A new framework for reliable control placement in software-defined networks based on multi-criteria clustering approach

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

The centralized control plane of Software Defined Network (SDN) introduces scalability concerns, which is addressed by physically distributing the control plane, although logically centralized. As the task of the control plane is delegated to multiple controllers, the layout of the controllers greatly influence the performance of the network. An important objective that researchers try to optimize while deciding placement of controllers is the flow setup time. This, in turn, depends on the number of flows generated. In this work, we decompose the network traffic into a time series model of flows. We use parametric and non-parametric learning techniques to predict the number of flows for the next epoch based on the current traffic dynamics. Two different real traffic traces have been used to develop the prediction models.

We present a control plane architecture to enable software-addressable optical acceleration from the application layer. The architecture is experimentally examined on a cluster-computing test-bed by enabling physical layer optical multicasting on-demand for the application layer to achieve non-blocking performance.

Controller placement is a key problem in software defined networks (SDNs). Previously, the solution to this problem only focused on propagation latency but ignored the load of controllers, which is a critical factor in real networks. In this letter, we define a capacitated controller placement problem (CCPP), taking into consideration the load of controllers, and introduce an efficient algorithm to solve the problem. The evaluation shows that the new strategy can significantly reduce the number of required controllers, reduce the load of the maximum-load controller, and reduce the radius stretches compared with the K-center strategy with dynamic controller provision or dynamic scheduling.

Control traffic balancing in software defined networks

From the previous chapter, one can see that software-defined networking (SDN) can be applied to large-scale distributed datacenter networks for network control and management. When this occurs, a logically centralized and physically distributed control plane is usually required. This type of control plane consists of multiple controllers communicating with one another. The collaboration of these controllers facilitates the maintenance of a global consistent view of the entire network. However, there are many new problems that must be addressed when a distributed control plane is deployed in a large-scale network; in particular, controller placement is one key problem. Controller placement refers to selecting the proper positions of the controllers to further improve the scalability and performance of the distributed control plane. In this chapter, we propose a novel placement metric for deploying multiple controllers that measures the cost when controllers with limited capacity handle request messages from switches. Then, we formulate the optimal controller placement problem as an integer linear program (ILP) and use an effective approximation algorithm to find its solution. We conduct intensive experiments based on many real topologies. Our results demonstrate that our strategy can significantly improve performance over existing strategies in terms of both cost and load balance.

Software defined networking (SDN) separates the control and the data planes. This separation brings flexibility to the network. But the decoupling has some drawbacks such as the controller placement problem (CPP). Controller placement is a crucial task which affects the overall networks’ performance. This paper proposes a novel controller placement model that is based on petri-nets to place the SDN’s controllers. The proposed model is called controller placement using petri-nets for SDNs (CPPNSDN). CPPNSDN aims to reduce the average propagation latency among switches and their associated controllers. CPPNSDN divides the network into sub-networks. Each sub-network is governed by a controller. Experiments were conducted on the Internet2/OS3E topology to evaluate the performance of CPPNSDN. Experiments show that CPPNSDN reduces the average latency significantly compared to two reference models. The first reference model is the Modified Density Peaks Clustering (MDPC) and the Optimized Kmeans model. In terms of the overall average latency, the CPPNSDN has shown promising results as it outperformed the MDPC and optimized Kmeans reference models by 7% and 17% respectively. Confidence Interval (CI) used was 90%. This is an ongoing work and the results are promising for more future investigation

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

Software-Defined Network is an emerging networking paradigm that enables intelligent and flexible network management. Specifically, the design of the control plane is crucial. Therefore, in order to avoid a single point of failure, multiple controllers are deployed constantly in a distributed manner on the control plane. In this paper, we propose a controller placement approach based on multiple objectives (MODECP), including network delay, network security, load-balancing rate, and link occupancy. In the controller placement stage, an improved multi-objective differential evolution algorithm is proposed to search for controllers’ positions and assign switches to controllers reasonably. Furthermore, an improved affinity propagation algorithm is proposed to obtain the number of controllers placed in the network partition stage, comprehensively considering the delay, node security, and load. Simulations are performed based on several topologies from Internet Topology Zoo. Extensive results show that the proposed algorithm can realize trade-offs among multiple objectives and improve network performance in delay, security, controller load, and link occupancy compared to the single-objective based approach. Moreover, compared with the genetic algorithm and random placement algorithm, the proposed algorithm performs better with low latency, high security, low load rate, and low link overhead.

The Software Defined Networks (SDN) architecture deploys the programmable network by decoupling the data plane and control plane from the existing network architectures. Control activities are put into a software called controller. This new architecture, utilizes programmable controllers, enhances the intelligence of the networks’ operations and enables network engineers to serve their business requirements more efficiently. One of issues in SDN is, estimating the required number of controllers needed and placing it in optimal locations. Many works have been proposed to place controllers in its optimal locations. In most of the works, the controller placement was based on some mathematical formulations, or by heuristic approach and number of controller required was given as an input parameter. In this work, a Traffic Engineering (TE) based controller deployment is proposed. For placing controllers K-Medoid algorithm was used and ANN model was created for analysing and predicting the traffic.

Software middlebox-based services can be flexibly managed by software defined networking (SDN) and network function virtualization (NFV). Meanwhile, traffic routing can be simplified and the number of routing rules in the SDN-enabled switches can be reduced through the consolidated middlebox model. However, different network functions in middleboxes may alter the volume of processed traffic, so high congestion may occur in specific bottleneck links if middlebox selection and traffic routing are not well jointly planned. Besides, in a statically switch-controller configured SDN, traffic dynamics will not only affect the link load in the data plane, but also pose a challenge to controller load balancing. Therefore, it’s necessary to achieve better quality-of-service (QoS) performance in both control and data planes. In this article, we first formulate this problem as a joint traffic-aware consolidated middleboxes selection and routing (JTMSR) problem and prove its NP-hardness. Then, we design a two-phase algorithm to achieve the controller and link load balancing where the first phase is to redirect selected flows by applying wildcard rules and the second phase is to find fine-grained routing path by a rounding-based algorithm with bounded approximation factor. Finally, compared with the existing algorithms through extensive simulations, it demonstrates that our method has near-optimal controller load balancing and link load balancing performance and can improve response time by 9.7% compared with static scheme.

Artificial intelligence based load balancing in SDN: A comprehensive survey

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Operational, organizational and business challenges for network operators in the context of SDN and NFV