Search

Achieving network resilience in terms of attack tolerance and service availability is critically important for Internet of Vehicles (IoV) networks where vehicles require assistance in sensitive and safety-critical applications like driving. It is particularly challenging in time-varying conditions of IoV traffic. In this paper, we study an attack-resilient optimal service placement problem to ensure disruption-free service availability to the users in edge-enabled IoV network. Our work aims to improve the user experience while minimizing the delay and simultaneously considering efficient utilization of limited edge resources. First, an optimal service placement is performed while considering traffic dynamicity and meeting the service requirements with the use of a deep reinforcement learning (DRL) framework. Next, an optimal secondary mapping and service recovery placements are performed to account for the attacks/failures at the edge. The use of DRL framework helps to adapt to dynamically varying IoV traffic and service demands. In this work, we develop three ILP models and use them in the DRL-based framework to provide attack-resilient service placement and ensure service availability with efficient network performance. Extensive numerical experiments are performed to demonstrate the effectiveness of the proposed approach., Submitted to IEEE Transactions on Intelligent Transportation Systems

The growth of 5G and edge computing has enabled the emergence of Internet of Vehicles. It supports different types of services with different resource and service requirements. However, limited resources at the edge, high mobility of vehicles, increasing demand, and dynamicity in service request-types have made service placement a challenging task. A typical static placement solution is not effective as it does not consider the traffic mobility and service dynamics. Handling dynamics in IoV for service placement is an important and challenging problem which is the primary focus of our work in this paper. We propose a Deep Reinforcement Learning-based Dynamic Service Placement (DRLD-SP) framework with the objective of minimizing the maximum edge resource usage and service delay while considering the vehicle's mobility, varying demand, and dynamics in the requests for different types of services. We use SUMO and MATLAB to carry out simulation experiments. The experimental results show that the proposed DRLD-SP approach is effective and outperforms other static and dynamic placement approaches., Accepted for publication at the IEEE Internet of Things Journal

Vehicular networks, like any other wireless networks, are prone to jamming due to the inherent nature of the wireless environment. In this letter, we consider an attacker who jams the network whenever he observes that a packet is being transmitted, i.e., some communication happening in the network. Such a strategy leads to an increase in the packet drop rate and latency of the network. This causes serious disruption of delay-sensitive applications that can lead to life endangering situations and therefore such an attack needs to be addressed. In this letter, we propose a mechanism that uses a support vector machine to detect the presence of a jammer in the network. We obtain jointly sufficient statistics of packet drop probabilities and use them to generate the training data. The results demonstrate the effectiveness of the proposed detection system.

Software defined networking (SDN) is gaining the confidence of network operators, who are increasingly motivated to introduce it in their networks. However, since SDN is based on centralized control plane (decoupled from the data plane), it is incompatible with distributed control plane of legacy networks. As adopting SDN by complete overhaul of existing legacy networks is infeasible, several solutions propose to incrementally adopt SDN in legacy networks, resulting in hybrid SDN/legacy networks during the transition phase. While strategies to effectively introduce SDN switches in legacy networks have received significant attention in the literature, the same is not true for the associated SDN controller placement in hybrid SDN networks. In this paper, we introduce and formulate the multi-objective control plane dimensioning problem in hybrid SDN/legacy networks, considering network resilience, flow-setup latency and controller load balancing as objectives. We propose optimization models for both the single-objective as well as the multi-objective controller placements. We model both controller processing latency (based on queueing theory) and inter-controller network state synchronization latency (based on Steiner trees) without compromising linearity of the optimization formulations. A genetic algorithm-based heuristic is presented to efficiently deduce the approximate Pareto frontier for our problem. Extensive simulations over a large number of real networks establish the effectiveness of our approach in terms of several single-objective and multi-objective performance metrics.

