Search

Research has proved that supposedly secure encrypted network traffic is actually threatened by privacy and security violations from many aspects. This is mainly due to flow features leaking evidence about user activity and data content. Currently, adversaries can use statistical traffic analysis to create classifiers for network applications and infer users’ sensitive data. In this article, we propose a system that optimally prevents traffic feature leaks. In our first algorithm, we model the packet length probability distribution of the source app to be protected and that of the target app that the source app will resemble. We define a model that mutates the packet lengths of a source app to those lengths from the target app having similar bin probability. This would confuse a classifier by identifying a mutated source app as the target app. In our second obfuscation algorithm, we present an optimized scheme resulting in a trade-off between privacy and complexity overhead. For this reason, we propose a mathematical model for network obfuscation. We formulate analytically the problem of selecting the target app and the length from the target app to mutate to. Then, we propose an algorithm to solve it dynamically. Extensive evaluation of the proposed models, on real app traffic traces, shows significant obfuscation efficiency with relatively acceptable overhead. We were able to reduce a classification accuracy from 91.1% to 0.22% using the first algorithm, with 11.86% padding overhead. The same classification accuracy was reduced to 1.76% with only 0.73% overhead using the second algorithm.

It has been well established that the Internet of Things will bring an expansion in traffic volume and types. This will bring new challenges in terms of Quality of Service (QoS) and security, requiring innovative traffic management techniques. Traffic classification is a main network function that helps in managing both QoS and security. Different machine learning based methods have been applied for this aim. However, traditional machine learning methods rely on hand crafted features, limiting the model ability to learn. Deep Learning (DL), a branch of machine learning, is characterized by its representation learning ability. In this paper, we analyse two methods of data representation for DL-based classification: a raw packet-based representation and a quasi-raw flow-based representation. Different tests are performed to evaluate the robustness of these data representation methods. The tests include features’ importance, model robustness, and anonymization tests. The results show that raw data representation suffers from traffic anonymization and the fact that many packet fields are data-dependent. On the other hand, the flow-based representation is sensitive to the number of packets used for classification and to traffic obfuscation.

Traffic classification acquired the interest of the Internet community early on. Different approaches have been proposed to classify Internet traffic to manage both security and Quality of Service (QoS). However, traditional classification approaches consisting of modifying the Transmission Control Protocol/Internet Protocol (TCP/IP) scheme have not been adopted due to their complex management. In addition, port-based methods and deep packet inspection have limitations in dealing with new traffic characteristics (e.g., dynamic port allocation, tunneling, encryption). Conversely, machine learning (ML) solutions effectively classify traffic down to the device type and specific user action. Another research direction aims to anonymize Internet traffic and thwart classification to maintain user privacy. Existing traffic surveys focus on classification and do not consider anonymization. Here, we review the Internet traffic classification and obfuscation techniques, largely considering the ML-based solutions. In addition, this paper presents a comprehensive review of various data representation methods, and the different objectives of Internet traffic classification. Finally, we present the key findings, limitations, and recommendations for future research.

Crowdsourcing is the process of obtaining input or enlisting the services of a crowd of people with the aim of finding the best solution to a proposed problem. The method with which the collected input is aggregated affects the outcome of the crowdsourcing process. In this paper, we introduce a modelling framework through which we compare several aggregation methods for crowdsourcing systems. The work reveals a surprising result where confidence-related approaches lack in performance when compared to other approaches such as simple plurality voting or approaches which consider respondent competence. This inadequacy stems from a psychological phenomenon brought forth by David Dunning and Justin Kruger related to people’s bias in assessing their own cognitive abilities.

The search for better networking paradigms has fostered the emergence of Software Defined Networking (SDN), which allows the decoupling of the data plane from the control plane and to configure the...

Mobile ads are plagued with fraudulent clicks which is a major challenge for the advertising community. Although popular ad networks use many techniques to detect click fraud, they do not protect the client from possible collusion between publishers and ad networks. In addition, ad networks are not able to monitor the user’s activity for click fraud detection once they are redirected to the advertising site after clicking the ad. We propose a new crowdsource-based system called Click Fraud Crowdsourcing (CFC) that collaborates with both advertisers and ad networks in order to protect both parties from any possible click fraudulent acts. The system benefits from both a global view, where it gathers multiple ad requests corresponding to different ad network-publisher-advertiser combinations, and a local view, where it is able to track the users’ engagement in each advertising website. The results demonstrated that our approach offers a lower false positive rate (0.1) when detecting click fraud as opposed to proposed solutions in the literature, while maintaining a high true positive rate (0.9). Furthermore, we propose a new mobile ad charging model that benefits from our system to charge advertisers based on the duration spent in the advertiser’s website.

