Appraisal of Source IP Validation Techniques in SDN

Software-defined networking (SDN) is a network technology that aims to make the network more flexible and centralized. The main aim of the architecture is decoupling of network and control plane which enables the network control to be programmed and hence the forwarding devices are abstracted from higher application services. However, before this technology evolves on a large scale, it is important to understand the vulnerabilities associated with it. The agenda for this paper is to study the different types of attacks on the three layers of the OpenFlow protocol and the possible mitigation strategies to reduce the impact of those attacks on the network, implement SDN network which consists assorted topologies connecting numerous hosts, switches, and controllers. The implemented framework monitors the various events occurring in the network, identifies malicious events causing DoS attack, and mitigates the same. Through implementation, we elaborate different ways of making SDN more secure.

Hybrid software-defined networking (SDN) networks are intermediates between traditional networks and SDN networks. However, since the hybrid control planes are structurally different from the single control plane, updating the hybrid SDN networks lacks effective techniques. In this paper, by utilizing the segment routing (SR) mechanism to update hybrid SDN networks and formalize the application of SR during updates, we propose a cooperative consistency update algorithm that can coordinate SR, two-phase commit techniques. The algorithm is capable of preserving consistency with low overhead and excellent applicability. When a network requires updating, the algorithm leverages the SR mechanism to stitch a new path using the available path segments; thus, flows can use the new path immediately. If the update cannot be completed with the SR mechanism alone, the algorithm can utilize the two-phase commit technique to update the nodes through duplication. Notably, our experiments based on real topologies indicate that, compared to prior techniques, the proposed algorithm can greatly reduce the TCAM overhead.

Ternary Content Addressable Memory (TCAM) is widely used for caching flow entries in Software Defined Network (SDN). However, limited by the current technology level and hardware cost, the capacity of TCAM is difficult to meet the needs for caching flow entries of large scale SDN, which would seriously affect the scalability of SDN. Aimed at the problem, some researches improve the efficiency of TCAM capacity by setting different lifecycle for different flow entries. Such as Openflow protocol proposed the default flow entry lifecycle, AHTM scheme dynamicly adjusted flow entry lifecycle according to the number of interrupted flows. However, these schemes didn't consider the dynamic features of network traffic in SDN, and hardly conform to the actual network demands. In order to effectively utilize TCAM capacity and thus enhance the scalability of SDN, we propose TF-IdleTimeout scheme to dynamically set flow entry lifecycle according to real-time network traffic in SDN-based data center network. Two criterion, called Flow Entry Missing Number and Flow Dropping Number, are used to evaluate the effect. The results show that, compared with existing schemes, TF-IdleTimeout scheme can greatly improve the utilization efficiency of TCAM capacity in SDN.

It is Software defined networking (SDN) is a new network approach which allows separation of the forwarding plane from the control plane in network architecture, that aids in the efficient control of data flow and gives network administrators a software- based method for managing and configuring the networks. In contrast to SDN, which provides a centralized controller, traditional network topologies require the individual configuration of each network device. Due to a centralized control functionality, SDN is increasingly used by businesses, telecom service providers, cloud providers, and many other users, as it encourages flexibility and scalability in the network while also assisting in streamlining operations. There is significant demand of SDN for effective and adaptable networks. SDN adoption has also been rising in the campuses and corporate sectors. This paper provides a concise overview of the Software Defined Networks (SDN) topic, which is essential for comprehending the fundamental principles of SDN in order to conduct research and implement SDN in many sectors. The initial focus is on the discussion of traditional networks, including their limitations, as well as the many issues encountered by industries. The topic of Software Defined Networks is explored, encompassing their necessity, historical background, architectural structure, interfaces, and models. Next, the many applications of Software-Defined Networking (SDN) are examined. Additionally, the various SDN case studies, vendors, setup issues with SDN, and current research fields were elucidated. The discussion focuses on the role of Software-Defined Networking (SDN) in Artificial Intelligence (AI), specifically addressing the issues associated with implementing SDN in AI.

: The benefits of Software-Defined Networking (SDN), when fully realized, offer many improvements over the current rigid and complex networking paradigm. By virtue of separating the control plane from the forwarding devices and handing its control over to a centralized external device, SDN removes many obstacles to networking innovation and research. OpenFlow protocol is a key enabler of SDN and provides a centralized control channel for effective state management. Simplified and centralized state management using SDN is highly desirable for rapid and secure network deployment in the battlefield. As the open-source community continues to progress with more stable software, the vendor support and implementation are leading the way in network innovation. Cisco has recently joined the list of SDN vendor supporters with the debut of its Open Network Environment (ONE) controller in 2013. Cisco ONE is built to OpenFlow 1.0 specifications and is said to be fully compliant with standard OpenFlow. In addition to the standard OpenFlow implementation, Cisco has also introduced a control plane in their switches as backup for the situation in which the external controller becomes unavailable. The U.S. Army Research Laboratory has obtained a privileged copy of the Cisco ONE controller from Cisco. As part of a summer project, the Cisco ONE controller has been analyzed and compared with the standard OpenFlow Floodlight controller for features and functionalities like handshake, connection setup, switch management, and security.

