environmental operational concerns. We propose a software-defined data-center monitoring algorithm that reduces power consumption by: 1) using a GPU implementation of a Stacked Long Short-Term Memory Recurrent Neural Network (RNN) model for link utilization prediction, thus reducing monitoring overhead; and 2) utilizing a flow aggregation routing algorithm with feedback from online, OpenFlow-powered monitoring and machine learning modules. This combined approach results in a new algorithm called SMart-Fill Prefer Path First (SM-FPLF). In the context of SM-FPLF, the objective of this paper is to compare the: 1) training and validation loss curves for various models; 2) to evaluate the prediction accuracy of learning approaches for a range of prediction horizons; 3) to assess the time-cost and accuracy for different models, with a specific focus on the GuSLSTM and GuGRU models; 4) to analyze OpenFlow traffic with and without using the preferred prediction algorithm, the GuSLSTM model, assessing the accumulated power consumption per OpenFlow channel in the data-centre when SM-FPLF is applied. Our findings indicate that the GuSLSTM outperforms rival algorithms in terms of link utilization prediction accuracy over varying input sequence lengths. This accuracy is achieved whilst satisfying the SDN domain-specific requirement of a small computation time in a real-time implementation. Embedding a GuSLSTM in the SM-FPLF algorithm offers a power saving of 372 watts per OpenFlow channel, which is achieved in part due to a 13.7% CPU usage reduction in controllers and switches. These findings provide a valuable perspective into the performance and suitability of RNNs for real-time implementation as part of SDN solutions. They also shed light on their practical implications and benefits of using link utilization prediction in SDN management and power consumption optimization solutions.

The Software-Defined Networking technology promises to enhance network performance and cost reduction for service providers by providing scalability, flexibility, and programmability through the separation of the control plane from the data plane. However, the separation between the control plane and data plane in the implementation of SDN presents scalability issues, as the controller has limited computational resources. To address the SDN scalability issues identified, we create a scalable hybrid switching solution using machine learning algorithms. We propose an SDN OpenFlow model switch which collaborates with the traditional switch to represent a scalable framework of Hybrid Routing with Reinforcement Learning (sHRRL). We implement a reinforcement algorithm to randomly explore new routes and discover the most optimal path through the Q-learning algorithm. This primitive and model-free form of reinforcement learning utilizes the Markov Decision Process and Bellman’s equation to reiteratively update Q-values in the Q-table for every transition in the network environment state until Q-function has converged to the best Q-values. The proposed hybrid switching model is benchmarked against the standard SDN OpenFlow switch in terms of network performance metrics, including throughput, packet exchange transmission rates, CPU load, and delay. When statistically comparing simulation results, it is evident that the proposed switching model, incorporating machine learning algorithms, can effectively tackle scalability challenges in the design of SDN controller networks, especially in Data Centre environments where rapid switching speeds are crucial.

Software Defined Networking (SDN) has emerged as a new paradigm for managing heterogeneous networks ranging from enterprises to home network via decoupling the control plane from the data plane. In the traditional networking landscape, these two planes are tightly bound together inside a single appliance. The logically centralized and distributed control plane and programmability offer a great opportunity to improve network security, such as by implementing new mechanisms to detect and mitigate various threats, and also enable security as a service in an SDN paradigm. Due to the ever increasing and fast development of SDN, this paper provides an extensive survey of SDN controllers, SDN-related security threats, and solutions to mitigate the security threats. This study provides a comprehensive survey of 53 SDN controllers from different aspects, including language, architecture, organization, open source, scalability, consistency, reliability, API used, library, and their description. We have also provided a detailed security analysis of SDN architecture with an extensive classification of security threats endangering its different architectural components and the solutions to effectively mitigate them. This paper also identifies challenges and promising future directions on SDN deployment, standardization, implementation, and security issues that should be addressed in this field.