Statistical traffic analysis has absolutely exposed the privacy of supposedly secure network traffic, proving that encryption is not effective anymore. In this work, we present an optimal countermeasure to prevent an adversary from inferring users’ online activities, using traffic analysis. First, we formulate analytically a constrained optimization problem to maximize network traffic obfuscation while minimizing overhead costs. Then, we provide OPriv, a practical and efficient algorithm to solve dynamically the non-linear programming (NLP) problem, using Cplex optimization. Our heuristic algorithm selects target applications to mutate to and the corresponding packet length, and subsequently decreases the security risks of statistical traffic analysis attacks. Furthermore, we develop an analytical model to measure the obfuscation system’s resilience to traffic analysis attacks. We suggest information theoretic metrics for quantitative privacy measurement, using entropy. The full privacy protection of OPriv is assessed through our new metrics, and then through extensive simulations on real-world data traces. We show that our algorithm achieves strong privacy protection in terms of traffic flow information without impacting the network performance. We are able to reduce the accuracy of a classifier from 91.1% to 1.42% with only 0.17% padding overhead.

Security is one of the principle concerns confronting the improvement of new networking and communications systems. Another challenge is to verify network consistency, such that it is functioning precisely as planned. On the other hand, propels in Artificial Intelligence (AI) innovation are expected to play a key role in offensive and defensive measures to ensure a fast reaction to respond to the landscape of developing threats. Software Defined Networking (SDN), being centralized by design, offers a global perspective of the network. Adaptability and robustness are part of a package offered by programmable networking, which drove us to consider the integration between both AI and SDN. The hybrid security techniques, inspired by the fascinating tactics of the human immunity system, directed the design of our general hybrid Artificial Intelligence Resiliency System (ARS). ARS aims to strikes a good balance between centralized and distributed security techniques that may be applicable to various network environments. Another objective is to investigate and leverage the state-of-the-art AI techniques to enhance network performance in general and resiliency in particular. A second objective of ARS is network consistency verification as a resiliency measurement alongside our security system. Throughout this work we discuss a new architecture that integrates both, a multilayer layer security and consistency establishment techniques, while preserving data privacy. Our results show, on one hand, the architecture tests along with the accuracy of multiple AI techniques for both security layers, and on the other hand, the attack mitigation and consistency tests. Finally, we propose a new distributed AI based security enforcement technique based on a state-of-the-art distributed Neural Network overlay.

Research community has been highlighting recently security issues related to network traffic analysis. Using machine learning techniques, an eavesdropper can exploit traffic features to determine useful information threatening privacy of users. In this paper, we propose an efficient defense against network fingerprinting attacks where we obfuscate information leaked by traffic features specifically packet sizes. First, we model the packet lengths probability distribution of the source app to be protected and that of the target app that the source app will resemble. Then, we define a security model that mutates the packet lengths of a source app to those lengths from the target app having similar bin probability. This would confuse a classifier and make it identify a mutated source app as the target app. A comprehensive simulation study of the proposed model, using real apps traffic traces, shows considerable obfuscation efficiency with relatively acceptable overhead. We were able to reduce a classification accuracy of 91.1% to 0.22% using the proposed algorithm, with only 11.86% padding overhead.

Recently, there has been an increasing interest in the Internet of Things (IoT). While some analysts disvalue the IoT hype, several technology leaders, governments, and researchers are putting serious efforts to develop solutions enabling wide IoT deployment. Thus, the huge amount of generated data, the high network scale, the security and privacy concerns, the new requirements in terms of QoS, and the heterogeneity in this ubiquitous network of networks make its implementation a very challenging task. SDN, a new networking paradigm, has revealed its usefulness in reducing the management complexities in today's networks. Additionally, SDN, having a global view of the network, has presented effective security solutions. On the other hand, fog computing, a new data service platform, consists of pushing the data to the network edge reducing the cost (in terms of bandwidth consumption and high latency) of “big data” transportation through the core network. In this paper, we critically review the SDN and fog computing-based solutions to overcome the IoT main challenges, highlighting their advantages, and exposing their weaknesses. Thus, we make recommendations at the end of this paper for the upcoming research work.