Accurate traffic and latency measurements are the foundation of many network management tasks, including traffic engineering and network provision, network diagnosis and fault recovery. However, SNMP-based traffic measurement techniques in traditional IP networks only provide measurements for link loads, which cannot lead to accurate measurements. For link latency measurement, it has been shown that a traditional IP network needs to deploy a large number of monitors to achieve accurate measurements. The software-defined network (SDN) architecture opens up new opportunities to tackle the traffic matrix estimation and latency measurement problems. For the traffic estimation problem, the counter in a flow table entry of an SDN switch can directly measure the size of a matched flow. This dramatically increases the number and type of flows that can be measured accurately. For link latency measurement, SDN switches provide flexible routing and hence allow even non-shortest paths to be measured in the network. This routing flexibility can reduce the number of monitors deployed in the network to achieve a complete measurement of all the link latencies. But the additional measurement capabilities of SDNs also have limitations: the flow table entries added for measurements must be limited due to the high cost of ternary content-addressable memory (TCAM), and the amount of additional traffic for measurement should also be confined. Under these constraints, this research investigates the traffic matrix estimation and link latency measurement problems for a pure SDN network and a hybrid SDN network. A hybrid network, which consists of SDN switches and conventional routers, will exist for some time to come since it is economically impossible to replace every conventional router overnight. For the traffic matrix estimation problem, we propose a new estimation framework, which can be used in both SDNs and hybrid SDNs. Performance evaluation results show that the new framework can achieve highly accurate traffic measurement with a small number of TCAM entries. For the link latency measurement problem, we first present minimum monitor placement schemes in hybrid SDNs. It has been shown that our schemes not only reduce the number of required monitors but also guarantee full link measurements even when link weights change. We then present two time-stamp-based link latency measurement schemes for pure SDNs and show that the proposed schemes can minimize the number of consumed TCAM entries and the amount of traffic generated for measurement.

Network traffic monitoring is an important factor to ensure the controllability and manageability of software-defined network (SDN). The current monitoring mechanism of SDN requires switches to request the controller for instructions to install flow entries for every new incoming flow. For finegrained monitoring, which requires many flow entries in switches' flow tables, this mechanism creates a non-trivial delay in the forwarding of switches and overhead in the control channel. Our previous work presented SDN-Mon, a monitoring framework that supports fine-grained monitoring for SDN. In this paper, we discuss the aspect of monitoring the flows in a distributed manner. We believe that a distributed monitoring capability enhances the monitoring scalability for SDN. We propose a mechanism that supports SDN to distribute the monitoring load over multiple switches in the network, in which it prevents flows monitoring duplication and balances the monitoring load over switches in the network. With the proposed mechanism, each switch handles much less monitoring load; and the overhead at switches, the control channel, and the controller caused by the monitoring duplication is eliminated. We implement the proposal and integrate it to SDN-Mon to enable a scalable and distributed monitoring capability in SDN. Experimental results show that the proposed mechanism significantly reduces the amount of monitoring load per switch, while the monitoring load is well balanced over switches in the network, with only an acceptable polling and processing overhead.

Software Defined Networking (SDN) has emerged as a new networking paradigm that is based on the decoupling between data plane and control plane providing several benefits that include flexible, manageable, and centrally controlled networks. From a security point of view, SDNs suffer from several vulnerabilities that are associated with the nature of communication between control plane and data plane. In this context, software defined networks are vulnerable to distributed denial of service attacks. In particular, the centralization of the SDN controller makes it an attractive target for these attacks because overloading the controller with huge packet volume would result in bringing the whole network down or degrade its performance. Moreover, DDoS attacks may have the objective of flooding a network segment with huge traffic volume targeting single or multiple end systems. In this paper, we propose an entropy-based mechanism for Distributed Denial of Service (DDoS) attack detection and mitigation in SDN networks. The proposed mechanism is based on the entropy values of source and destination IP addresses of flows observed by the SDN controller which are compared to a preset entropy threshold values that change in adaptive manner based on network dynamics. The proposed mechanism has been evaluated through extensive simulation experiments.

Computer network conditions that are dynamic and also complex make network operators often make mistakes in the configuration of a network device. However, these mistakes can be resolved by the emergence of a centralized programming approach which is now known as Software Defined Network (SDN). In addition, with the development of information technology, several services in computer networks also grabbed a lot of attention from the world, such as video streaming services. A video streaming service that is so massive is capable of having an impact on data traffic on computer networks. In SDN networks, controllers are a core component of this architecture. Currently, many different types of SDN controllers can be used, however, choosing a controller in an SDN network must be an important concern. This is related to the performance of the SDN controller which is a requirement for SDN network development. This research will analyze the performance of the video streaming service using the Real-time Transport Protocol (RTP) streaming protocol in testing two SDN controllers, namely Pox and Opendaylight. Based on the tests that have been carried out, it produces Quality of Service (QoS) values in the form of throughput, delay, and jitter. The Pox controller excels in the value of QoS delay and throughput. As for the jitter value, both Pox and Opendaylight controllers have good indexes.

