A Broadcast Based Link Discovery Scheme for Minimizing Messages in Software Defined Networks

Software-Defined Network (SDN) represents a new network paradigm. Unlike conventional networks, SDNs separate control planes and data planes. The function of a data plane is enabled using switches, whereas that of a control plane is facilitated by a controller. The controller learns network topologies and makes traffic forwarding decisions. However, some serious vulnerabilities are gradually exposed in the topology management services of current SDN controller designs. These vulnerabilities mainly exist in host tracking and link discovery services. Attackers can exploit these weak points to poison the network topology information in SDN controllers. In this study, a novel solution is proposed to defend against topology poisoning attacks. By analyzing the existing topology attack principles and threat models, this work constructs legal conditions for host migration to detect host hijacking attacks. The checking of the Link Layer Discovery Protocol (LLDP) source and integrity is designed to defend against link fabrication attacks. A relay-type link fabrication attack detection method based on entropy is also designed. Results show that the proposed solution can effectively detect existing topological attacks and provide complete and comprehensive topological security protection.

The expected higher complexity of upcoming 5G wireless backhauls suggests the need to evolve towards a softwaredefined networking (SDN) paradigm to increase the degree of programmability of these networks. Within the context of softwaredefined wireless backhaul, one important issue is the provision of an even resource consumption of both network and IT resources. Backpressure policies have shown their ability to balance resource consumption in traditional (non-SDN) wireless backhauls. This paper analyzes two use cases in which backpressure policies can be integrated in software-defined wireless backhaul to manage network and IT resources. The first use case proposes an SDN application based on a centralized backpressure policy to balance network resources in the wireless backhaul. Simulation results reveal how the granularity of routing decisions in the SDN application significantly affects the data plane performance, suggesting a trade-off between data plane performance and overload in the control plane. The second use case proposes a distributed backpressure policy to deal with the management of computing resources by balancing the processing load caused by OpenFlow (OF) switch requests among the available distributed SDN controllers. Simulation results demonstrate how a dynamic and distributed backpressure policy can balance the processing load amongst different SDN controllers, hence, leading to significant improvements with respect to static mapping policies.

The nature of computer network flash crowd traffic, which is generated by legitimate users accessing servers or other network resources are similar to the traffic generated by Distributed Denial of Service (DDoS) like attacks. With advancement in spoof packet generation tools, attacker may generate Multi-source Multi-destination Multi-protocol (MMM) traffic; characteristics of such traffic are very similar to on-going genuine/ flash crowd traffic in the network. In the case of Software Defined Network (SDN), attacker’s target is controller plane. Controller plane in SDN is a centralized processing unit of the underlying network, which manages several data planes. Controller plane frames the policies and pushes forwarding rules to the data planes. Data planes just maintain the forwarding rules. Thus by overloading the SDN controller, functionality of complete computer network will be hampered. In this paper, we have proposed Media Access Control (MAC) address based Model to Differentiate Flash crowd and Malicious traffic in SDN (MDFMS). Novelty of the proposed model is to detect, locate and mitigate the source of Traditional DDoS (T-DDoS) and MMMDDoS traffic. MDFSM has been implemented on separate machine to avoid any additional computing load on SDN controller. It also preserves the original design of the SDN architecture. Proposed model has been evaluated under various scenarios and encouraging results have been obtained to differentiate T-DDoS and MMM-DDoS from benign flash crowd traffic.