Advanced metering infrastructures (AMIs) enable two-way communications between the utility and customers opening up opportunities for an efficient and reliable smart grid. This, however, opens up the grid to a vast amount of attack vectors and intruders. Therefore, cyber security is an indispensable part of the smart grid communications’ infrastructure and must be considered in the early phases of planning. The achievement of a secure grid infrastructure requires cryptographic primitives whose strength is dependent on the utilized keys, raising the need for secure key generation/distribution mechanisms. Furthermore, the underlying security mechanisms should be scalable due to the large AMI network sizes. In this paper, we propose the usage of identity-based-cryptography as the basic block of the key distribution mechanism to generate secret keys between neighboring smart meters in a non-interactive manner. Physical unclonable functions are proposed on the hardware platform to eliminate key compromise at the hardware level. We also propose a secure mechanism for updating private keys that are utilized as a seed within the identity-based cryptosystem. A lightweight key delivery mechanism exploiting multicast network features is presented along with a new authentication algorithm for the updated keys. Hardware tests are performed on a Cortex M3-based microcontroller to mimic smart meters’ processors and assess the feasibility of the proposed key authentication. Experiments conducted on a network simulator validate the feasibility of the proposed methodology indicating key delivery latency reduction up to 80% and network traffic reduction up to 27%.

Purpose The purpose of this paper is to present an approach to reduce energy consumption in data centers. Subsequently, it reduces electricity bills and carbon dioxide footprints resulting from their use. Design/methodology/approach The authors present a mathematical model of the energy dissipation optimization problem. The authors formulate analytically the server selection problem and the supply air temperature as a non-linear programming, and propose an algorithm to solve it dynamically. Findings A simulation study on SimWare, using real workload traces, shows considerable savings for different data center sizes and utilization rates as compared to three other classic algorithms. The results prove that the proposed algorithm is efficient in handling the energy-performance trade-off, and that the proposed algorithm provides significant energy savings and maintains a relatively homogenous and stable thermal state at the different rack units in the data center. Originality/value The proposed algorithm ensures energy provisioning, performance optimization over existing state-of-the-art heuristics, and on-demand workload allocation.

Network operators and mobile carriers are facing serious security challenges caused by an increasing number of services provided by smartphone Apps. For example, Android OS has more than 1 million Apps in stores. Hence, network administrators tend to adopt strict policies to secure their infrastructure. The aim of this study is to propose an efficient framework that has a classification component based on traffic analysis of Android Apps. The framework differs from other proposed studies by focusing on identifying Apps traffic from a network perspective without introducing any overhead on subscribers smartphones. Additionally, it involves a technique for pre-processing network flows generated by Apps to acquire a set of features that are used to build an identification model using machine learning algorithms. The classification model is built using classification ensembles. A group of chosen users contribute in training the classification model, which learns the normal behavior of selected Apps. Eventually, the model should be able to detect abnormal behavior of similar Apps across the network. A 93.78% classification accuracy is achieved with a low false positive rate under 0.5%. In addition, the framework is able to detect abnormal flows of unknown classes by implementing an outlier detection mechanism and reported a 94% accuracy.

We propose a new multiplier design that fulfills the need for low-power circuit blocks used in error-tolerant applications on energy-constrained devices. The design trades accuracy for higher speed, lower energy consumption, and lower transistor count. The average relative error of an N-bit multiplier is modeled as a function of N and saturates at a constant (around 17%) as the multiplier width increases. An 8-bit implementation simulated in HSPICE achieved almost 90% energy savings for a random sample of operands as compared to a conventional parallel multiplier. The design is flexible whereby simple variations to the circuit structure lead to a perfectly accurate multiplier. Tests performed on multimedia applications such as JPEG compression showed a promising outcome.

Evolved Packet System (EPS) was designed to be an umbrella technology for next generation LTE wireless networks. The enhanced data rates, innovative core architecture, and improved security mechanisms motivate operators and vendors to invest in the LTE technology that is intended to stay for the long term. The Authentication and Key Agreement protocol in EPS has a privacy-breaching vulnerability that is considered too expensive to solve. Previously, attackers were not able to locate precisely the users who are trying to connect to a network because the area covered by the monitored cell is in terms of kilometers squared. Currently, with the increase in the use of femtocells and the decreasing cost of attack equipment, the above hypothesis fails, and the expected rate of attacks exploiting this vulnerability increases. In this paper, we propose a new protocol to solve these privacy concerns, compare it to other solutions, and verify its security using the AVISPA tool.

