Search

Software-Defined Networking (SDN) provides a programmable framework for multi-tenant cloud network management and orchestration. The end-to-end packet processing induced by virtual network functions (VNFs) like stateless firewall, load balancer, intrusion detection, and prevention system (IDPS) in a network involves the processing of network traffic through security policies matching the traffic pattern defined in security rules of individual VNF. The conflicting rules in terms of traffic match and conflicting actions can lead to a) violation of security requirements (authentication and authorization bypass) b) mission requirements - the presence of redundant rules (increased latency, reduced throughput). We present a new object-oriented policy conflict detection and resolution framework (OOPC), which analyzes the rule dependency relationships between the rules of heterogeneous virtual network functions (VNFs) and creates a VNF-Graph. The rules are analyzed using object-oriented dependencies between the address space and actions of VNF rules. OOPC utilizes a compact VNF-Graph, which leads to a reduction in search complexity when analyzing new security policies. Our security policy composition in our framework OOPC achieves 37% lower latency in policy graph composition than previous work. The proposed solution performs 20% faster security policy conflict detection on a cloud network with 60k OpenFlow rules than prior frameworks that serve a similar purpose.

The network function virtualization paradigm replaces dedicated hardware appliances with software running on virtual machines in commodity servers. However, to overcome performance and scalability issues on virtual network functions (VNFs) demanding intensive packet processing, we propose implementing these VNFs as programmable rules distributed among software-defined networking (SDN) switches. Our approach allows infrastructure providers to combine hardware-based and software-based SDN switches, exploring the tradeoff between the packet processing speed and instantiation flexibility. Our proposal includes a scalable mechanism, which decides the type and number of switches to meet network demand, along with a load balancing mechanism to distribute flows among switches, considering their singularities. We first evaluate our proposal in a small testbed with real equipment, confirming its effectiveness. Then, we evaluate our proposal with simulations to further investigate its scalability. Our results show that, even under high traffic loads, the joint operation of both mechanisms improves VNF capacity and saves virtualization resources.

The Software Defined Networking (SDN) paradigm decouples the network control functions from the data plane and offers a set of software components for flexible and controlled management of networks. SDN has promised to provide numerous benefits in terms of on-demand provisioning, automated load balancing, streamlining physical infrastructure, and flexibility in scaling network resources. In order to realize these network service offerings, there is an important need for developing an efficient, robust, and secure execution platform. As a primary contribution, we present a novel virtual execution platform for the OpenFlow controller using Network Function Virtualization (NFV). Theoretically, NFV can apply to any network function, which can simplify the managing of the heterogeneous data plane. The characteristics of our proposed architecture include pipe-lined processing of network traffic, virtualized and replicated execution of network functions, isolation between task nodes, and random mapping of traffic to task nodes. The proposed architecture has two major components: a Network Packet Schedulers (NPS) and a Task Engine (TE). The TE consists of Task Nodes (TNs) which are responsible for executing different network functions on various traffic flows and each TN is realized as a virtual machine. Upon receiving traffic from the data plane, NPS analyses the functional requirements of the traffic and different controller performance parameters. Then it allocates the traffic to appropriate TNs for executing necessary network functions. In this respect, it provides performance benefits, robustness, fine-grained modularity, and strong isolation security in the processing of traffic flows on the SDN platform. Efficacy of our proposed architecture has been demonstrated with a case study.

The availability of Software Defined Network’s (SDNs) flow rule entry in the flow table is considered a key factor in the timely delivery of a certain flow. The controller is approached for instructions on how to deal with the flow when the rule for such flow is missing. The controller then updates the flow table accordingly at the switch so that flow could be dealt with locally. It becomes problematic when no rule is defined yet at the controller by the application plane. In most of these cases, such a situation is handled by programming the controller with wildcard rules. However, handling many flows at once under wildcard rules severely hampers the network performance. Flow rules formation by the application plane is sometimes critical and time-consuming which increases the latency ratio by creating a bottleneck at the switch level. To avoid the bottlenecks due to rule absence, in this paper, rather than waiting for the application plane’s response and putting the pending traffic flows in the buffer, which may be dropped, the controller is programmed in a way that has the built-in mechanism of self-flow rule formation. This atomized mechanism is based on the previously available traces of the same flows when they were forwarded on the network using the wildcard rules. To assess the performance of the proposed work, it is emulated and benchmarked with the latest research. The results show considerable performance achievement.

Distributed denial of service (DDoS) attacks have always been a nightmare for network infrastructure for the last two decades. Existing network infrastructure is lacking in identifying and mitigating the attack due to its inflexible nature. Currently, software-defined networking (SDN) is more popular due to its ability to monitor and dynamically configure network devices based on the global view of the network. In SDN, the control layer is accountable for forming all decisions in the network and data plane for just forwarding the message packets. The unique property of SDN has brought a lot of excitement to network security researchers for preventing DDoS attacks. In this article, for the identification of DDoS attacks in the OpenFlow controller, a probabilistic technique with a central limit theorem has been utilized. This method primarily detects resource depletion attacks, for which the DARPA dataset is used to train the probabilistic model. In different attack scenarios, the probabilistic approach outperforms the entropy-based method in terms of false negative rate (FNR). The emulation results demonstrate the efficacy of the approach, by reducing the FNR by 98% compared to 78% in the existing entropy mechanism, at 50% attack rate.

Cloud Computing provides an auto-scaling feature for dynamic resource utilization to cope with their customers’ requirements and charge as ‘pay-per-use’. Attackers get the benefit of this auto-scaling feature by flooding DDoS attacks on the VMs or instances in the cloud environments. Such DDoS attacks give financial damages to the customers because of massive amount of resource utilization, known as the Economic Denial of Sustainability (EDOS) attack. Transmission Control Protocol (TCP) SYN flooding attack is known to be the most challenging attack resulting EDOS attack. Software Defined Network (SDN) being a cost-efficient solution for cloud service providers, uses the OpenFlow switches and flow tables to make rules for each incoming flow. In SDN, it is feasible to classify an incoming flow as an attack and block forwarding of this flow to the targeted VM. This research work proposes an SDN based fast and computationally cost-efficient statistical anomaly detection model, named EDOS-TCP SYN mitigation model (EDOS-TSM) to mitigate TCP SYN flooding attack from a single user and spoofed IPs. EDOS-TSM uses binomial probability, TTL field value of IP packet header and multi-TCP SYN requests to detect source-based and spoofing based attacks. The proposed model is implemented, and the performance is evaluated on an OpenStack production-based cloud with real-time traffic and attack generation. The attack mitigation results are compared with existing models in the literature. The results show a large number of false negatives in existing models and efficiency of EDOS-TSM is proved in both source based and spoofing attacks.