The evolution and advancements in Information and Communication Technologies (ICT) have enabled large scale distributed computing with a huge chunk of applications for massive number of users. This has obviously generated large volumes of data, thus severely burdening the processing capacity of computers as well as the inflexible traditional networks. State-of-the-art methods for addressing datacenter level performance fixes are yet found wanting for sufficiently addressing this huge processing, storage, and network movement with proprietary protocols for this voluminous data. In this chapter the works have focused on addressing the backend server performance through effective reducer placement, intelligent compression policy, handling slower tasks and in-network performance boosting techniques through effective traffic engineering, traffic classification, topology discovery, energy minimization and load balancing in datacenter-oriented applications. Hadoop, the defacto standard in distributed big data storage and processing, has been designed to store data with its Hadoop Distributed File System (HDFS) and processing engine MapReduce large datasets reliably. However, the processing performance of Hadoop is critically dependent on the time taken to transfer data during the shuffle generated during MapReduce. Also, during concurrent execution of tasks, slower tasks need to be properly identified and efficiently handled to improve the completion time of jobs. To overcome these limitations, three contributions have been made; (i) Compression of generated map outputs at a suitable time when all the map tasks are yet to be completed to shift the load of network onto the CPU; (ii) Placing the reducer onto the nodes where the computation done is highest based on a couple of counters, one maintained at the rack level and another at node level, to minimize the run-time data copying; and (iii) Placing the slower map tasks onto the nodes where the computation done is highest and network is handled by prioritizing. Software defined networking (SDN) has been a boon for next generation networking owing to the separation of control plane from the data plane. It has the capability to address the network requirements in a timely manner by setting flows for every to and fro data movement and gathering large network statistics at the controller to make informed decisions about the network. A core issue in the network for the controller is traffic classification, which can substantially assist SDN controllers towards efficient routing and traffic engineering decisions. This chapter presents a traffic classification scheme utilizing three classifiers namely Feed-forward Neural Network (FFNN), Logistic Regression (LR), Naïve Bayes and employing Particle Swarm Optimization (PSO) for improved traffic classification with less overhead and without overlooking the key Quality of Service (QoS) criterion. Also lowering energy minimization and link utilization has been an important criterion for lowering the operating cost of the network and effectively utilizing the network. This issue has been addressed in the chapter by formulating a multi-objective problem while simultaneously addressing the QoS constraints by proposing a metaheuristic, since no polynomial solution exists and hence an evolutionary based metaheuristic (Clonal Selection) based energy optimization scheme, namely, Clonal Selection Based Energy Minimization (CSEM) has been devised. The obtained results show the efficacy of the proposed traffic classification scheme and CSEM based solution as compared with the state-of-the-art techniques. SDN has been a promising newer network paradigm but security issues and expensive capital procurement of SDN limit its full deployment hence moving to a hybrid SDN (h-SDN) deployment is only logical moving forward. The usage of both centralized and decentralized paradigms in h-SDN with intrinsic issues of interoperability poses challenges to key issues of topology gathering by the controller for proper allocation of network resources and traffic engineering for optimum network performance. State-of-the-art protocols for topology gathering, such as Link Layer Discovery Protocol (LLDP) and Broadcast Domain Discovery Protocol (BDDP) require a huge number of messages and such schemes only gather link information of SDN devices leaving out legacy switches’ (LS) links which results in sub-optimal performance. This chapter provides novel schemes which unearth topology discovery by requiring fewer messages and gathering link information of all the devices in both single and multi-controller environments (might be used when scalability issue is prevalent in h-SDN). Traffic engineering problems in h-SDN are addressed by proper placement of SDN nodes in h-SDN by utilizing the analyzing key criterion of traffic details and the degree of a node while lowering the link utilization in real-time topologies. The results of the proposed schemes for topology discovery and SDN node placement demonstrate the merits as compared with the state-of-the-art protocols.

Software Defined Network (SDN) Technology made tremendous changes in networking field by controlling the hardware with remote software by decoupling data plane and control plane. The focus here is on the controller which is part of control plane. A controller is a central part of SDN; it is an intermediary between Data plane and Forwarding plane. It takes prime place in SDN architecture like Operating System in Computers. SDN Controller is a software which directs the packets using flow rules and also contains statistical information of network. The controller orchestrates the networking devices such as switches and routers by channelizing the packets. SDN controller has different flavor based on the commercial requirement achieved by including new pluggable module. This paper discusses some of the SDN Controller with their feature; the controllers are POX, NOX, Floodlight, ODL, Open Contrail. This paper also compares the characteristic of centralized and distributed controller by focusing on performance, bandwidth and round-trip time of Floodlight and Open Daylight (ODL) controller. The simulation is conducted using Mininet.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

Software-defined networking is a new paradigm that overcomes problems associated with traditional network architecture by separating the control logic from data plane devices. It also enhances performance by providing a highly-programmable interface that adapts to dynamic changes in network policies. As software-defined networking controllers are prone to single-point failures, providing security is one of the biggest challenges in this framework. This paper intends to provide an intrusion detection mechanism in both the control plane and data plane to secure the controller and forwarding devices respectively. In the control plane, we imposed a flow-based intrusion detection system that inspects every new incoming flow towards the controller. In the data plane, we assigned a signature-based intrusion detection system to inspect traffic between Open Flow switches using port mirroring to analyse and detect malicious activity. Our flow-based system works with the help of trained, multi-layer machine learning-based classifier, while our signature-based system works with rule-based classifiers using the Snort intrusion detection system. The ensemble feature selection technique we adopted in the flow-based system helps to identify the prominent features and hasten the classification process. Our proposed work ensures a high level of security in the Software-defined networking environment by working simultaneously in both control plane and data plane.