International audience; Traffic classification is key for managing both QoS and security in the Internet of Things (IoT). However, new traffic obfuscation techniques have been developed to thwart classification. Traffic mutation is one such obfuscation technique, that consists of modifying the flow’s statistical characteristics to mislead the traffic classifier. In fact, this same technique can also be used to hide normal traffic characteristics for the sake of privacy. However, the concern is its use by attackers to bypass intrusion detection systems by modifying the attack traffic characteristics. In this paper, we propose an unsupervised Deep Learning (DL)-based model to detect mutated traffic. This model is based on generative DL architectures, namely Autoencoders (AE) and Generative Adversarial Network (GAN). This model consists of a denoising AE to de-anonymize the mutated traffic and a discriminator to detect it. The implementation results show that the traffic can be denoised when different mutation techniques are applied with a reconstruction error less than $$10^{-1}$$. In addition, the detection rate of fake traffic reaches 83.7%.

Current implementations of mobile apps offer limited security assurances against traffic analysis. Encryption is not effective in hiding particular patterns within packets that can be used as side-channel information to classify specific apps. What we need is an anonymity system that ensures strong security with acceptable computational overhead and latency for interactive app usage. Recently, we undertook this problem by mutating an app traffic that we try to defend so that it resembles the traffic of another app. Our goal in this paper is to develop a simpler and more scalable system to anonymize mobile app packet traffic without the need of another app’s model traffic. This could happen using probabilistic distribution of packet sizes. We propose first a scheme that regenerates statistical modeling of app packet lengths. Then, we present a privacy preserving technique that implements defense against traffic analysis and confines the incurred overhead by mutation of packet lengths of the incoming traffic to the regenerated ones. Experiments show that using this confusion technique, we are able to reduce 91.1% classification accuracy to 0.9% with only 12.51% overhead. On the other hand, we demonstrate a second technique for anonymization where we thwart traffic analysis of mobile app traffic by modifying its packet sizes probability distribution to another dissimilar distribution.

In this paper, the authors provide a detailed overview and technical discussion and analysis of the latest research trends in securing body sensor networks. The core of this work aims at: (1) identifying the resource limitations and energy challenges of this category of wireless sensor networks, (2) considering the life-critical applications and emergency contexts that are encompassed by body sensor network services, and (3) studying the effect of these peculiarities on the design and implementation of rigorous and efficient security algorithms and protocols. The survey discusses the main advancements in the design of body sensor network cryptographic services (key generation and management, authentication, confidentiality, integrity, and privacy) and sheds the light on the prominent developments achieved in the field of securing body sensor network data in Cloud computing architectures. The elastic virtualization mechanisms employed in the Cloud, as well as the lucrative computing and storage resources available, makes the integration of body sensor network applications, and Cloud platforms a natural choice that is packed with various security and privacy challenges. The work presented in this paper focuses on Cloud privacy and integrity mechanisms that rely on tamper-proof hardware and energy-efficient cryptographic data structures that are proving to be well-suited for operation in untrusted Cloud environments. This paper also examines two crucial design patterns that lie at the crux of any successful body sensor network deployment which are represented in: (1) attaining the right balance between the degree, complexity, span, and strength of the cryptographic operations employed and the energy resources they consume. (2) Achieving a feasible tradeoff between the privacy of the human subject wearing the body sensor network and the safety of this subject. This is done by a careful analysis of the medical status of the subject and other context-related information to control the degree of disclosure of sensitive medical data. The paper concludes by presenting a practical overview of the cryptographic support in the main body sensor network development frameworks such and TinyOS and SPINE and introduces a set of generalized guideline patterns and recommendations for designing and implementing cryptographic protocols in body sensor network environments.

Recommender systems have become quite popular recently. However, such systems are vulnerable to several types of attacks that target user ratings. One such attack is the Sybil attack where an entity masquerades as several identities with the intention of diverting user ratings. In this work, we propose classical and spatial evolutionary game theory as possible solutions to the Sybil attack in recommender systems. We model the attack using the two techniques and use replicator dynamics in the classical model to solve for evolutionary stable strategies. Results from both models agree that under conditions that are easily achievable by a system administrator, the probability of an attack strategy drops to zero implying degraded fitness for Sybils that eventually die out.