In the contemporary cybersecurity landscape, robust attack detection mechanisms are important for organizations. However, the current state of research in Software-Defined Networking (SDN) suffers from a notable lack of recent SDN-OpenFlow-based datasets. This study seeks to bridge this gap by introducing a novel dataset for intrusion detection in Software-Defined Networking named SDNFlow. The dataset, derived from OpenFlow statistics gathered from real traffic, integrates a comprehensive range of network activities. An empirical evaluation leveraging diverse Machine and deep Learning algorithms was performed. Namely, Logistic regression, decision tree, random forest, K-nearest neighbors, Support Vector Machines, and Multilayer Perceptron were tested getting pretty good results with a precision average of 98% to 99% in binary classification and from 97% to 99% in multiclass classification depending of the attack, we highlight the efficacy of K-Nearest Neighbors (KNN) for traffic classification, particularly in detecting DDoS attacks and port scanning. The dataset is valuable for evaluating intrusion detection systems within SDN environments and deepening the understanding of traffic patterns in Software Defined Networks.

The size of the TCAM memory grows as more entries are added to the flow table of Open Flow switch. The procedure of looking up an IP address involves finding the longest prefix. In order to keep up with the link speed, the IP lookup operation in the forwarding table should also need to be speed up. TCAM's scalability and storage are constrained by its high power consumption and circuit density. The only time- or space-efficient algorithms for improvement are the subject of several research studies. In order to boost performance even further, this study focuses on time and space efficient algorithms. To strike a balance between speedy data access and efficient storage, this study proposes a combination of compression and a quick look-up mechanism to satisfy the space and speed requirements of the Open Flow switch. As the data is compressed, performance improves because less memory is required to store the look-up table and fewer bits are required to search. The look up complexity of proposed approach is $O(log\,(log\;n/2))$ and average space reduction is 61%.

Abstract Software-Defined Networking (SDN) has emerged as an innovative networking method that offers effective management and remarkable flexibility. However, current SDN-based solutions primarily focus on static networks or concentrate on backbone networks, where network dynamics have minimal impact. The existing methods for placing flow entries in Software-Defined Networking (SDN)-based Internet of Things (IoT) systems exhibit shortcomings in accurately predicting outcomes and efficiently reducing table misses and associated performance metrics. This research introduces a new approach, specifically the mobility-aware adaptive flow entry placement scheme for SDN-based Internet of Things (IoT) environments, to address the mobility aspect of networks. The proposed scheme utilizes the Q-learning algorithm to predict the next possible location of end devices, while the cost-sensitive AdaBoost algorithm is employed to select heavy and active flows. As a result, efficient flow rules for incoming flows can be dynamically implemented without controller intervention. Extensive computer simulations demonstrate that this approach significantly enhances match probability and prediction accuracy while concurrently reducing the number of table misses and resource expenditure compared to existing schemes.