Low-rate Denial of Service (LDoS) attacks cause severe destructiveness to network security. Consequently, the implementation of detection and defense against them is a concern among the research communities. But it is formidable to deploy extension modules to detect and mitigate attacks online in traditional networks, because devices are deficient of flexibility and scalability. To address the problem, we design and implement an online attack detection and mitigation system (ADMS) framework via the scalable and programmable Software Defined Networking (SDN). ADMS is installed on SDN controllers and conforms to the OpenFlow policy without extra devices. ADMS consists of two modules: the two-phase detection module and the mitigation module. The two-phase detection module combines the new port traffic feature and the Lightgbm classifier based on flow table statistics traffic to precisely detect LDoS attacks. The mitigation module utilizes the novel Sequence Matching based Dynamic Series Analysing (SMDSA) algorithm to locate the attacker, and efficiently mitigates attack traffic by packet filter. The SMDSA algorithm distinguishes the victim port from benign ports by calculating the anomaly score of each port. Our evaluation on a prototype implementation of ADMS shows that the framework is able to precisely identify and efficiently mitigate LDoS attacks in real-time.

In this article, we revisit the problem of how to provide "native" IP multicast support to enterprise distributed applications in today's clouds, without touching either the application implementation or the underlying network hardware. We propose SDM, Software-Defined IP Multicast, to explore the idea of performing Multicast-to-Unicast (M2U) and Unicast-to-Multicast (U2M) translations at the virtualized network edge. At the data plane, with novel architecture designs, SDM achieves efficient M2U and U2M translations by only using Open vSwitch (OVS), an OpenFlow-compatible open-source software switch widely deployed in modern clouds. At the control plane, SDM dynamically adopts multicast trees respecting the join and leave of receivers with flexible cost-based algorithms. SDM is very easy to deploy and use, as its required features are already supported by off-the-shelf OVS software (version ≥ 2.3) and the OpenFlow protocol (version ≥ 1.1). Performance evaluations of its control-plane algorithms also imply that SDM is flexible to construct throughput and latency/height optimized multicast trees respecting task requirements.

The inappropriate distribution of traffic in high workload areas leads to congestion, packet loss, and poor service quality provided by data center networks (DCNs). In this paper, we have proposed a new method for traffic engineering (TE) as a modular approach. Based on this algorithm, depending on the type of traffic, when enough resources are not available for routing, the best path for that flow would be chosen. In the proposed algorithm, the less loaded paths for conduction of current are selected with regard to the present conditions as soon as a current is generated between two hosts, their position is identified in the DCN, and the paths between the two are obtained. We have simulated our algorithm by Mininet emulator. The results demonstrated that the SEMTE method performed an average of 30% better in energy consumption and 70% better in increasing maximum link utilization (MLU) compared to the conventional equal cost multi-path (ECMP) algorithm; however, there was some overhead on the system in terms of time of reading information from OpenFlow switches.

The quality of service (QoS) in networking is the process of managing network resources to reduce packet loss and to lower network jitter and latency. QoS has been widely used in traditional network and can also be implemented in the 5G standard based on a software-defined network (SDN). A traditional network carries several challenges, such as vendor dependency, the complexity of managing a large network, dynamically changing forwarding policies, and more. Software-defined networking is a new networking strategy designed to address the challenges of a traditional IP network, such as high levels of complexity and inability to adapt to the new quality of service requirements in a timely manner. The fundamental idea behind SDNs compared to the conventional networking paradigm is the creation of horizontally integrated systems through the separation of the control and the data plane while providing an increasingly sophisticated set of abstractions. Recently, various SDN-enabled QoS frameworks have emerged that offer many possibilities for network reconfiguration and high-level definition of policies. QoS requirements for 5G networks have been defined on the basis of three main categories of use cases: extreme mobile broadband (xMBB), massive machine type communications (mMTC) IoT/M2M devices, and highly reliable М2М-communication (ultra-reliable machine-type communications – uMTC). This paper analyzes and surveys the QoS based on the openflow protocol method and QoS based on open-source SDN controllers method in 5G network. In addition, we discuss various architectural issues of open-source SDN controllers network and examine their impact on the QoS. Furthermore, we outline the characteristics of the QoS parameters such as latency, availability, reliability, jitter, and bandwidth in the 5G network. Finally, the article discusses and compares parameters of the QoS in 5G determined by world’s leaders in 5G technology.

Software Defined Networking (SDN) is a new networking paradigm where forwarding hardware is decoupled from control decisions. It promises to dramatically simplify network management and enable innovation and evolution. In SDN, network intelligence is logically centralized in software-based controllers (the control plane), while network devices (OpenFlow Switches) become simple packet-forwarding devices (the data plane) that can be programmed via an open interface (OpenFlow protocol). Such decoupling of the control plane from the data plane introduces various challenges that include security, reliability, load balancing, and traffic engineering. Dreadful security challenges in SDNs are denial of service (DoS) and distributed denial of service (DDoS) attacks. For instance, in SDNs, DoS/DDoS attacks could flood the control plane, the data plane, or the communication channel. Attacking the control plane could result in failure of the entire network, while attacking the data plane or the communication channel results in packet drop and network unavailability. In this paper we deliver several contributions that shed light on the field of DoS/DDoS attacks in SDNs, providing a complete background about the area, including attacks and analysis of the existing solutions. In particular, our contributions can be summarized as follow: we review and systematize the state-of-the-art solutions that address both DoS and DDoS attacks in SDNs through the lenses of intrinsic and extrinsic approaches. Moreover, the discussed countermeasures are organized accordingly to their focus, be it on detection, mitigation, prevention, or graceful degradation. Further, we survey the different approaches and tools adopted to implement the revised solutions. Finally, we also highlight possible future research directions to address DoS/DDoS attacks in SDNs.

In recent years, the huge expansion of Datacenters (DC) to execute billions of end-user applications in real-time leads to a large amount of energy consumption across the globe. So, the traditional TCP/IP-based networks which are being used for DC inter-connections are facing challenges of managing stringent Quality-of-Service (QoS) requirements of different applications of the end-users and service providers. Moreover, the existing solutions rely on distributed architecture and do not scale for large scale data centers. The issue of high power consumption at DC arises with the increase in the number of nodes and links in the network. Also, it becomes problematic on the DC whenever the underlying network resources (switches and routers) are not efficiently utilized at the time of peak data traffic resulting in high operational cost of energy utilization. However, Software-Defined Networking (SDN) emerges as one of the leading technologies to address the aforementioned issues using the programmable switches and controllers. Inspired from these facts, in this paper, we have formulated the Energy-Aware Routing (EAR) problem of DCs as a Mixed Integer Non-Linear Programming (MINLP) for which an Energy-Efficient Fast Flow Forwarding (EnFlow) scheme is designed. The EnFlow scheme uses the power-saving mode of the network to solve the EAR problem. It has three modules namely– priority scheduling , routing , and re-routing . The first module works according to the First-in-First-Out Push Out Priority (FIFO-POP) scheduling using the multiple OpenFlow switches. The FIFO-POP is designed to save the energy usage of multiple switches by reducing the average waiting time of incoming packets in the queue buffers. The second module is based upon an efficient flow re-routing for a new node and link adaptation to provide the maximum bandwidth to the wired links. The third module is based upon the meta-heuristic Ant Colony Routing (ACR) to execute the stochastic decision policy on the network controller for computation of the shortest path of the forwarding nodes. The proposed EnFlow scheme is simulated using the data traces of 34 cities of NorthAmerica zone with Omnet++ 5.1 using various performance evaluation metrics. The results obtained demonstrated that the proposed EnFlow scheme is 24.55% and 71.15% more energy-efficient in comparison to the RE-FPR and ILP-EAR schemes. Also, it consumes 9.72% and 40.83% lower energy in comparison to the FFHA and EXR schemes respectively.