In this paper, the authors provide a detailed overview and technical discussion and analysis of the latest research trends in securing body sensor networks. The core of this work aims at: (1) identifying the resource limitations and energy challenges of this category of wireless sensor networks, (2) considering the life-critical applications and emergency contexts that are encompassed by body sensor network services, and (3) studying the effect of these peculiarities on the design and implementation of rigorous and efficient security algorithms and protocols. The survey discusses the main advancements in the design of body sensor network cryptographic services (key generation and management, authentication, confidentiality, integrity, and privacy) and sheds the light on the prominent developments achieved in the field of securing body sensor network data in Cloud computing architectures. The elastic virtualization mechanisms employed in the Cloud, as well as the lucrative computing and storage resources available, makes the integration of body sensor network applications, and Cloud platforms a natural choice that is packed with various security and privacy challenges. The work presented in this paper focuses on Cloud privacy and integrity mechanisms that rely on tamper-proof hardware and energy-efficient cryptographic data structures that are proving to be well-suited for operation in untrusted Cloud environments. This paper also examines two crucial design patterns that lie at the crux of any successful body sensor network deployment which are represented in: (1) attaining the right balance between the degree, complexity, span, and strength of the cryptographic operations employed and the energy resources they consume. (2) Achieving a feasible tradeoff between the privacy of the human subject wearing the body sensor network and the safety of this subject. This is done by a careful analysis of the medical status of the subject and other context-related information to control the degree of disclosure of sensitive medical data. The paper concludes by presenting a practical overview of the cryptographic support in the main body sensor network development frameworks such and TinyOS and SPINE and introduces a set of generalized guideline patterns and recommendations for designing and implementing cryptographic protocols in body sensor network environments.

In recent years, mobile advertising has gained popularity as a mean for publishers to monetize their free applications. One of the main concerns in the in-app advertising industry is the popular attack known as “click fraud”, which is the act of clicking on an ad, not because of interest in this ad, but rather as a way to generate illegal revenues for the application publisher. Many studies evaluated click fraud attacks in the literature, and some proposed solutions to detect it. In this paper, we propose a click fraud detection model, hereafter CFC, to classify fraudulent clicks by adopting some features and then testing using KNN, ANN and SVM. In fact, based on our experimental results, the different featured classifiers reached an accuracy higher than 93%.

In the network domain, there is a continuous ongoing evolution in the type of connected devices and the nature of developed applications. This presents the network with varying Quality of Service (QoS) and security requirements. Consequently, there is a need to classify Internet traffic to facilitate its management. Thus, a granular classification based on needs is required, one which relates better to the network requirements of the traffic. In this paper, we apply deep learning to classify traffic requiring different QoS and security policies. We propose a multi-level classification framework applying a new data representation method. A comparison between the proposed data representation method and a previous method is presented. The implementation results show that the proposed data representation model outperforms the previous one and promises to permit the classification of the traffic at different granularity. Recording up to 95% accuracy using only the size, interarrival time, direction, transport protocol of the first 16 packets of each flow, our method can be employed in an online classification platform.

Hybrid Networks, defined as networks that include both SDN and IP nodes, were considered as a natural consequence of the incremental deployment of SDN in the current all-IP world. However, under some circumstances, the centralized control plane of SDN offers advantages over the traditional distributed one. This drove our work as we design a hybrid network in which each node adaptively switches its control state between centralized and distributed given the prevailing network conditions. The proposed optimization problem delivered the expected network behavior; the network was fully centralized when conditions were favorable for full centralization, and it was fully distributed when conditions favored full distributivity. For random conditions, we were able to capture the behavior of network nodes with time and with different decision thresholds.

Quick User Datagram Protocol Internet Connection (QUIC) 1 boosts web traffic performance by solving a number of transport-layer and application-layer problems. QUIC provides key advantages to HTTP/2 such as reduced connection establishment latency, improved congestion control, forward error correction, and connection migration. However, QUIC suffers from three limitations: (1) it performs poorly under high bandwidth and heavy traffic conditions, (2) it suffers from some security issues, (3) it implements static Forwarding Error Correction (FEC) XOR "group" mechanism, which performs poorly under variable network conditions, influencing the utilized bandwidth. Software Defined Networking (SDN), being centralized by nature, provides a global view of the network. When integrated with QUIC, SDN improves resource utilization and network security as we show in this paper. We propose an SDN-enhanced QUIC that achieves improved security at higher bandwidth utilization when transferring large amounts of data.

Security is one of the main concerns facing the development of new projects in networking and communications. Another challenge is to verify that a system is working exactly as specified. On the other hand, advances in Artificial Intelligence (AI) technology have opened up new markets and opportunities for progress in critical areas such as network resiliency, health, education, energy, economic inclusion, social welfare, and the environment. AI is expected to play an increasing role in defensive and offensive measures to provide a rapid response to react to the landscape of evolving threats. Software Defined Networking (SDN), being centralized by nature, provides a global view of the network. It is the flexibility and robustness offered by programmable networking that lead us to consider the integration of these two concepts, SDN and AI. Inspired by the fascinating tactics of the human immunity system, we aim to design a general hybrid Artificial Intelligence Resiliency System (ARS) that strikes a good balance between centralized and distributed security systems that may be applicable to different network environments. In addition, we aim to investigate and leverage the latest AI techniques to improve network performance in general and resiliency in particular.