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

Network administrators employ a variety of security policies to protect the data and services. However, the lack of standard control protocol and distributed network control causes these policies to be complicated in traditional networks. An ideal paradigm is provided by Software Defined Network (SDN) to address these challenges through separating the control plane from data plane. Security policies are enforced by logically centralized control's which take advantage of SDN. In this paper, we present a fully configurable system for an institution using POX which is a famous SDN controller. A network administrator can enforce the policies related to security, access and control through it. So that a single change in policy will be reflected in all the OpenFlow switches, attached to the SDN, resulting in reduced cost and time, as compare to the conventional networks where each switch is managed individually. The purpose of this research is to achieve a secure and controllable SDN by blocking the malicious and restricting the anonymous users in the network.

Considering the problem that the SDN controller can not fully resolve the virtual network function during the Software Defined Network (SDN) and Network Function Virtualization (NVF) collaborative deployment in the satellite network, a SDN/NFV coordination based on the three-layer satellite network is designed. The framework extends the SDN controller function and proposes the SDN controller function extension method (SDN-FE) based on LightGBM algorithm. SDN-FE has extended the functions of the original SDN controller in three aspects. One is based on LightGBM to establish a classification model for intelligent forwarding of SDN controller data packets. The second is to learn and predict VNF modification of data packets through logistic regression. The third is to design an idle state monitoring mechanism. The above method effectively enhances the control capability of the SDN controller to the network. In terms of SDN packet forwarding classification, SDN-FE is compared with existing well-known machine learning classification algorithms such as SVM, random forest, LSTM. Simulation experiments show that the SDN packet forwarding classification problem is predictable. The average accuracy of the LightGBM model in multi-classification problems is over 69%, which is better than machine learning models such as SVM and random forest. The next step is to conduct an in-depth study of the packet rule learning algorithm in VNF.

Software Defined Networking (SDN) is a new paradigm proposed to meet the requirements of new networking concepts such as cloud computing and data center networking. SDN decouples control and data planes and uses a logically centralized controller to manage the underlying network resources. In this paper, a joint server and route selection mechanism is proposed for SDN networks, where current and past statistics of network resource utilization are taken into account to allocate a server and a corresponding routing path for each incoming flow. The proposed mechanism periodically and automatically updates the link cost metrics of link state routing protocol to achieve the load balancing in the network. The proof of concept has been implemented using Mininet to emulate OpenFlow enabled switches and OpenDaylight as an SDN controller. Using the real IP traffic, we successfully demonstrated that the proposed system evenly distributes traffic flows among network links and servers.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Software-defined networking (SDN) has revolutionized traditional network management by decoupling the control and data planes, offering enhanced flexibility, programmability, and efficiency. However, this centralized architecture makes SDN vulnerable to Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, which severely impact network performance and reliability. Through overloading critical network components, especially the SDN controller, these attacks reduce network availability and result in significant service interruptions. This review offers a thorough summary of mitigation strategies designed to combat DoS and DDoS attacks in SDN systems. These attacks overwhelm network resources, disrupt services, and compromise the availability of critical components such as the SDN controller. Additionally, it explores the key challenges facing SDN in defending against DoS and DDoS attacks, such as the need for real-time detection, the impact of network scale, and the complexities of adaptive responses. As such, addressing DoS and DDoS attacks has become a critical research area for ensuring the security and robustness of SDN-based networks. It categorizes existing approaches based on detection methods, response strategies, and deployment models, providing a detailed analysis of their strengths and limitations. Furthermore, it discusses problems such as scalability, concurrent detection, and adaptability that hinder the effectiveness of current solutions. Emerging trends, including integrating artificial intelligence, blockchain, and collaborative frameworks, are highlighted as promising directions for future research. This aim is to give researchers, network admins, and cyber-security practitioners an insight into the state of the art as well as a basis on which to build for future SDN security advancements. This survey aims to serve as a comprehensive resource for researchers and practitioners seeking to imporve SDN's resilience against DoS and DDoS attacks.

In the past few years there has been a tremendous increase in network attacks especially the Denial of Service and Distributed Denial of Service attacks. The attacker tries to send a number of packets to the victim site so as to make it unavailable to provide any service. Nowadays DoS attacks can be performed using IoT enabled devices too. The traditional network architecture is unable to handle such attacks which gave rise to Software Defined Network(SDN) as a solution. Software-defined networking is a network technology that provides central control over the network and thus manages network behavior dynamically through software via open interfaces. SDN plays a role to retain the heterogeneity in networks and objects by integrating into them a control solution that interacts with the SDN controllers. Although SDN provides promising solutions to many security problems, it is also exposed to new attacks targeting the data plane, control plane or the link connecting the two planes. This paper aims at the integration of IoT with SDN technology, the study of OpenFlow Protocol, different DoS attacks occurring on the layered SDN structure and the possible mitigation strategies to weaken the impact of those attacks on the network. For this purpose, we will be using a mininet simulator, OpenVSwitch(OVS) and Floodlight SDN controller.