Network Virtualization (NV) and Software Defined Networking (SDN) bring new business opportunities for network providers allowing them to offer the network as a service over their network infrastructure. One challenge for network providers is to provision virtual SDN services for multiple tenants while satisfying QoS and traffic engineering (TE) objectives of the higher priced SDN services, allocating the network resources cost effectively and managing the virtual services that span over customer premises, wide area and cloud domains. In this paper, we describe an algorithmic framework that includes QoS management and traffic-engineering methods for managing virtual services over large SDN networks. The algorithmic framework is part of an intelligent service management architecture which employs optimization algorithms, machine learning and artificial intelligence techniques into the management of virtual services over SDN networks.

Software Defined Networking (SDN) is a rapidly emerging technology in the commercial market, and is a technology that should be embraced by the defence and emergency services to enable more flexible and adaptable communication networks in the future. Common deployment of SDN, especially in data centres, involves building a separate network for the control channel between forwarding devices and the SDN controllers. For geographically distributed networks typically found in defence and emergency services, it is often not feasible to establish a separate dedicated network for the control channel. In such networks, traffic between SDN controllers and forwarding devices therefore needs to be in-band in the same network that the SDN controllers should control. This paper describes the steps necessary for forwarding devices to both discover and set up the connections with SDN controllers when in-band control channels must be used. The work expands on earlier published work on setting up in-band control channels between SDN controllers and the forwarding devices. Especially, our solution that uses the Intent frameworks of major SDN controllers improves on network resilience in disconnected, intermittent and limited networks and the solution will allow for implementation of enhanced security mechanisms compared to previous work.

Software Defined Network (SDN) is a new network construction. But due to its construction, SDN is vulnerable to be attacked by Distributed Denial of Service (DDoS) attack. So it is important to detect DDoS attack in SDN network. This paper presents a DDoS detection scheme based on k-means algorithm in SDN environment. The establishment of this scheme is based on the two hypotheses that the daily network works normally most of the time, and there is a significant difference between the data characteristics of normal situation and abnormal situation. At the same time, these two hypotheses are also true to the daily network condition. After demonstrating the validity of k-means clustering algorithm, the paper proposes 5 flow table features that can be used to detect DDoS attacks. Finally, the DDoS detection scheme was tested by simulation experiment. The test results showed that the method proposed by the author could effectively detect DDoS, with an average success rate of 97.78%.

Challenges and solutions in Software Defined Networking: A survey

Considering the problem that the SDN controller can not fully resolve the virtual network function during the Software Defined Network (SDN) and Network Function Virtualization (NVF) collaborative deployment in the satellite network, a SDN/NFV coordination based on the three-layer satellite network is designed. The framework extends the SDN controller function and proposes the SDN controller function extension method (SDN-FE) based on LightGBM algorithm. SDN-FE has extended the functions of the original SDN controller in three aspects. One is based on LightGBM to establish a classification model for intelligent forwarding of SDN controller data packets. The second is to learn and predict VNF modification of data packets through logistic regression. The third is to design an idle state monitoring mechanism. The above method effectively enhances the control capability of the SDN controller to the network. In terms of SDN packet forwarding classification, SDN-FE is compared with existing well-known machine learning classification algorithms such as SVM, random forest, LSTM. Simulation experiments show that the SDN packet forwarding classification problem is predictable. The average accuracy of the LightGBM model in multi-classification problems is over 69%, which is better than machine learning models such as SVM and random forest. The next step is to conduct an in-depth study of the packet rule learning algorithm in VNF.

This paper proposes a Traffic Engineering (TE) scheme for routing in a target network topology that supports OpenFlow using a metric called congestion contribution and Software-Defined Networking (SDN). According to the network traffic volume has been increasing dramatically, it is clear that the congestion, which is caused by the imbalance of the traffic flow, can be occurred. Furthermore, an Interior Gateway Protocol (IGP) that is used for an Autonomous System (AS) also can cause congestion because it uses snapshot information of network topology to make the shortest path-based routing table. Due to the reasons mentioned above, much research on TE has been conducting to enhance the network performance. However, as an example of TE, the Multi-Protocol Label Switching (MPLS) using Resource Reservation Protocol (RSVP) is not flexible in reconfiguring the labeled path, and it has resource overhead that cannot be ignored. Thus, we propose a TE scheme using SDN to overcome the limitations in the target network. In order to show the feasibility of the proposed scheme, TE application predicts the bandwidth utilization for network devices in SDN networks. It also determines the near-optimized routing path for the maximization of the average bandwidth utilization with avoiding the congestion nodes. Our scheme can configure network devices (e.g., SDN switches) along the paths of traffic flows so that the SDN network can have maximum bandwidth utilization. Through experiments, it is shown that our proposed scheme can utilize the average bandwidth of the whole topology up to 66%.