Network availability and reliability remain of primary concern, especially that network failures and changes cannot be completely eliminated, but their consequences can be mitigated and controlled. Accordingly, fast network convergence becomes a significant requirement to control and limit the negative effects of network failures or changes. Network convergence has been studied for different distributed routing protocols; but with the emergence of centralized routing in SDN, better convergence characteristics are expected. In this paper, we model convergence delays for centralized (SDN) and distributed routing (OSPF), and compare their theoretical behavior to the experimental one. Analytical results show that SDN and OSPF outperform each other under different network conditions, depending on network size, link delays, and fault location. Experimental results verify the theoretical expectations, and provide more insights into convergence delays. Even with minor discrepancies due to controller and switch modeling, the theoretical study and the empirical results give comparable outcomes.

Fingerprinting of mobile device apps is currently an attractive and affordable data gathering technique. Even in the presence of encryption, it is possible to fingerprint a user's app by means of packet-level traffic analysis in which side-channel information is used to determine specific patterns in packets. Knowing the specific apps utilized by smartphone users is a serious privacy concern. In this study, we address the issue of defending against statistical traffic analysis of Android apps. First, we present a methodology for the identification of mobile apps using traffic analysis. Further, we propose confusion models in which we obfuscate packet lengths information leaked by mobile traffic, and we shape one class of app traffic to obscure its class features with minimum overhead. We assess the efficiency of our model using different apps and against a recently published approach for mobile apps classification. We focus on making it hard for intruders to differentiate between the altered app traffic and the actual one using statistical analysis. Additionally, we study the tradeoff between shaping cost and traffic privacy protection, specifically the needed overhead and realization feasibility. We were able to attain 91.1% classification accuracy. Using our obfuscation technique, we were able to reduce this accuracy to 15.78%.

Networking has already entered a new era where it is evolving into the Internet of Things (IoT). The future network consists of tens of billions of connected devices. These things bear different security vulnerabilities and can be abused to perform diverse attacks. Due to the heterogeneous nature of IoT and its massive deployment, managing the IoT security requires automated techniques to deal with the emerging security challenges. To address this problem, we propose a model where intelligence is integrated at the network edge to extract specific statistical features per network flow. These features are passed to a controller which implements a classification algorithm to determine the device type generating the observed flow. A monitoring module is responsible for analyzing the network traffic behavior. If abnormal traffic is detected from a certain device, the controller takes the adequate action (e.g. blocking the traffic from this device). After collecting data from IoT devices, we evaluate our proposed classification model. Results show that our approach can achieve up to 99.6% accuracy for device type identification and up to 99.9% for traffic type classification.

Software Defined Networking (SDN) is a networking technology that caught the interest of many researchers and specialists in the field. The attention that SDN management obtained wasn't any less since traditional techniques were no longer sufficient for managing this new concept, and fully exploiting the flexibility and agility introduced with it. The purpose of this paper is to survey techniques used for network management for Software Defined Networks, and build on the FCAPS (Fault, Configuration, Accounting, Performance, Security) model to propose a new management framework to serve SDN orchestration. Results showed an improvement of 27.5% for our proposed design as compared to the Controller-only and Manager-only scenarios.

This paper presents VISKA, a cloud security service for dynamically detecting malicious switching elements in software defined networking (SDN) infrastructures. The main contributions of VISKA lie in (1) utilizing network programming and secure probabilistic sketching in SDN environments to dynamically detect and isolate parts of the data plane that experience malicious behavior, (2) applying a set of focused packet probing and sketching mechanisms on isolated network partitions/views rather than focusing the security mechanisms on the whole physical network, (3) efficiently analyzing the network behavior of the resulting views by recursively partitioning them in a divide-and-conquer fashion to logarithmically reduce the problem size in order to localize abnormal/malicious switching units, and (4) providing an attack categorization module that analyzes live ingress/egress traffic of the maliciously detected switch(es) solely to identify the specific type of attack, rather than inspecting the whole network traffic as is done in traditional intrusion detection systems. This significantly enhances the performance of attack detection and reduces the load on the controller. A testbed prototype implementation is realized on the Mininet network emulator. The experimental analysis corroborated the algorithms’ convergence property using the linear and FatTree topologies with network sizes of up to 250 switches. Moreover, an implementation of the attack categorization module is realized and achieved an accuracy rate of over 90% for the different attack types supported.