The scalability issue hinders the deployment of Software-Defined Networking (SDN) in the Wide Area Networks (WANs). Existing solutions have two issues: (1) network performance relies on complicated controller synchronization, which increases the complexity of network control; (2) fine-grained flow processing enables flexible flow control at the cost of high processing load on the controllers and high flow table occupancy on switches. In this paper, we propose a scalable routing solution named HybridFlow, which achieves a good load balancing performance using a single controller with low control overhead (i.e., flow routing and rerouting overhead). HybridFlow mainly employs two techniques: hybrid routing and crucial flow rerouting . Hybrid routing enabled by commercial SDN switches gives us opportunities to reduce the processing load of the controller by routing flows with the hybrid OpenFlow/OSPF mode. Thus, the majority of flows can be routed by OSPF without involving the controller. Crucial flow rerouting realizes load balancing by dynamically identifying crucial flows based on a new metric called Variation Slope and rerouting these flows with the hybrid OpenFlow/OSPF mode. The simulation based on the real traffic traces and network typologies shows that compared with the optimal solution, HybridFlow can achieve 87% of the optimal load balancing performance by rerouting 36% less flows on average.

Software Defined Networking (SDN) has developed tremendously in the recent years. This paper addresses different flow installation mechanisms. The idea of a programmable network which is the foundation of SDN ensures dynamic network management by separating the control plane from data and management planes. In SDN the control plane resides in SDN Controller, which is responsible for the installation of flows on the data plane. Whenever a flow enters into an SDN switch, flow tables are generated for those flows and installed at data plane from the control plane. These flows have their own properties because of their relevant protocols which are attached to them. A flow consists of a matching pattern, actions, and counter. Based on the respective flow, data communication takes place. This paper investigates three kinds of flow installation mechanisms, reactive, proactive and hybrid. Based on these three flow installation mechanisms, we have analysed the performance of SDN by using different performance metrics. We have used the Mininet and POX controller to evaluate the performance analysis in Ubuntu and Windows-based environments. Finally, we have drawn conclusions

We expose the state of the art in the topic of one-way delay measurement in both traditional and software-defined networks. A representative range of standard mechanisms and recent research works, including OpenFlow and Programming Protocol-independent Packet Processors (P4)-based schemes, are covered. We classify them, discuss their advantages and drawbacks, and compare them according to their application environment, accuracy, cost, and robustness. The discussion extends to the reuse of traditional schemes in software-defined networks and the benefits and limitations of the latter with respect to reducing the overhead of network wide measurements. We conclude with a summary of learned lessons and open challenges for future work.

The Internet of Things (IoT) is a key developing innovation aimed at linking objects via the Internet. While, Software Defined Networking (SDN) is another modern network- ing domain intelligence innovation that increases network effi- ciency and enhances security, reliability, and protection through dynamic software programs. In this paper, we proposed a distributed secure SDoT-NFV architecture for smart cities with Network Function Virtualization (NFV) implementation. We integrated highly protected SDN that delivers better network ef- ficiency, protection, and privacy results. It also secures metadata within each layer as well as payload. In addition, this architecture attempted to implement a more efficient method for constructing a cluster via SDN. Moreover, SDN-IoT with the NFV ideas brings benefits in terms of energy conservation and load balancing to the relevant fields. In addition, several distributed controllers have suggested enhancing accessibility, integrity, anonymity, con- fidentiality, and so on. We also implemented an energy-efficient Cluster Head Selection (CHS) algorithm to make use of our proposed architecture. The network offers greater protection of each network layer as opposed to the traditional network in the proposed architecture. Lastly, we analyze the efficiency of the proposed architecture with different network parameters (throughput, RTT, and Time sequence) for smart cities. GUB JOURNAL OF SCIENCE AND ENGINEERING, Vol 7, Dec 2020 P 27-35

2In Software Defined Network based Internet of Things (SDN-IoT), the path selected for forwarding the packets as per rules, should be Quality of Service (QoS) effective. Since SDN based IoT involves dynamic heterogeneous flows, handling caching in terms of rules becomes challenging. Hence in this paper, we propose QoS aware Optimum Path Selection and Rule Caching Policy (QOPS-RCP) for SDN based IoT. In this technique, the optimum path is determined that satisfies the QoS constraints: Rule Caching (RC) cost, packet loss probability and delay. A RC policy is designed that matches the requirements of SDN based IoT architecture such that the cost of RC is minimized. The proposed research methodology is implemented in OpenFlow module and the performance is evaluated in terms of throughput and end-to-end delay.

The industrial ecosystem has been unprecedentedly affected by the COVID-19 pandemic because of its immense contact restrictions. Therefore, the manufacturing and socio-economic operations that require human involvement have significantly intervened since the beginning of the outbreak. As experienced, the social-distancing lesson in the potential new-normal world seems to force stakeholders to encourage the deployment of contactless Industry 4.0 architecture. Thus, human-less or less-human operations to keep these IoT-enabled ecosystems running without interruptions have motivated us to design and demonstrate an intelligent automated framework. In this research, we have proposed "EdgeSDN-I4COVID" architecture for intelligent and efficient management during COVID-19 of the smart industry considering the IoT networks. Moreover, the article presents the SDN-enabled layer, such as data, control, and application, to effectively and automatically monitor the IoT data from a remote location. In addition, the proposed convergence between SDN and NFV provides an efficient control mechanism for managing the IoT sensor data. Besides, it offers robust data integration on the surface and the devices required for Industry 4.0 during the COVID-19 pandemic. Finally, the article justified the above contributions through particular performance evaluations upon appropriate simulation setup and environment.