The separation of control and data plane in Software Defined Networking (SDN) introduces new security threats. A compromised controller can leverage its position to perform attacks by installing malicious rules in switches while avoiding detection. Current approaches propose broadcast of flow-setup requests to multiple controllers simultaneously and to check consistency of forwarding rules to install the correct rule and identify compromised controllers. However, such approaches result in heavy load on the control plane, resulting in longer response times to requests and higher network cost to accommodate the increased load. To alleviate this issue, we propose a game-theory based framework to detect a malicious controller without overloading the control plane. Instead of broadcasting every request to multiple controllers, switches randomly broadcast requests on the basis of a randomization strategy obtained by the Stackelberg game, whose solution results in a randomization strategy that maximizes the detection probability of a malicious controller. We formulate a two-level optimization problem in the context of our game-theoretic framework that aims to maximize the attack detection probability among the set of controllers by mapping switches to controllers and obtaining randomization strategies for each controller. We develop Midas (MalIcious controller Detection mApping Strategy), a heuristic algorithm to obtain an effective solution to the optimization problem in reasonable time. Midas achieves minimum detection probability within 12% of the optimal solution. Further, it achieves at least 80% of min-max ratio of load at the controllers, implying higher fairness in load distribution compared to optimal solution, a state-of-art algorithm and a baseline heuristic.

Classification of IoT devices into different types is of paramount importance, from multiple perspectives, including security and privacy aspects. Recent works have explored machine learning techniques for fingerprinting (or classifying) IoT devices, with promising results. However, existing works have assumed that the features used for building the machine learning models are readily available or can be easily extracted from the network traffic; in other words, they do not consider the costs associated with feature extraction. In this work, we take a more realistic approach, and argue that feature extraction has a cost, and the costs are different for different features. We also take a step forward from the current practice of considering the misclassification loss as a binary value, and make a case for different losses based on the misclassification performance. Thereby, and more importantly, we introduce the notion of risk for IoT device classification. We define and formulate the problem of cost-aware IoT device classification. This being a combinatorial optimization problem, we develop a novel algorithm to solve it in a fast and effective way using the Cross-Entropy (CE) based stochastic optimization technique. Using traffic of real devices, we demonstrate the capability of the CE based algorithm in selecting features with minimal risk of misclassification while keeping the cost for feature extraction within a specified limit., 33 pages, 9 figures

The fast-growing Internet-of-Things (IoT) market has opened up a large threat landscape, given the wide deployment of IoT devices in both consumer and commercial spaces. Attacks on IoT devices generally consist of multiple stages and are dispersed spatially and temporally. These characteristics make it challenging to detect and identify the attack stages using solutions that tend to be localized in space and time. In this work, we present Adept , a distributed framework to detect and identify the individual attack stages in a coordinated attack. Adept works in three phases. First, network traffic of IoT devices is processed locally for detecting anomalies with respect to their benign profiles. Any alert corresponding to a potential anomaly is sent to a security manager, where aggregated alerts are mined, using frequent itemset mining (FIM), for detecting patterns correlated across both time and space. Finally, using both alert-level and pattern-level information as features, we employ a machine learning approach to identify individual attack stages in the generated alerts. We carry out extensive experiments, with emulated and realistic network traffic; the results demonstrate the effectiveness of the proposed framework in terms of its ability in attack-stage detection and identification.

In software-defined networks, a compromised controller that is Byzantine in nature would issue inconsistent messages selectively to its communicating nodes. Defending against such threats is very challenging since the infected messages look legitimate. To defend against $f$ simultaneous controller failures using the conventional Byzantine fault tolerance approach requires a switch to be mapped to $3f+1$ controllers. This approach increases the network load due to multiple requests from switches and also requires a large number of controllers for the entire network. In this paper, we propose a novel primary-backup controller mapping approach in which a switch is mapped to only $f+1$ primary and $f$ backup controllers to defend against $f$ simultaneous controller failures. We develop an optimization programming formulation for the switch-controller mapping problem that minimizes the number of controllers required considering latency and capacity constraints. We also develop an optimization programming formulation for the remapping problem upon a controller failure, minimizing the number of remappings of unaffected switches. Since the optimization formulations are computationally prohibitive, we develop heuristic algorithms for both problems. The performance study shows that the optimal mapping requires up to 50% fewer controllers compared to an existing scheme and the heuristics perform within $8\%$ of the optimum.