Mobile applications are becoming computationally intensive nowadays due to the increasing convenience, reliance on, and sophistication of smartphones. Nevertheless, battery lifetime remains a major obstacle that prohibits the large-scale adoption of such apps. Mobile cloud computing is a promising solution whereby apps are partially processed in the cloud to minimize the overall energy consumption of smartphones. However, this will not necessarily save energy if there is no systematic mechanism to evaluate the effect of offloading an app onto the cloud. In this paper, we present a mathematical model that represents this energy consumption optimization problem. We propose an algorithm to dynamically solve the problem while taking security measures into account. We also propose the free sequence protocol (FSP) that allows for the dynamic execution of apps according to their call graph. Our experimental setup consists of an Android smartphone and a Java server in the cloud. The results demonstrate that our approach saves battery lifetime and enhances performance. They also show the effects of workload amount, network type, computation cost, security operations, signal strength, and call graph structure on the optimized overall energy consumption.

In this paper, we present the design and implementation of Green Route (G-Route), an autonomic service routing protocol for constructing energy-efficient provider paths in collaborative cloud architectures. The chief contribution of this work resides in autonomously selecting the optimal set of composite service components sustaining the most efficient energy consumption characteristics among a set of providers for executing a particular service request. For ensuring the accountability of the system, the routing decision engine is designed to operate by processing accountable energy measurements extracted securely from within the cloud data centers using trusted computing technologies and cryptographic mechanisms. By pushing green computing constraints into the service routing decision engine, we can leverage the collaborative cloud computing model to maximize the energy savings achieved. This is realized by focusing on a path of providers that execute the service requests instead of directing the green computing efforts towards a single provider site. To the best of our knowledge, G-Route is the first service routing protocol that utilizes the collaborative properties among cloud providers to select "green" service routes and thus, to enhance the energy savings in the overall cloud computing infrastructure. The devised G-Route design is developed and deployed in a real cloud computing environment using the Amazon EC2 cloud platform. The experimental results obtained analyze the protocol convergence characteristics, traffic overhead, and resilience under anomalous service configurations and conditions and demonstrate the capability of the proposed system to significantly reduce the overall energy requirements of collaborative cloud services.

Ensuring dynamic behavior, accountability, and flexible management is required by any traffic engineering solution. Software Defined Networking (SDN), presenting a central management control, is a promising solution in this context. However, the migration to SDN is not straightforward. SDN and non-SDN based networks will coexist for a long period of time. This hybrid mode brings together the distributed networking scheme benefits in terms of robustness and scalability, and the SDN management power gained by the control centralization. At the same time, it avoids the centralization single point of failure and the distributed scheme's management complexity. In this paper, we review research work related to hybrid networks and we present a solution to guarantee Quality of Service (QoS) for time-critical applications over a hybrid network.

“2020 and Beyond” is announced by the International Telecommunication Union to be the era of the next mobile network generation. After Long-Term Evolution (LTE)/fourth generation, fifth generation (5G) is promising to be a major evolution in the communication domain, not simply due to the acceleration of the data rate, but rather due to the new applications. The challenging objectives such as minimum user-plane latency, uninterruptable connectivity, high quality of service, high data rate communications, and network capacity, while dealing with ubiquitous and heterogeneous network access, call for a major overhaul of the whole mobile network architecture. The limitations of today's mobile systems, derived from their dependency on hardware-based designs, led to inflexible and limited architectures. It is essential to have dynamic and flexible management systems at several levels, starting from the radio access network (RAN), passing by the Evolved Packet Core (EPC), up to the application interfaces. These future demands and the requirement for a self-adaptive system can be realized by adopting the software-defined-networking (SDN) paradigm, which leads to the integration of SDN in the network components of the upcoming 5G technology. Benefiting from software flexibility on one hand and control and management centralization on the other hand, SDN has its positive impact in the communication world from several aspects. SDN will provide 5G with a smooth transition and unified management among various wireless standards and among different RANs and wired core networks. Furthermore, SDN can optimally orchestrate the interference between cells, handovers, roaming process, routing, and signaling between access and core networks, management of the gateways, and even the management of user data. Furthermore, the new bandwidth and latency requirements, and the ability to support the innovative 5G applications, cannot be satisfied by centralizing the data in the cloud. Pushing the data to the user's proximity will be vital for some time-critical applications, which is a requirement supported by edge computing. Therefore, the geo-distribution of data requires an optimal networking design for these edges. On top of this distributed data layer, the network function virtualization coupled with SDN promises easier management of such an infrastructure. In this chapter, we investigate how SDN can be integrated into the 5G network architecture at different levels (RAN, EPC, security, etc.) and highlight the solutions, challenges, and benefits resulting from such integration. Also, we present the mobile edge computing concept, its integration with SDN, and its implications on 5G. We review the designs and architectures that have been proposed in this area and others that are under development, including the innovative applications and use cases that will be enabled by the SDN-5G combination. Our work will be concluded by proposing an architecture for SDN-5G for telecom operators.