Проблематика. Принципи побудови і функціонування мереж SDN суттєво відрізняються від традиційних телекомунікаційних мереж. Для визначення чисельних значень показників функціонування такого типу мереж та перевірки їх відповідності вимогам, консорціумом OpenNetworkingFoundation розроблений мережевий емулятор Mininet. Елементи мережевого емулятора є у відкритому доступі. Однак, побудова імітаційної моделі і порядок визначення показників функціонування мережі SDN з використанням Mininet має ряд особливостей,які розглянуті в роботі. Мета дослідження. Створення імітаційної моделі на базі мережевого емулятору Mininet і визначення показників функціонування мереж SDN різної структури. Методика реалізації. Визначення показників функціонування мережі SDN у режимі перевантаження напрямків зв'язку. Результати дослідження. Проведено моделювання мереж SDN складної структури і визначені наступні показники функціонування: RTT (RoundTripTime) для кожного напрямку зв'язку, пропускна здатність гілок і напрямків зв'язку, величина затримки на мережевих елементах, завантаження портів OpenFlowSwitch, елементи мережі з найбільшою затримкою, число обслугованих і втрачених пакетів. Висновки. Використання мережевого емулятора Mininet є досить зручним інструментом для визначення показників функціонування мереж SDN. Однак, є і проблеми. По-перше, налаштування працездатності системи вимагає написання програм для забезпечення взаємодії стандартних елементів з бібліотеками Mininet. По-друге, при виникненні перевантажень в напрямках зв'язку, FloodlightController не забезпечує автоматичного балансування трафіку по обхідним шляхам. Цю задачу доводиться вирішувати в ручному режимі шляхом внесення змін до таблиці маршрутизаціїOpenFlowSwitch. Background. The implementation of the new modern services on existing networks requires replacement or modernization of the old equipment. This negatively affects the efficiency of providing users with new types of services and their cost. Therefore, the issues/tasks of implementing SDN technology in the construction of networks are in the center of attention of representatives of science-research organizations and telecom operators. SDN networks have the advantages of flexible scaling of the system without replacing existing server and network equipment, eliminating operator dependence on specific vendor solutions, and rapid implementation of the new network technologies and services. To determine the numerical values of indicators of the functioning of SDN networks and check their compliance with the requirements, it is proposed to use in working process simulation modelling. For these goals, the Open Networking Foundation consortium developed the Mininet network emulator, the elements of that are published publicly. The formation of the simulation model and the procedure for determining the performance indicators of the SDN network that uses Mininet has a number of features that are considered in the work. Objective. The purpose of the article is to build a simulation model based on the Mininet network emulator and to determine the performance indicators of SDN networks of various structures/topologies. Methods. Creation of a SDN network segment for testing process of its functioning in the overload mode of various communication routes. Results. The Mininet network emulator allows simulating SDN networks of a rather complex structure, change the performance of network branches and the amount of load in communication routes, to create a network-wide overload mode. During the simulation, it is possible to determine a number of indicators of network performance, such as the RTT (Round Trip Time) parameter for each route of communication, the bandwidth of branches and routes of communication, the amount of delay on network elements, loading of OpenFlow Switch ports/interfaces, network elements with the highest delay, the number of served and lost packets. Conclusions. Use of the Mininet network emulator is a fairly convenient tool for determining the performance indicators of SDN networks. However, there are also some problems. First of all, setting up the system's operability requires writing programs to ensure the interaction among standard elements from the Mininet library. Secondone, is when congestion occurs in the communication routes, the Floodlight Controller does not automatically balance traffic along the work-around route. This task has to be solved manually by making changes to the OpenFlow Switch routing tables.

Software defined networks (SDN) creates an environment for designing customized networks based on consumer needs. SDN can effectively apply the decoupling methods on the forwarding plane and the control plane. The SDN controller will forward the traffic information to northbound API and controller obtain the traffic information from openflow virtual switch. SDN routes data and control packets to their destinations based on flow labels, but it lacks protection features to prevent malicious traffic. The SDN environment faces denial of service (DoS) attacks and distribute denial of service attacks, it leads to service unavailability. This paper is mainly focused on dynamically configuring the firewall to identify DoS attacks and decrease malevolent traffic. Virtual networks are simulated using mininet with dynamic access control list rules, and the result show that the suggested solution has improved attack alleviation time bins.

In order to support a variety of Internet of Things (IoT) and smart city applications, it is necessary to provide computing and networking resources at cloud, fog and edge levels. Fortunately, evolution of Network Function Virtualization (NFV) and Software Defined Networking (SDN) technologies are greatly supporting operators to deploy their data centers at reduced expenditures by integrating cloud, fog and edge (Cloud-Fog-Edge) platforms. Although Cloud-Fog-Edge environments provide economic platforms, due to their multi-tenant sharing platforms customer applications could face a variety of security issues in terms of networking and computing resources. For instance, in cloud environments Intrusion Detection Systems (IDS) and authentication mechanisms are useful for enforcing security policies and improving operational security, but internal malicious users can do Address Resolution Protocol (ARP) spoofing attacks by exploiting shared networking environments. Mainly, ARP spoofing attacks could lead to VLAN-ID spoofing, Denial of Service (DoS) and distributed DoS (DDoS), Man in the Middle (MITM) and session hijack attacks in the network. In this work we are proposing a Denial of ARP Spoofing (D-ARPSpoof) approach to prevent ARP spoofing in SDN and NFV enabled Cloud-Fog-Edge platforms. Unlike existing IDS and anomaly detection systems, D-ARPSpoof prevents ARP spoofing attacks by reducing overhead towards the centralized controllers and OpenFlow switches. In this work, D-ARPSpoof performance is compared with recent ARP spoofing mitigation approaches and anomaly detection systems using important metrics like number of successful connections, controller processing messages overhead and number of flow rules installed in OpenFlow switches. In results, we found that in comparison with existing approaches D-ARPSpoof successfully prevents all malicious connections at reduced overhead towards controllers and switches.

Software-defined networking (SDN) has predominantly become the defacto network standard for next generation networking due to its flexibility features; through a single-phase full deployment is unlikely owing to obvious tedious substitution and economic reasons. This has paved the path for hybrid SDN (h-SDN) as a practical alternative with a centralized SDN controller that connects a slow of OpenFlow switches (OFSs) and Legacy switches (LSs). However, such h-SDN imposes fresh challenges since the existing SDN solutions for key functions like topology discovery are rendered futile since LSs do not respond to the controller in the same way OFSs do. State-of-the-art SDN topology protocols, hence, leave out LSs undetected resulting in suboptimal performance. This article presents a novel indirect controller to legacy forwarding (ICLF) scheme that sets out by the controller sending a solitary PACKET_OUT ( P $_{\text{out}}$ ) to an OpenFlow device, which then percolates through the slow of OFSs and LSs; by exploiting the way OFSs and LSs react to the forwarded P $_{\text{out}}$ , the controller can discover the network topology, except for terminal LSs configurations if any. Experiments performed on Mininet shows that the proposed scheme shows an improvement amounted between 34.6%–97.9% in the number of ports detected and reduction in number of messages of about 25%–58.9% under varying degree of legacy device densities, albeit at a slightly overhead of messages forwarded.

OpenFlow discovery protocol (OFDP) is the standard protocol for discovering network topologies for OpenFlow. Each controller generates and receives OFDP messages for each switch to yield a network topology. However, for a network with a large number of switches, the controller may suffer from high overhead to perform OFDP even though the network topology remains unchanged. In this article, we improve the efficiency of network topology discovery by implementing a delegated function in OpenFlow switches. Our mechanism can reduce controller’s overhead for topology discovery to shorten the time of discovering a network topology. It also provides with the interoperability with switches which only perform OFDP. The experimental results demonstrate that the proposed scheme can improve the time for discovering a new network topology by decreasing the number of messages. Our scheme also eliminates unnecessary Packet-Out and Packet-In messages when the network topology remains unchanged. As a result, the controller overhead, including CPU usage and traffic load, is greatly reduced to shorten the response latency of controllers. Hence, the proposed scheme improves the feasibility of achieving scalable OpenFlow networking.