In a distributed Software Defined Networking (SDN) architecture, the Quality of Service (QoS) experienced by a traffic flow through an SDN switch is primarily dependant on the SDN controller to which that switch is mapped. We propose a new controller-quality metric known as the Quality of Controller (QoC) which is defined based on the controller’s reliability and response time. We model the controller reliability based on Bayesian inference while its response time is modelled as a linear approximation of the M/M/1 queue. We develop a QoC-aware approach for solving (i) the switch-controller mapping problem and, (ii) control traffic distribution among the mapped controllers. Each switch is mapped to multiple controllers to enable resilience with the switch-controller mapping and control traffic distribution based on the QoC metric which is the combined cost of controller reliability and response time. We first develop an optimization programming formulation that maximizes the minimum QoC among the set of controllers to solve the above problem. Since the optimization problem is computationally prohibitive for large networks, we develop a heuristic algorithm — Qoc-Aware switch-coNTroller Mapping (QuANTuM) — that solves the problem of switch-controller mapping and control traffic distribution in two stages such that the minimum of the controller QoC is maximized. Through simulations, we show that the heuristic results are within 18% of the optimum while achieving a fair control traffic distribution with a QoC min-max ratio of up to 95%.

In recent years, Software Defined Networking (SDN) has emerged as a pivotal element not only in data-centers and wide-area networks, but also in next generation networking architectures such as Vehicular ad hoc network and 5G. SDN is characterized by decoupled data and control planes, and logically centralized control plane. The centralized control plane in SDN offers several opportunities as well as challenges. A key design choice of the SDN control plane is placement of the controller(s), which impacts a wide range of network issues ranging from latency to resiliency, from energy efficiency to load balancing, and so on. In this paper, we present a comprehensive survey on the controller placement problem (CPP) in SDN. We introduce the CPP in SDN and highlight its significance. We present the classical CPP formulation along with its supporting system model. We also discuss a wide range of the CPP modeling choices and associated metrics. We classify the CPP literature based on the objectives and methodologies. Apart from the primary use-cases of the CPP in data-center networks and wide area networks, we also examine the recent application of the CPP in several new domains such as mobile/cellular networks, 5G, named data networks, wireless mesh networks and VANETs. We conclude our survey with discussion on open issues and future scope of this topic.

Cloud data centers nowadays play an important role in providing computing and network resources for online applications and services. Such applications obtain cloud resources by submitting resource requests in the form of virtual networks that are embedded in the cloud infrastructures, referred to as virtual network embedding (VNE). Developing an effective VNE algorithm is crucial since it affects the performance of data centers, such as rejection ratio, resource utilization, and revenue. The problem is much more challenging when considering ring optical data centers due to multiple issues: wavelength continuity constraint, wavelength selection, and physical path selection for a lightpath. In this paper, we first develop an optimization programming formulation, which is computationally prohibitive. We then develop a novel VNE algorithm that adopts the Web page ranking approach to evaluate the goodness of a top-of-the-rack (ToR)-based on its resources in correlation with that of other ToRs. We also develop efficient methods for wavelength and physical path selections for a lightpath dynamically created during the embedding. We evaluate the proposed algorithm through comprehensive simulations in comparing with the optimal results and baseline algorithms. The simulation results show that the proposed algorithm performs close to the optimal one. It significantly reduces the rejection ratio by at least 23% compared to the baseline algorithms, leading to an increase in revenue by at least 14%.

We address the problem of embedding service chains consisting of a sequence of virtual network functions (VNF) for 5G slices, considering diversified slice requirements. We develop a fine-grained approach that considers resource requirements and limited traffic processing capacity of VNFs, which can be shared (or not) among slices depending on VNF functionalities. We develop an optimization formulation that minimizes the resources while satisfying the constraints in both the physical infrastructure and logical slices. We also develop a heuristic algorithm based on a goodness function to overcome the problem complexity. The numerical results show that our approach uses 30% less bandwidth and 45% fewer VNF instances, compared with a baseline.

Identifying IoT devices connected to a network has multiple security benefits, such as deployment of behavior-based anomaly detectors, automated vulnerability patching of specific device types, dynamic attack mitigation, etc. In this paper, we look into the problem of IoT device identification at network level, in particular from an ISP’s perspective. The simple solution of deploying a supervised machine learning algorithm at a centralized location in the network neither scales well nor can identify new devices. To tackle these challenges, we propose and develop a distributed device fingerprinting technique (DEFT), a distributed fingerprinting solution that addresses and exploits the presence of common devices, including new devices, across smart homes and enterprises in a network. A DEFT controller develops and maintains classifiers for fingerprinting, while gateways located closer to the IoT devices at homes perform device classification. Importantly, the controller and gateways coordinate to identify new devices in the network. DEFT is designed to be scalable and dynamic—it can be deployed, orchestrated, and controlled using software-defined networking and network function virtualization. DEFT is able to identify new device types automatically, while achieving high accuracy and low false positive rate. We demonstrate the effectiveness of DEFT by experimenting on data obtained from real-world IoT devices.