Technological advancements in wireless communications and electronics have enabled the rapid evolution of smart things connected to the Internet. Traditional networks face the challenges of scalability, real-time data delivery, programmability and mobility to support these smart objects collectively known as Internet of Things (IoT). To solve these issues, the integration of two emerging network technologies, namely, software defined networking (SDN) and Fog computing have gained a momentum as a novel model that support IoT architecture for manageability and low latency. SDN has a logically centralized network control plane, which is used for implementing sophisticated mechanisms of traffic control and resource management. On the other hand, Fog computing enables IoT devices' data to be processed and managed at the network edge, thus providing support for applications that require very low and predictable latency. Though the communication latency is substantially reduced by the adoption of distributed fog layer closer to IoT ends, the latency overhead in the IoT/fog network is not only because of long distance between IoT devices and the cloud, but it is also caused by flow entry installation delay, which comes from limitations in data and control space designs. Traditional fog networks lack priority based fine-grain control over allocation of flows, and this incurs unnecessary delay for critical packets. The impact of packet blocking on QoS delivery could be reduced if the programmability power of SDN approach is employed in IoT applications for priority oriented flow space management in fog networks. In this paper, we propose a converged SDN and IoT/fog architecture which employs differential flow space allocation for heterogeneous IoT applications per flow classes to satisfy priority based quality of service requirements. Our analytical results demonstrate that urgent flow classes are served more efficiently than Naïve approach without compromising fairness of allocation for normal flow classes. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) offers an innovative model over the separation of the data plane, control plane and management plane. This separation would result in more effective network management, including cost reductions for hardware and manpower, and the ability to deliver on-demand solutions using programmable SDN approaches. As network policy and on-demand services become more impartial, SDN is becoming more popular. However, there are safety risks associated with the SDN network due to malicious floods such as Distributed Denial of Service (DDoS) attacks and Denial of Service (DoS) attacks directed at the SDN Controller, OpenFlow Virtual Switch (OVS), and end nodes, which must be addressed. Because of these assaults, network throughput is reduced, resulting in a lapse in the availability of network services and a reduction in business operations. The main emphasis of this study is on the detection and mitigation of DDoS and DoS assaults in the SDN network, which is accomplished by the use of both unsupervised and supervised learning approaches. The use of the Dynamic Access Control List (DACL) allows for the performance of mitigation operations in the SDN network, which has been implemented using the mininet. The outcome of the experiment demonstrates that malicious (DDoS and DoS) flood is reduced as a consequence of the mitigation technique. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) is a new network technology that uses programming to complement the data plane with a control plane. To enable safe connection, however, numerous security challenges must be addressed. Flooding attacks have been one of the most prominent risks on the internet for decades, and they are now becoming challenging difficulties in SDN networks. To solve these challenges, we proposed a unique firewall application built on multiple levels of packet filtering to provide a flooding attack prevention system and a layer-based packet detection system. This study offers a systematic strategy for wrapping up the examination of SDN operations. The Mininet simulator examines the effectiveness of SDN-based firewalls at various network tiers. The fundamental network characteristics that specify how SDN should operate. The three main analytical measures of the network are jitter, response time, and throughput. During regular operations, their behavior evaluates in the standard SDN conditions of Transmission Control Protocol (TCP) flooding and User Datagram Protocol (UDP) flooding with no SDN occurrences. Low Orbit Ion Cannon (LOIC) is applied to launch attacks on the transmission by the allocated server. Wireshark and MATLAB are used for the behavioral study to determine how sensitive the parameters are used in the SDN network and monitor the fluctuations of those parameters for different simulated scenarios. [ABSTRACT FROM AUTHOR]

The traditional networks have a decentralized routing process, which uses routing rules to direct packets, leading to looping problems during failure. This is primarily due to the close connection between the data/control planes and the absence of overall network topological information. Furthermore, Software-Defined Networking (SDN) is a rising network concept that has garnered significant attention from both academia and the industry. It enables network flexibility by separating the control and data planes, leading to centralized network control. The global network topology information supplied by SDN facilitates network management, allows designers to encounter their specific, end-to-end requirements, and enables invention in networking. To guarantee high reliability and availability in networks, fault tolerance is required to minimize service failure consequences. This paper discusses the different SDN fault tolerance approaches in the literature. Specifically, our study focuses on Link Failure Detection and Recovery in both, Control and Data planes. We involve a systematic classification, comparison, and analysis of the existing SDN fault tolerance approaches: Reactive, Proactive, and Hybrid. Research and practical implications of fault tolerance in SDN are further discussed, along with open challenges and future research directions. [ABSTRACT FROM AUTHOR]