International audience; For audiovisual network operators, end-users satisfaction is a major issue. This is the case for TDF who operates a nationwide network in France whose main purpose is to carry Digital Terrestrial Television streams. Such audiovisual content is forwarded through multicast real-time streams which require continuity of service. Therefore, the main goal of this work is to define a new architecture to prevent impact during network healing time. The proposed architecture aims to use a pair of redundant multicast trees, and ensure their seamless resiliency. This architecture called “Seamless Multicast” takes advantage of the network-end equipment’s ability to receive and combine two identical streams, complete or not. The main contribution of this paper is the development and evaluation of an algorithm for the computation of a pair of multicast trees and the associated hitless deployment scheme. Implementation requires an Software-Defined Networking architecture, in which performance knowledge and bandwidth management are centralized in a controller. A proof of concept controller has been used for validation of the architecture’s global behaviour using a virtualized environment in multiple scenarios.

Network traffic monitoring is vital for enhancing the overall network performance and for optimizing the traffic flows. However, an emerging growth of use in cloud services, internet-of-things, block-chain and data analytics, demand the hardware-based-network-controller to provide more features for expanding network architecture. Therefore, Software Defined Networking (SDN) offers a new solution in terms of scalability, usability and programmable software-based-network-controller for the legacy network infrastructure. In fact, SDN provides a dynamic platform for the network traffic monitoring using international standard. In this study, SDN setup and installation method uses a Mininet emulator containing a controller Ryu with switching hub component, OpenFlow switches, and nodes. The number of nodes is adding until reaches to 16 nodes and evaluated through different network scenarios (single, linear and tree topology). Findings show that the single topology gives a winning criterion compared to other topologies. SDN implementation is measured with performance parameters such as Throughput, Jitter, Bandwidth and Round-Trip Time between scenarios using the Ryu controller. Future research explores on the performance of SDN in larger network and investigates the efficiency and effectiveness of SDN implementation in mesh topology.

Software Defined Networks (SDN) concept reduces the complexity of the traditional network. The decentralization of controlling issues of the traditional networks in SDN increases the popularity of ...

Software-Defined Networking (SDN) continues to be deployed spanning from enterprise data centers to cloud computing with the proliferation of various SDN-enabled hardware switches and dynamic control plane applications. However, state-of-the-art SDN-enabled hardware switches have rather limited downlink message processing capability, especially for Flow-Mod and Statistic Query , which may not suffice the huge need of dynamic control plane applications. In this paper, we systematically study the interactions between the control plane applications and the data plane switches, and present two new attacks, namely Control Plane Reflection Attacks, to exploit the limited processing capability of SDN-enabled hardware switches. The reflection attacks adopt direct and indirect data plane events to force the control plane to issue massive expensive downlink messages towards SDN switches. Moreover, we propose a two-phase probing-triggering attack strategy, which makes the reflection attacks much more efficient and powerful. Experiments on a testbed with 3 different physical OpenFlow switches demonstrate that the attacks can lead to catastrophic results such as hurting the establishment of new flows and even disruption of connection between SDN controller and switches. To mitigate such attacks, we present several countermeasures from different perspectives. In particular, we propose a novel, systematical defense framework, SwitchGuard, to detect anomalies of downlink messages and prioritize these messages based on a novel monitoring granularity, i.e., host-application pair (HAP). Implementations and evaluations demonstrate that SwitchGuard can effectively reduce the latency for legitimate hosts and applications under the control plane reflection attacks with only minor overheads.

One-to-many transfers in a fast and efficient manner are essential to meet the growing need for duplicating, migrating, or sharing bulk data among servers in a datacenter and across geographically distributed datacenters. Some existing works utilize multiple multicast trees for a one-to-many transfer request to increase network link utilization and its transfer throughput. However, since those schemes do not fully utilize the max-flow value of transmission from a single sender to each recipient, there is room for each recipient to retrieve data more quickly. Therefore, assuming fully-controlled networks with full-duplex links, we pose a problem to find a set of multicast flows with an allocation of block-wise transmissions by which each of multiple recipients with diverse max-flow values from the sender can utilize its own max-flow value. Based on that, assuming a sender-side coding capability on file blocks, we design a schedule of block transmissions over multiple phases by which each recipient can achieve a lower-bound of its file retrieval completion time, i.e., the file size divided by its own max-flow value. This paper presents the coded Multipath Multicast (Coded-MPMC) for one-to-many transfers with heuristic procedures to find a desired set of multicast flows on which block transmissions are scheduled. Through extensive simulations on large-scale real-world network topologies and different types of randomly-generated synthetic topologies, the proposed method is shown to design a desired schedule efficiently. A preliminary implementation on OpenFlow is also reported to show the fundamental feasibility of Coded-MPMC.

It is widely recognized that connected vehicles have the potential to further improve the road safety, transportation intelligence and enhance the in-vehicle entertainment. By leveraging the 5G enabled Vehicular Ad hoc NETworks (VANET) technology, which is referred to as 5G-VANET, a flexible software-defined communication can be achieved with ultra-high reliability, low latency, and high capacity. Many enabling applications in 5G-VANET rely on sharing mobile data among vehicles, which is still a challenging issue due to the extremely large data volume and the prohibitive cost of transmitting such data using 5G cellular networks. This article focuses on efficient cooperative data sharing in edge computing assisted 5G-VANET. First, to enable efficient cooperation between cellular communication and Dedicated Short-Range Communication (DSRC), we first propose a software-defined cooperative data sharing architecture in 5G-VANET. The cellular link allows the communications between OpenFlow enabled vehicles and the Controller to collect contextual information, while the DSRC serves as the data plane, enabling cooperative data sharing among adjacent vehicles. Second, we propose a graph theory based algorithm to efficiently solve the data sharing problem, which is formulated as a maximum weighted independent set problem on the constructed conflict graph. Specifically, considering the continuous data sharing, we propose a balanced greedy algorithm, which can make the content distribution more balanced. Furthermore, due to the fixed amount of computing resources allocated to this software-defined cooperative data sharing service, we propose an integer linear programming based decomposition algorithm to make full use of the computing resources. Extensive simulations in NS3 and SUMO demonstrate the superiority and scalability of the proposed software-defined architecture and cooperative data sharing algorithms.