The scale of connected devices in the modern communication network and its heterogeneous nature have made securing the network more challenging. However, with the advent of software defined networking (SDN), the algorithmic complexity is handled at a centralized control plane and the network elements perform only data forwarding based on control plane decisions. This enables researchers to design innovative security protocols at the control plane to dynamically defend against attacks. In this paper, we propose a dynamic attack-resilient routing (ARR) approach and develop an optimization formulation for fragmented multipath routing taking reliability and load into consideration for SDN-enabled networks. Though erasure encoding has been well studied for resilient data storage, it is rarely mentioned in the context of network routing owing to its complexity, redundancy, and difficulty of satisfying practical routing constraints. In this paper, we dynamically determine the optimal route for erasure-encoded fragments of the data, in terms of attack resilience, under the constraint on allowable encoding redundancy. Since the ARR algorithm is computationally prohibitive for larger networks, we develop a heuristic solution for the same using a multipath-tree. The proposed algorithm dynamically routes the data fragments along a set of reliable and lightly loaded paths to achieve multipath diversity and thereby improve data availability at the destination even in the presence of attacks. We demonstrate the effectiveness of our proposed approach in terms of weighted path reliability, resilience, and blocking performance through simulations.

We derive a tight, single-term, purely exponential, lower bound on the Gaussian $Q$ -function, along with a method to optimize its tightness and a fast iterative method for its inversion. To illustrate its application, we show that it enables the accurate, analytical estimation of the signal-to-noise ratio penalty and the laser linewidth tolerance of coherent optical communication systems, without any time-consuming simulations.

We propose an effective switch-controller mapping scheme for distributed controller architectures in software defined networks. Our scheme maps a switch to multiple controllers and distributes flow setup requests among them to minimize flow setup time, satisfying the resilience constraint, which requires that a specified fraction of setup requests at each switch is not affected upon a controller failure. We develop an optimization formulation for the problem and compare our scheme against the single controller mapping. The results show that our scheme reduces flow setup time, provides better fairness among switches and that it is more stable against dynamic traffic fluctuations.

The effect of pointing errors on the average bit error probability (ABEP) of an intersatellite laser communication link is studied. A closed-form expression in terms of the Marcum $Q$ -function is given for calculating the instantaneous channel gain. This expression provides great potential in further performance analysis and system optimization. In addition, tight, closed-form upper and lower bounds on the ABEP are derived, by using bounds on the Gaussian $Q$ -function. These bounds are in simpler form than existing results and are much more efficient in numerical evaluations. Further simplifications of these bounds are performed and invertible ABEP expressions are given. Via numerical comparisons, these invertible ABEP expressions are shown to be accurate approximations within a wide range of transmit power of interest and thus provide efficient error prediction methods. The diversity gain is easily obtained using the invertible ABEP expressions, which is related to the ratio of the equivalent beam radius to the pointing error displacement standard jitter at the receiver. Moreover, we show explicitly how the ABEP depends on different system parameters.

Increased power usage and network performance degradation due to best-effort bandwidth sharing significantly affect tenancy cost, cloud adoption, and data center efficiencies. In this article, we propose a novel Sliding-Scheduled Tenant request model which enables tenants to specify the required duration of their application within a certain window, in addition to its resource requirement graph. We investigate the sliding-scheduled application placement and routing problem, which selects the start-time of requests within their specified time-window to reserve both server and network resources for their required duration, and therefore provide resource guarantees with predictable performance. Using the multi-component utilization-based power model, we formulate the problem as an optimization problem that maximizes the acceptance rate while consuming as low power as possible. We develop fast online heuristics that adopt power, acceptance and adaptive spread-based scheduling policies while allocating the resources with the consideration of request duration and current shutdown-time of the devices. We demonstrate the effectiveness of the proposed algorithms in terms of power saving and acceptance rate, 1) for small data centers, by comparing their performance with the numerical results obtained from solving the optimization problem using CPLEX and 2) for large data centers using comprehensive simulation results.