Packet classification based on rules of packet header fields is the key technology for enabling software-defined networking (SDN). Ternary content addressable memory (TCAM) is a widely used hardware for packet classification; however, commercially available TCAM chips have only limited storage. As the number of supported header fields in SDN increases, the number of supported rules in a TCAM chip is reduced. In this work, we present a novel scheme to enable packet classification using TCAM with entries that are narrower than rules by storing the most representative field of a ruleset in TCAM. Due to the fact that not all rules can be distinguished using one field, our scheme employs a TCAM-based multimatch packet classification technique to ensure correctness. We further develop approaches to reduce redundant TCAM accesses for multimatch packet classification. Although our scheme requires additional TCAM accesses, it supports packet classification upon long rules with narrow TCAM entries, and drastically reduces the required TCAM storage. Our experimental results show that our scheme requires a moderate number of additional TCAM accesses and consumes much less storage compared to the basic TCAM-based packet classification. Thus, it can provide the required scalability for long rules required by potential applications of SDN. [ABSTRACT FROM AUTHOR]

In recent years, Internet traffic has increased due to its widespread use. This can be attributed to the growth of social games on smartphones and video distribution services with increasingly high image quality. In these situations, a routing mechanism is required to control congestion, but most existing routing protocols select a single optimal path. This causes the load to be concentrated on certain links, increasing the risk of congestion. In addition to the optimal path, the network has redundant paths leading to the destination node. In this study, we propose a multipath control with multi-commodity flow problem. Comparing the proposed method with OSPF, which is single-path control, and OSPF-ECMP, which is multipath control, we confirmed that the proposed method records higher packet arrival rates. This is expected to reduce congestion.

With increasing attention to the secondary use of data, privacy protection laws such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) have come into force to protect residents from unauthorized exploitation of personal data. Flow management is an effective method to track the distribution of user data in a multi‐domain network environment. Transparency in the relationship between data and service providers is essential to track the status of data provision. Vendor and Consumer Relationship Management (VCRM) manages this relationship by regulating relevant flow information. VCRM is expected to collaborate with the edge‐computing environment in the management of regional unit flow, wherein all access to personal user data should be restricted in accordance with the stakeholders' requests. Accordingly, this study proposes a packet processing function that collaborates with VCRM to manage the access control of flows passing through a regional network. Moreover, this paper proposes methods to reduce packet processing time on the switch, and requests to the switch controller. Using tag‐based matching and cache injection methods, the number of requests to the controller decreased to 33.4% of the original figure. Our proposed method also reduces the total processing time on flow management switches in the network environment in the analysis of encrypted TCP streams such as HTTP over TLS and MQTT over TLS. © 2023 Institute of Electrical Engineer of Japan and Wiley Periodicals LLC. [ABSTRACT FROM AUTHOR]

SoftwareDefined Networks (SDN) introduced better network management by decoupling control and data plane. However, communication reliability is the desired property in computer networks. The frequency of communication link failure degrades network performance, and service disruptions are likely to occur. Emerging network applications, such as delaysensitive applications, suffer packet loss with higher Round Trip Time (RTT). Several failure recovery schemes have been proposed to address link failure recovery issues in SDN. However, these schemes have various weaknesses, which may not always guarantee service availability. Communication paths differ in their roles; some paths are critical because of the higher frequency usage. Other paths frequently share links between primary and backup. Rerouting the affected flows after failure occurrences without investigating the path roles can lead to post-recovery congestion with packet loss and system throughput. Therefore, there is a lack of studies to incorporate path criticality and residual path capacity to reroute the affected flows in case of link failure. This paper proposed Reliable Failure Restoration with Congestion Aware for SDN to select the reliable backup path that decreases packet loss and RTT, increasing network throughput while minimizing post-recovery congestion. The affected flows are redirected through a path with minimal risk of failure, while Bayesian probability is used to predict post-recovery congestion. Both the former and latter path with a minimal score is chosen. The simulation results improved throughput by (45%), reduced packet losses (87%), and lowered RTT (89%) compared to benchmarking works. [ABSTRACT FROM AUTHOR]