In Software Defined-Content Delivery Networks (SD-CDN), the policies of tenants such as Youtube, Netflix, Office 365, etc. are not the same due to having different 5G traffic requirements for such contents as enhanced Mobile Broadband (eMBB), ultra-reliable low-latency (URLLC) and massive machine-type communication (mMTC). This leads SD-CDN multi-tenant slicing to provide different services with limited network resources, where each tenant can functionally manage their own virtual slice of a physical component according to service level agreements (SLAs). However, they are not permitted to dynamically configure their own components. Therefore, the physical end-to-end configuration of all edge devices causes extra hardware and bandwidth costs. Although software as a service (SaaS) is more preferred to handle cost-efficiency on a switch configuration that increases forwarding throughput (Mbps) with a less number of physical components in SD-CDN, the edge devices can be only served as infrastructure as a service (IaaS) currently. This motivation leads us to serve the switch as a service that includes both IaaS and SaaS characteristics. Therefore, we propose an OpenFlow as a service (OFaaS) design where each tenant has flow management and switch configuration permissions on their own virtual slice. In flow management, we define a novel Service Oriented Architecture (SOA) to orchestrate OFaaS driven topology by isolating each tenant from physical complexity. Here, each tenant can dynamically alter QoS on a flow and load balance between a sub-set of contents via OpenFlow protocol. In switch configuration; a novel OFaaS Management Algorithm for a multi-tenant slicing increases the number of tenants served per OpenFlow switch thanks to OFaaS design. It enables an end-to-end configuration via the NETCONF protocol with a novel YANG model of OFaaS. According to performance evaluation; OFaaS has the same forwarding throughput as conventional IaaS based OpenFlow switch for a homogenous content, whereas it has 71% more forwarding throughput (Mbps) and it has 40% more cost-efficient than conventional one for a heterogeneous content with $17 savings per tenant.

Software Defined Networking (SDN) is a promising technology that provides flexibility, programmability, and network automation by shifting the network intelligence to the logically centralized controller. In SDN architecture, the controller maintains the global view of network topology; therefore the network management is efficient as compared to the traditional networks. Moreover, the cost of SDN devices is less due to the use of open source network operating system instead of proprietary and vendor-specific software. In spite of the flexibility offered by the SDN, OpenFlow enabled switches have a fixed behavior as specified in the datasheet of switch ASIC. They recognize fixed set of header fields according to the support of OpenFlow version. In addition, SDN is suffering from scalability and performance issues because SDN switches heavily dependent on the control plane to forward the packets which increases the data-control communication overhead. To resolve these issues, P4-Programmable data plane switches can be used. The analysis of review articles about SDN suggests insufficient focus on the data plane programmability. Therefore, this paper provides the comprehensive overview of domain-specific language (P4) for the programmability of the data plane. We have discussed the problems in the traditional SDN architecture and then, how these problems can be managed by the data plane programmability. Further, this study critically analyze the research articles based on the P4 programming language for network traffic monitoring, DDoS attack detection, load balancing, and packet aggregation and disaggregation. Finally, we have identified the research gaps and highlighted the open research challenges in the field of data plane programmability for the future directions.

Software-Defined Networking (SDN) is a growing network technology that has brought significant benefits to a wide range of disciplines, from science to technology to various fields. This structure can be used in network-based environments, data centers and various research sites. OpenFlow is one of the most widely used protocols for interaction between a controller and a switch in a Software-Defined Networking. Understanding the performance and limitations of the network defined by open source software, including bottlenecks and security vulnerabilities due to the centralized network structure, are important prerequisites for the efficient deployment of these systems. These points of view led researchers to examine various related mathematical models to address these issues. Queueing theory provides the most important and accurate model for evaluating the performance of the SDN networks affected by these restrictions, which has attracted the attention of researchers recently. Regarding to extensive mathematical modeling, this theory has also been used to improve network efficiency. Researchers have used this theory to investigate operational power and improve time consumption and control of data planes due to the nature of classification and storage of packets in SDN buffers. These methods overcome controller performance bottlenecks and increase SDN control capacity, especially for large distributed networks. In this paper, we examine the queueing models for different applications in different layers of SDN, in which researchers use these methods to monitor network loads, evaluate and predict performance changes due to diversity in network traffic. We introduce and review a collection of articles that explore, different applications of Queueing theory in SDN networks. In addition, in order to increase the efficiency of this research, detailed comparisons are performed in terms of structure, mathematical models and the final simulation results.

Network resource management is one of the key technologies needed to ensure that multiple applications in edge networks provide reliable and stable performance. Although throughput has previously been seen as the primary network performance metric, recent applications do not focus on throughput alone. Instead, Quality of Experience (QoE) is attracting significant attention as an indicator of network resource management performance because it allows a wide variety of applications to be compared within a single metric. In this study, we tackle QoE measurements for a video streaming service as a way to evaluate QoE-based network management. However, there are several problems related to measuring QoE. For example, in-network components are difficult to measure because QoE is normally measured at end-points, and several properties that are deeply related to application settings are required for those calculations. Additionally, the measurements set forth in the International Telecommunication Union’s ITU-T G.1071 standard require a certain duration, which is too long for network resource management evaluations. Therefore, this paper proposes a two-staged in-network QoE estimation method for video flows that can resolve these issues. In the first stage, we focus on producing a fast and rough QoE estimate to start forwarding the arriving flow onto an appropriate route as soon as possible. Next, the second stage is designed to produce precise QoE estimations based on careful long-duration measurements. In both stages, the proposed method uses a parameter estimation process that converts in-network information to end-point information for QoE calculations by following ITU-T G. 1071 and corrects measurement errors reducing QoE calculation errors to the greatest extent possible. Through experimental evaluations, we then demonstrate that the QoEs of all flows can be maximized by selecting appropriate routes based on the predicted QoE at the first stage, and that the accuracy of the QoE estimation at the second stage can be improved in real-time even when packet losses occur.

OpenFlow implements flow-based control over switches with improved network management performance. However, a packet may match more than one flow entry due to the intra-table dependency phenomenon among flow entries. Moreover, different packets may incur different conflicting flow entries under the intra-table dependency. Forwarding packets by the first-match scheme for prioritized flow entries may not always produce the best outcome. Thus, an online conflict detection procedure executed for each incoming packet is needed to flag the conflicts to network administrators. In addition, the SDN controller may frequently update the service provisioning policies that are specified in the flow entries and deliver them to the switches in a large OpenFlow-based environment. This needs a high-performance conflict detection mechanism to support real-time updating. However, performing conflict detection within a large flow table will be very time consuming. This paper first develops a graph-based multilevel redundancy reduction scheme to construct highly compact matching trees that will be used in conflict detection for a large flow table. Then, a conflict detection algorithm with higher performance and lower cost, the Compact Bit Vector algorithm (CBV), is proposed. The performance of the CBV has been validated through an extensive mathematical performance analysis followed by simulations, with good results in terms of requiring less time for the search, lower memory requirement and lower incremental updating time. Obviously, the CBV is very suitable for the conflict detection task of a large and frequently updated flow table.