Increased power usage and network performance variation due to best-effort bandwidth sharing significantly affect tenancy cost, cloud adoption, and data center efficiencies. In this paper, we propose a novel time-aware request model which enables tenants to specify an estimated required time-duration, in addition to their required server resources for Virtual Machines (VMs) and network bandwidth for their communication. We investigate the VM-placement and routing problem, which allocates both server and network resources for the specified time-duration, to provide resource guarantees. Further, we exploit VM-migration while considering its power consumption overhead, to improve power saving and resource utilization. Using the multi-component utilization-based power model, we formulate the problem as an optimization problem that maximizes the acceptance rate while consuming as low power as possible. We develop fast online heuristics that allocate resources for requests, considering their duration and bandwidth demand. We also develop migration policies augmenting these heuristics. For migration heuristics, we propose server-migration and switch-migration approaches, which migrate the VMs between the powered-on servers only if their migrations result in turning-off at least one server and switch, respectively. We demonstrate the effectiveness of the proposed heuristics in terms of power saving, acceptance ratio, and migration overhead using comprehensive simulation results.

This article focuses on the problem of bandwidth allocation to users of Cloud data centers. An interesting approach is to use advance bandwidth reservation. Such systems usually assume all requests demand either bandwidth-guarantee (BG) or time-guarantee (TG), but not both. Hence the solutions are tailored for one type of requests. A BG request demands guarantee on bandwidth; whereas a TG request demands guarantee on time for transfer of data of specified volume. We define a new model that allows users to not only submit both kinds of requests, but also specify flexible demands. We tie up the problem of bandwidth allocation with differential pricing, that gives discounts to users based on the flexibility in their requests. We propose a two-phase, adaptive and flexible bandwidth allocator (A-FBA) that, in one phase admits and allocates minimal bandwidth to dynamically arriving user requests, and in another phase, allocates additional bandwidth for accepted requests maximizing revenue. The problem formulated in first phase is ${\cal NP}$ -hard, while the second phase can be solved in polynomial time. We show that, in comparison to a traditional deterministic model, the A-FBA not only increases the number of accepted requests significantly, but also does so by generating higher revenues.

As bandwidth is shared in a best-effort way in today's data centers, traffic generated between a set of VMs (virtual machines) affect the traffic between another set of VMs (possibly belonging to another tenant) sharing the same physical links, leading to unpredictable performance of applications running on these VMs. This article addresses the problem of allocation of not only server resources (computational and storage) but also network bandwidth, to provide performance guarantees in multi-tenant data centers. Bandwidth being a critical shared-resource, we formulate the problem as an optimization problem that minimizes bandwidth demand between clusters of VMs of a tenant; and we prove it as ${\cal NP}$ -hard. We develop fast online heuristics as an integrated resource allocator (IRA) that decides on the admission of dynamically arriving requests, and allocates resources for the accepted ones. We also present a modified version of IRA, called B-IRA that bounds the cost of bandwidth allocation, while exploring smaller search space for solution. We demonstrate that, IRA accommodates significantly higher number of requests in comparison to a load-balancing resource allocator (LBRA) that does not consider reducing bandwidth between clusters of VMs. IRA also outperforms B-IRA when traffic demands of VMs in an input are not localized.

Ethernet is becoming a preferred technology to be extended to metropolitan area networks (MANs) due to its low cost, simplicity, and ubiquity. However, current Ethernet lacks a fast failure recovery mechanism as it reconstructs the spanning tree after the failure is detected, which commonly requires tens of seconds. Some fast failure-handling methods based on multiple spanning trees have been proposed in the literature, but these approaches are either centralized or require periodic message broadcasting over the entire network. In this paper, we propose a local restoration mechanism for metro Ethernet using multiple spanning trees, which is distributed and fast and does not need failure notification. Upon failure of a single link, the upstream switch locally restores traffic to preconfigured backup spanning trees. We propose two restoration approaches, connection-based and destination-based, to select backup trees. We formulate the tree preconfiguration problem that includes working spanning tree assignment and backup spanning tree configuration. We prove that the preconfiguration problem is NP-complete and develop an integer linear programming model. We also develop heuristic algorithms for each restoration approach to reduce the computation complexity. To evaluate the effectiveness of our heuristic algorithms, we carry out the simulation on grid and random networks. The simulation results show that our heuristic algorithms have comparable performance close to the optimal solutions, and both restoration approaches can efficiently utilize the network bandwidth to handle single link failures.

