Search

With the rapid development of network technologies, many new technologies, such as Software Defined Network (SDN), are applied to firewalls to manage network security. However, current SDN firewalls cannot automatically change security policies according to dynamic network status or deploy personalized policy based on user identities. In this paper, we design a special SDN switch that incorporates a traffic acquisition module and a data analysis module. According to the traffic patterns caused by different user behaviors, the proposed switch could recognize the user identities by statistical analysis and clustering analysis, and automatically deploy corresponding network policies. Experiments conducted over an OpenvSwitch showed the proposed SDN switch could accurately identify three kinds of users and apply respective flow tables successfully.

Since the current SDN southbound interface level is low and programming situation is complex, it requires a high-level abstract programming language to simplify programming. First, this paper improves the NetCore programming language to generate NetCore-M language, so that it can support deployment of multi-policies combination including packet drop action. This paper describes in detail the syntax, semanteme, and implementation of NetCore-M language. Secondly, this paper describes the network policy conflict systematically and solves it. Finally, this paper shows that the modified multi-policies combination algorithm can effectively detect and prompt policies conflicts based on the implementation of the Pyretic project.

Summary Through network programmability, software defined network can simplify network control and management. Since the current software defined network southbound interface level is low and programming situation is complex, it requires a high-level abstract programming language to simplify programming. First, this paper improves the NetCore programming language to generate NetCore-M language, so that it can support deployment of multipolicies combination including packet drop action. This paper describes in detail the syntax, semanteme, and implementation of NetCore-M language forwarding policy service. Secondly, this paper describes the network policy conflict systematically. Finally, this paper shows that the modified multipolicies combination algorithm can effectively detect policies conflicts based on the implementation of the Pyretic project.