SDN enables a new networking paradigm probable to improve system efficiency where complex networks are easily managed and controlled. SDN allows network virtualization and advance programmability for customizing the behaviour of networking devices with user defined features even at run time. SDN separates network control and data planes. Intelligently controlled network management and operation, such that routing is eliminated from forwarding elements (switches) while shifting the routing logic in a centralized module named SDN Controller. Mininet is Linux based network emulator which is cost effective for implementing SDN having in built support of OpenFlow switches. This paper presents practical implementation of Mininet with ns-3 using Wi-Fi. Previous results reported in literature were limited upto 512 nodes in Mininet. Tests are conducted in Mininet by varying number of nodes in two distinct scenarios based on scalability and resource capabilities of the host system. We presented a low cost and reliable method allowing scalability with authenticity of results in real time environment. Simulation results show a marked improvement in time required for creating a topology designed for 3 nodes with powerful resources i.e. only 0.077 sec and 4.512 sec with limited resources, however with 2047 nodes required time is 1623.547 sec for powerful resources and 4615.115 sec with less capable resources respectively.

© Copyright 2021, A. O. Nyanteh et al. Software-Defined Networking (SDN) is an innovative technology which provides a programmable network control which is decoupled from the physical infrastructure. Network Virtualization (NV) is the phenomenon where a given physical network infrastructure and its resources are abstracted to create multiple logical virtual network slices of the underlying substrate. NV enables independent virtual networks to co-exist on one or more shared physical network infrastructure. Edge computing makes use of the edge resources in close proximity to end-users to reduce service delay and the network traffic volume in the end-to-end networks. Similarly, network slicing which is a key enabling technology for 5G networks is designed to support different services from different platforms at different scales enables sharing of physical network infrastructure on many different virtual network layers. These innovative technologies and strategies have gained significant attention from both academia and industry as they have the potential to maximize network resource utilization and optimize end–to–end network service delivery in 5G solutions deployment. To enable continuous simulation and development of applicable 5G networking concepts using these technologies, there is a need for an accessible and easy-to-learn testbed which is able to efficiently measure the performance of physical and virtual network capacities, provisioning approaches and management of multiple architectural models using large-scale network slicing configurations in a repeatable and controllable manner. These tools and toolkits provide scalable, lightweight and controlled cloud simulation environments necessary to analyse network traffic flows, allocation capacities and policies and the behaviour of multiple heterogeneous networks at an extremely low cost as compared to the huge financial commitments involved in conducting similar experiments in a real-life event. Existing solutions do not support Network Slicing and end- to -end heterogenous network automation which are key enablers of 5G network implementation. Hence in this paper, the CloudSimHypervisor framework is developed in this based on CloudSimSDN-NFV. The complete architecture and features of the CloudSimHypervisor framework and some used cases are presented in this paper. We validate the CloudSimHypervisor framework with two use case experiments in the cloud computing environment: Joint compute and network resource utilization and network traffic prioritization. Results from these experiments display the efficiency of the CloudSimHypervisor in estimating and measuring processing speed, transmission speed, compute and network usage efficiency and energy consumption.

Scalable Video Coding (SVC) is a promising coding technique that enables flexible video transmission to support heterogeneous devices. However, the current best-effort delivery model characterized by the Internet cannot fully exploit the scalability feature of SVC because the network nodes are transparent for multimedia streaming applications. Software-defined networking (SDN) has emerged as an innovative network paradigm that decouples the control and forwarding planes while routing. This architecture with the OpenFlow protocol enables network operators to obtain per-flow QoS control in a more scalable, flexible, and finely granular manner compared to the conventional network architecture. Inspired by these facts, this paper designs a comprehensive QoS-aware multicast scheme for scalable video streaming over SDN networks. First, we present the designed multimedia streaming multicast system architecture and formulate the QoS-aware multicast routing problem as a non-linear programming model. We then propose a fundamental tree construction algorithm that decomposes the video streaming requests into subrequests and serves them in a bottom-up manner. Furthermore, we design a layer switching strategy based on the video distortion model to mitigate network-induced video quality distortion. Finally, the experimental results are presented to validate the performance of our methods in terms of scalability, network utility, video playout quality, and playback interruption ratio.

Industrial Cyber-Physical Systems (CPSs) require flexible and tolerant communication networks to overcome commonly occurring security problems and denial-of-service such as links failure and networks congestion that might be due to direct or indirect network attacks. In this work, we take advantage of Software-defined networking (SDN) as an important networking paradigm that provide real-time fault resilience since it is capable of global network visibility and programmability. We consider OpenFlow as an SDN protocol that enables interaction between the SDN controller and forwarding plane of network devices. We employ multiple machine learning algorithms to enhance the decision making in the SDN controller. Integrating machine learning with network resilience solutions can effectively address the challenge of predicting and classifying network traffic and thus, providing real-time network resilience and higher security level. The aim is to address network resilience by proposing an intelligent recommender system that recommends paths in real-time based on predicting link failures and network congestions. We use statistical data of the network such as link propagation delay, the number of packets/bytes received and transmitted by each OpenFlow switch on a specific port. Different state-of-art machine learning models has been implemented such as logistic regression, K-nearest neighbors, support vector machine, and decision tree to train these models in normal state, links failure and congestion conditions. The models are evaluated on the Mininet emulation testbed and provide accuracies ranging from around 91–99% on the test data. The machine learning model with the highest accuracy is utilized in the intelligent recommender system of the SDN controller which helps in selecting resilient paths to achieve a better security and quality-of-service in the network. This real-time recommender system helps the controller to take reactive measures to improve network resilience and security by avoiding faulty paths during path discovery and establishment.

Smart city is a transformative and progressive vision that aims to revolutionize infrastructure systems and public services in an urban area with modern information technologies. Its ultimate goal is to greatly improve the livability Quality of Service (QoS) of its citizens and to optimize the utilization of its assets and natural resources sustainably. One of the key technical attributes in smart cities is to deploy a large number of sensors to collect data to enable real-time and intelligent decisions for various city functions and citizen needs. Many of the data have strict security requirements as they are either private to citizens or sensitive to critical infrastructures. As a result, how to securely and efficiently deliver and process the dramatically increasing volume of data becomes one of the grand challenges in materializing the smart city vision. In recent years, Software-Defined Networking (SDN) has emerged as a leading communication infrastructure candidate for smart cities. While many efforts have existed to research, prototype, and even deploy SDN on a small scale for some smart city applications, there is still a lack of cohesive understanding about SDN’s impact on the secure communication need of smart cities. In this paper, we conduct a comprehensive survey of the core functionality of SDN from the perspective of secure communication infrastructure at different scales. A specific focus is put on the security threats and challenges in accordance with SDN plane-based architectures for various smart city-enabled applications. We further systematically categorize the state-of-art solutions and proposals to apply SDN to support typical smart city applications, such as transportation, health, and energy applications. Lastly, we cast a holistic view of future research trends.