In this paper, we consider the problem of scheduling lightpaths and computing resources for sliding grid demands in WDM networks. Each sliding grid demand is represented by a tuple (v,R,c,p,q,l) , where v is the client node, R is the resource-group which includes a group of predefined resource nodes, c is the required amount of computing resources, [p,q] is the time window and l is the demand duration. With each demand, the scheduling algorithm is required to decide the start time t (p les t les q - l), reserve an amount of c computing resources at a resource node v ' isin R and provision a primary lightpath as well as a backup lightpath from v ' to v . The reserved computing resources and lightpaths are used during [t,t + l]. Unlike the sequential approach wherein the start time, the network resources (lightpaths) and the computing resources are considered one after another, in our work we use the joint scheduling approach wherein the resources and the start time are examined jointly. We consider sliding demands with static and dynamic arrival patterns. We develop an integer linear programming (ILP) formulation to obtain optimal results. For the reason of scalability, we propose heuristic algorithms based on joint resource scheduling and study their effectiveness through simulation experiments.

We consider Label Switched Path (LSP) protection for connections with various protection grade requirements in multi-protocol label switching (MPLS) over wavelength division multiplexing (WDM) optical networks. In full protection, bandwidth needs to be reserved for the backup LSP to protect the failure of any fiber along the primary LSP. In this paper, we study the problem of partial spatial-protection (PSP) where bandwidth is reserved for the backup LSP to protect the failure of a subset of fibers traversed by the primary LSP to satisfy the specified protection grade. We formulate the optimal LSP PSP problem as an ILP and identify three suboptimal problems. For each suboptimal problem, an exhaustive search algorithm and a heuristic are developed. We analyze the probability that a connection can be restored upon a fiber failure and find that it is higher than or equal to the protection grade specified. We also develop a failure recovery protocol which specifies recovery operations upon failure and determines whether a connection can be recovered if the failed fiber is one of its unprotected fibers. Through extensive simulation experiments, we demonstrated that the proposed LSP PSP algorithms perform better than shared LSP protection in blocking probability and resource efficiency.

In this paper, we consider the connected target coverage (CTC) problem with the objective of maximizing the network lifetime by scheduling sensors into multiple sets, each of which can maintain both target coverage and connectivity among all the active sensors and the sink. We model the CTC problem as a maximum cover tree (MCT) problem and prove that the MCT problem is NP-Complete. We determine an upper bound on the network lifetime for the MCT problem and then develop a (1+w)H(M circ) approximation algorithm to solve it, where w is an arbitrarily small number, H(M circ)=1 lesilesM circ(1/i) and M circ is the maximum number of targets in the sensing area of any sensor. As the protocol cost of the approximation algorithm may be high in practice, we develop a faster heuristic algorithm based on the approximation algorithm called Communication Weighted Greedy Cover (CWGC) algorithm and present a distributed implementation of the heuristic algorithm. We study the performance of the approximation algorithm and CWGC algorithm by comparing them with the lifetime upper bound and other basic algorithms that consider the coverage and connectivity problems independently. Simulation results show that the approximation algorithm and CWGC algorithm perform much better than others in terms of the network lifetime and the performance improvement can be up to 45% than the best-known basic algorithm. The lifetime obtained by our algorithms is close to the upper bound. Compared with the approximation algorithm, the CWGC algorithm can achieve a similar performance in terms of the network lifetime with a lower protocol cost.

This paper addresses the problem of achieving a balance in satisfying a network service provider's requirements: maintaining an acceptable call acceptance rate, satisfying protection requirements of requests, and controlling the signaling overhead in case of a component failure, in IP-over-WDM networks in a dynamic traffic arrival scenario. Satisfying all these aspects is a difficult task especially when the traffic pattern is dynamic in nature and a single layer protection approach is followed. In this work, first we propose a multi-layer protection scheme for achieving a better and acceptable tradeoff between blocking performance and signaling overhead in IP-over-WDM networks. We define various operational settings in the proposed scheme and investigate their impacts on the performance of the scheme. An important feature of this scheme is that, these settings allow a network service provider to select a suitable operational strategy for achieving the desired tradeoff based on network's policy and traffic demand. Then we propose an adaptive protection approach for dynamic traffic in consideration of providing better protection to requests as much as possible while considering blocking performance and signaling overhead. Through simulation experiments we evaluate the performance of the proposals and demonstrate their effectiveness