In Software Defined Networks (SDN), the switches are statically assigned to controllers, which cause load imbalance among controllers. Among other problems, congestion, delay in SDN control messages, and controller overload are usually risen, especially in high traffic networks like data centers. In this work, we consider a distributed SDN controlling switches running OpenFlow protocol. We propose an add-on algorithm implemented on the controllers, whose aim is to dynamically assign switches to controllers whenever overload or failure is observed. Consequently, this will preserve the control plane and improve controllers performance. Simulations showed that such algorithm improves performance and reliability, and it is a must in a distributed SDN.

Multi-Path TCP (MPTCP) boosts network performance of applications by aggregating bandwidth over multiple paths using sub-flows of the same TCP connection. However, MPTCP suffers from three limitations: (1) it is an end-to-end protocol with no control over the network routes, and sub-flows might end up traversing the same links, (2) it has no dynamic control over choosing the optimal number of sub-flows to achieve maximum throughput, (3) its performance may degrade due to the large number of out-of-order caused by the heterogeneous paths traversed. Software Defined Networking (SDN), being centralized by nature, provides a global view of the network. When integrated with MPTCP, SDN improves resource utilization as we show in this paper. We propose an SDN-enhanced MPTCP that achieves higher data rates while transferring big-data in large-scale L2 networks such as those found in datacenters. Test results show a 20% to 30% increase in the throughput over regular MPTCP.

As networking technology evolves and new network services are being deployed, the network infrastructure is shifting towards a virtualized software-enabled architecture, namely, Software Defined Networking (SDN). However, a full deployment of SDN is challenging due to financial limitations and lack of expertise in the field. Consequently, a new form of hybrid network emerged as a result of the partial deployment of SDN. This paper considers the three types of networks, traditional, SDN and hybrid, and implements a fuzzy decision system that embodies network deployment best practices according to the advantages gained with each technology (legacy and SDN), and provides technology and financial recommendations that help operators decide on what type of network is best to deploy given their network and service requirements.

The requirements of the fifth generation of mobile communications technology (5G) present many challenges. Among others, it aims at improved support of device-to-device communication, lower cost, lower latency than 4G and lower battery consumption, for better implementation of the Internet of things (IoT). However, the connectivity of IoT devices gives rise to additional security and privacy concerns. Given the associated data proliferation and the integration of third-party applications, the access control management becomes an exceedingly complex task. Thus, a security model is needed. Few years ago, the “softwarization” invasion along with the network “virtualization” have led to a new network control paradigm and paved the way towards a global network operating system. In this paper, we discuss the IoT requirements in terms of security and privacy. Additionally, we propose an IoT software defined security framework.

5G, the fifth generation of mobile communication networks, is considered as one of the main IoT enablers. Connecting billions of things, 5G/IoT will be dealing with trillions of GBytes of data. Securing such large amounts of data is a very challenging task. Collected data varies from simple temperature measurements to more critical transaction data. Thus, applying uniform security measures is a waste of resources (processing, memory, and network bandwidth). Alternatively, a multi-level security model needs to be applied according to the varying requirements. In this paper, we present a multi-level security scheme (BLP) applied originally in the information security domain. We review its application in the network domain, and propose a modified version of BLP for the 5G/IoT case. The proposed model is proven to be secure and compliant with the model rules.

Vehicular ad-Hoc Networks (VANETs) have been promoted as a key technology that can provide a wide variety of services such as traffic management, passenger safety, as well as travel convenience and comfort. VANETs are now proposed to be part of the upcoming Fifth Generation (5G) technology, integrated with Software Defined Networking (SDN), as key enabler of 5G. The technology of fog computing in 5G turned out to be an adequate solution for faster processing in delay sensitive application, such as VANETs, being a hybrid solution between fully centralized and fully distributed networks. In this paper, we propose a three-way integration between VANETs, SDN, and 5G for a resilient VANET security design approach, which strikes a good balance between network, mobility, performance and security features. We show how such an approach can secure VANETs from different types of attacks such as Distributed Denial of Service (DDoS) targeting either the controllers or the vehicles in the network, and how to trace back the source of the attack. Our evaluation shows the capability of the proposed system to enforce different levels of real-time user-defined security, while maintaining low overhead and minimal configuration.