Nowadays, the increase in the number of mobile users and cellular traffic leads to new challenges in the fifth-generation (5G) of cellular networks. The increase in the demand for high data rates brings challenges like scalability and flexibility in the 5G network. Software-defined networking (SDN) is a network paradigm that separates the control plane and data plane in the network and ease the management of the network. In this work, an SDN based 5G core architecture is proposed, in order to introduce flexibility and ease of management in the network. Another benefit of using SDN is to make the network vendor-independent. Furthermore, the explanation of initial attachment and handover procedures in the proposed architecture is provided. A network simulator is built to evaluate the performance of proposed architecture, in terms of end-to-end delay, throughput and resource utilization of controller, under different network factors. A performance comparison, in terms of end-to-end delay, between proposed SDN based 5G architecture and traditional 5G architecture is provided. Results show that the proposed architecture provides 18% to 62% less end-to-end delay, under different factors for different procedures, compared to the traditional 5G architecture. A comparison with previous works is also provided, which indicates similar trends in delay between our work and previous studies.

Core wavelength division multiplexed (WDM) networks are widely used to provide fixed physical connectivity and bandwidth to the logically connected upper electronic layer devices using optical signals. However, growing demands for bandwidth-intensive applications and cloud-based services push optical networks carriers’ to provide scalable and flexible services dynamically. Software defined networking (SDN) has the potential to program electronic layers by dynamically controlling and managing network resources using SDN controller applications. SDN’s on-demand characteristics combined with the optical circuit-switching can enable optical network service providers to customize their service provisioning dynamically to the user’s requirements. They enable fast provision of new services, and minimize under-utilization of resources. In this paper, a model is proposed to bring the dynamic allocation of resources which is a layer 2+ functionality, to the WDM layer using SDN. A middle-ware application based on SDN and OpenFlow for dynamic switching and provisioning of optical service is presented. The application abstracts the optical layer’s connectivity, also accounting for the switching constraints. Details of the model’s implementation are discussed considering classically used equipment and its performance in terms of CPU and memory utilization, topology emulation time, and latency is evaluated. Finally, the application is tested with a Cisco layer one switch. Performance results show that the latency doubles when increasing the number of fibers of an optical cross connect from 5 to 7 and keeping wavelengths equal to 8, with Clos fabric topology.

The SDN controller uses the OpenFlow Discovery Protocol (OFDP) to collect network topology status. OFDP detects the link between OpenFlow switches by generating Link Layer Discovery Protocol (LLDP) packets. However, OFDP is not a completely secure protocol and can be used by attackers to perform topology discovery injection attacks, topology discovery man-in-the-middle attacks, and topology discovery flood attacks, thereby confusing the network topology. This paper proposes a Correlation-based Topology Anomaly Detection (CTAD) mechanism to run in a software-defined network controller. Spearman’s rank correlation is used to analyze the correlation between network traffic between links and measure the time difference between the round trip time of each LLDP frame to determine whether the topology man-in-the-middle attack exists in the network. This paper also adds a dynamic authentication key and counting mechanism in the LLDP frame to prevent attackers from using the topology discovery injection attack to generate fake links and topology discovery flooding attacks, causing network routing or switching abnormalities.

Software-defined networking (SDN) is an emerging technology of efficiently controlling and managing computer networks, such as in data centres, wide-area networks, as well as in ubiquitous communication. In this study, the authors explore the idea of embedding the SDN components, represented by SDN controller and virtual switch, in end-hosts to improve network performance. In particular, the authors consider load balancing across multiple network interfaces on end-hosts with different link capacity scenarios. The authors have explored and implemented different SDN-based load-balancing approaches based on OpenFlow software switches, and have demonstrated the feasibility and the potential of this approach. The proposed system has been evaluated with MultiPath transmission control protocol (MPTCP). The proposed results demonstrated the potential of applying the SDN concepts on multi-homed devices resulting in an increase in achieved throughput of 55% compared to the legacy single network approach and 10% compared to the MPTCP.

Recent developments in networking include the interest in software‐defined networking, in which OpenFlow switches are in charge of forwarding traffic by matching incoming packets with forwarding rules in their flow tables. Flow tables are commonly implemented in ternary content addressable memories (TCAMs). Typically, this type of memory tends to be extremely expensive and to be power‐hungry devices. The price and power dissipation of TCAM depend on the capacity of the memory. A blind design of memory size can result in dramatic degradation in performance and power efficiency of the entire network. In this study, the authors clarify this impact and show how the optimum value of TCAM capacity is attainable. They also propose a power consumption model for TCAM‐based OpenFlow switches. Simulation results show that the proposed solution reduces the average power consumption by 24% compared to the minimum link on method and by 11.5% compared to the minimum node on (MNO) method and thus power efficiency is better achieved when each memory is supplied by appropriate TCAM size.

Link Flooding Attack (LFA) is a genre of Distributed Denial of Service (DDoS) attack. LFA can cut off a target area from the network, without directly attacking the target. The attacker chooses links which when cut off will disconnect the target area and instruct the bots to flood those links with small packets. Some of the existing solutions are suitable for specific routing methods like shortest path routing or need cooperation between Autonomous Systems (AS). To overcome certain hitches of existing solutions, we have proposed a novel mechanism named BALANCE. It detects and mitigates LFA via hybrid-Software-Defined Network (SDN). SDN splits the control and data plane using OpenFlow protocol. Hybrid SDN has both legacy and SDN nodes, with a controller in the control plane. We have used Service Based Hybrid SDN (SBHS), which is a type of hybrid-SDN. BALANCE begins with an algorithm that chooses nodes in an AS to be SBHS enabled in such a way that the controller can get statistics of all the links in the AS. Next, congestion detection and location algorithms are implemented in the controller to find the congested links. Finally, LFA bot detection and mitigation algorithms are implemented in the controller to mitigate LFA. BALANCE was evaluated in testbed and emulator. We compared the results with state-of-the-art solutions. BALANCE was able to detect LFA bots at a precision of 97.64% and had HTTP response time of 2 seconds during the LFA attack.

Packet classification is a key factor for choosing proper action for incoming packet and has to be done fast and effectively, especially in OpenFlow. But OpenFlow vSwitch technology doesn’t always allow to use some fast hardware technology for packet classification like TCAM (Ternary Content Addressable Memory). Instead of TCAM, decision tree methods are preferred solutions for fast classification in OpenFlow vSwitch in the literature. But most of these methods can cause the rule replication problem. As a result, while the duration of packet classification decreases, rule update duration increases. There are also rule partitioning methods in the literature to solve this problem, but the running time of these methods mostly depends on the number of rule fields. Also, some of these solutions don’t overcome the rule replication problem. At that point, the main question of this letter is that how can we make the rule partitioning fast by both preventing the rule replication and allowing fast packet classification and rule update in OpenFlow vSwitch? To solve the rule partitioning problem, we propose a greedy based interval partitioning strategy. Here, the running time of the partitioning algorithm only depends on the rule number. After partitioning, we propose to use HyperCuts to construct decision trees for fast packet classification and rule update. According to performance evaluation results, we do the rule partitioning and rule updates faster than the PartitonSort method with the percentage of 88, 15, respectively. Also, we classify packet faster than the TupleMerge method with the percentage of 40 for online and 50 for offline scenarios.