The Blockchain technology raises many concerns because all transactions must be verified by every node in the Blockchain network. Because of this the spread of Blockchain technology in all sectors has been very slow. This paper introduces Blockchain nodes and the difference between nodes and then our approach light node control node based on SDN that has a more secure routing mechanism than only light nodes or networks without full nodes and light nodes. In peer to peer networks nodes connect and disconnect all the time and some of these nodes are malicious and will cost the network security and scalability. We applied a technique that uses route packet information by making a table of the IP address with OpenFlow. We calculate our approach flow measurement performance using large scale simulations. The result showed that by using an IP table we can control the nodes connections and make more scalable, secure ones without the need of full nodes working all the time. The proposed model is a distributed architecture based on Blockchain and OpenFlow protocol technology that provides a low-cost, secure, intelligent, and simple approach in all types of computer network infrastructure.

Network monitoring allows network administrators to facilitate network activities and to resolve issues in a timely fashion. Monitoring techniques in software-defined networks are either (i) active, where probing packets are sent periodically, or (ii) passive, where traffic statistics are collected from the network forwarding elements. The centralized nature of software-defined networking implies the implementation of monitoring techniques imposes additional overhead on the network controller. We propose Graph Modeling for OpenFlow Switch Monitoring (GMSM), which is a lightweight monitoring technique. GMSM constructs a flow-graph overview using two types of asynchronous OpenFlow messages: packet-in and flow-removed, which improve monitoring and decision making. It classifies new flows based on the class of service. Experimental findings suggest that using GMSM leads to a decrease in network overhead resulting from the communication between the controller and the switches, with a reduction of 5.7% and 6.7% compared to state-of-the-art approaches. GMSM reduces the controller’s CPU utilization by more than 2% compared to other monitoring methods. Overhead reduction comes with a slight reduction of approximately 0.17 units in the estimation accuracy of links utilization because GMSM allows the user to monitor the network subject to a selected class of service, as opposed to having an exact view of the network utilization.

Software-Defined Networking (SDN) has revolutionized the networking landscape by offering programmable control and optimization of network resources. However, SDN architecture’s inherent flexibility and centralized control expose it to new security risks. In this paper, we have presented a comprehensive study focused on the security implications associated with the control plane of SDN, which serves as a critical layer responsible for its network orchestration. We have addressed some pressing security concerns in SDN deployments by examining control plane vulnerabilities and explicit attacks. Through extensive analysis, we have investigated various control plane attacks. By meticulously exploring each attack vector, we have shed light on its mechanisms, potential impact and countermeasures. Furthermore, we have emphasized the interdependencies between the control plane, application plane, and data plane, highlighting how compromises in the control plane can propagate and impact the entire network infrastructure. Our research contributes to a deeper understanding of the specific vulnerabilities within SDN, focusing on the control plane as the primary target. By providing insights into the security landscape of SDN, network administrators, researchers, and security practitioners can develop proactive defense strategies and fortify the security posture of SDN deployments. We have underscored the importance of integrating robust security mechanisms to safeguard the control plane and maintain the overall security of SDN architectures. Our comprehensive analysis of control plane attacks in SDN elucidates the evolving security challenges posed by the programmability and centralization of network control. By addressing these vulnerabilities, we have tried to pave the way for future researchers to develop effective security solutions and ensure SDN networks’ resilience and integrity.

OpenFlow is a network device management and monitoring protocol, as well as a switch specification, that has enabled research, experimentation and deployment of software-defined networks in general, and data center networks in particular. In this review, after describing the particularities of data center networks and OpenFlow technology, a collection of recent research papers integrating both topics is analyzed. The collection of proposals made by the authors whose research is reviewed is very broad. Most focus on traffic engineering, load balancing, congestion reduction and related topics, with the goal of optimizing data transfer by using all available resources. Other works focus on issues related to the multi-tenancy nature of these large networks, monitoring them, improving their security or modifying switch architecture specifically for data center networks. Overall, we have a panoramic view of the issues related to data center networking and the flexibility OpenFlow provides to help solve them.