End-to-end quality aware optimization for multimedia clouds

The proliferation of mobile demands and increasingly multifarious services pose challenges to both the radio access networks (RANs) and the core network (CN). Unfortunately, the traditional networks can hardly meet the increasing requirements. Software-defined network (SDN) and network virtualization (NV) are considered as innovative paradigms to stress these problems. By extending SDN to wireless networks, software-defined wireless network (SDWN) consisting of both RANs and CN can be obtained. In this paper, the RANs and CN of SDWN are virtualized to virtual access points (VAPs) and network slices respectively based on NV technology. Considering the system scenario that a SDWN consists of overlapping RANs, an optimal joint VAP and network slice selection scheme is proposed. To characterize the complicated transmission performance of VAPs and network slices, the concepts of utility function and network calculus are introduced, and the joint utility of VAPs and network slices is formulated based on which the optimal VAP and network slice combination corresponding to the maximal joint utility can be selected. The simulation results demonstrate the efficiency of the proposed scheme.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

The nature of computer network flash crowd traffic, which is generated by legitimate users accessing servers or other network resources are similar to the traffic generated by Distributed Denial of Service (DDoS) like attacks. With advancement in spoof packet generation tools, attacker may generate Multi-source Multi-destination Multi-protocol (MMM) traffic; characteristics of such traffic are very similar to on-going genuine/ flash crowd traffic in the network. In the case of Software Defined Network (SDN), attacker’s target is controller plane. Controller plane in SDN is a centralized processing unit of the underlying network, which manages several data planes. Controller plane frames the policies and pushes forwarding rules to the data planes. Data planes just maintain the forwarding rules. Thus by overloading the SDN controller, functionality of complete computer network will be hampered. In this paper, we have proposed Media Access Control (MAC) address based Model to Differentiate Flash crowd and Malicious traffic in SDN (MDFMS). Novelty of the proposed model is to detect, locate and mitigate the source of Traditional DDoS (T-DDoS) and MMMDDoS traffic. MDFSM has been implemented on separate machine to avoid any additional computing load on SDN controller. It also preserves the original design of the SDN architecture. Proposed model has been evaluated under various scenarios and encouraging results have been obtained to differentiate T-DDoS and MMM-DDoS from benign flash crowd traffic.

Network virtualization (NV) becomes an essential technology in cloud computing that isolates network flows for tenants. However, because existing NV technologies like overlay do not enable tenants to directly program (i.e., provision, control, and monitor) network resources, software-defined networking (SDN)-based NV (SDN-NV) has been proposed. Despite its great benefits, SDN-NV has been believed to bring considerable overheads due to the network hypervisor (NH). However, to date, there is no definite performance evaluation that proves the overheads of SDN-NV. To this end, this paper comprehensively investigates the performance and overheads of SDN-NV. Our experiment results reveal that SDN-NV provides the data plane performance comparable to or even better (up to 10.5× better TCP throughput) than the existing NV technologies. Also, the results on NH show that its overheads remain mostly constant, even when the number of switches, virtual networks, or network flows increases. In short, our evaluation indicates that the overhead of SDN-NV should not deter its practical use in datacenters.

The expected higher complexity of upcoming 5G wireless backhauls suggests the need to evolve towards a softwaredefined networking (SDN) paradigm to increase the degree of programmability of these networks. Within the context of softwaredefined wireless backhaul, one important issue is the provision of an even resource consumption of both network and IT resources. Backpressure policies have shown their ability to balance resource consumption in traditional (non-SDN) wireless backhauls. This paper analyzes two use cases in which backpressure policies can be integrated in software-defined wireless backhaul to manage network and IT resources. The first use case proposes an SDN application based on a centralized backpressure policy to balance network resources in the wireless backhaul. Simulation results reveal how the granularity of routing decisions in the SDN application significantly affects the data plane performance, suggesting a trade-off between data plane performance and overload in the control plane. The second use case proposes a distributed backpressure policy to deal with the management of computing resources by balancing the processing load caused by OpenFlow (OF) switch requests among the available distributed SDN controllers. Simulation results demonstrate how a dynamic and distributed backpressure policy can balance the processing load amongst different SDN controllers, hence, leading to significant improvements with respect to static mapping policies.

PON versus AON: Which is the best solution to offload core network by peer-to-peer traffic localization

SummaryMobility management (MM) in Long‐Term Evolution (LTE) networks is a vital process to keep an individual User Equipment (UE) connected while moving within the network coverage area. MM Entity (MME) is the LTE component responsible for tracking and paging procedures and controlling the corresponding signaling between the UE and its serving cell, which is necessary for data‐packet exchange. Because of the massive increase in the density of mobile UEs, MME is burdened by the high volume signaling load, especially because most of that load comes from Tracking Area Update (TAU) and Paging messages, which are essential to exchange UE‐specific information with the network. To achieve cost‐efficient resource provisioning, many solutions have been proposed for TAU and Paging management to optimize not only UE experience (ie, battery power consumption) but also network resources (ie, bandwidth). In this paper, we discuss various solution schemes for TAU and Paging in terms of complexity, latency, and computation costs. Also, this review discusses the adverse effects of these solutions on the LTE Key Performance Indicators (KPIs). Furthermore, we present a new trend of MM solutions in LTE networks, called software‐defined network (SDN) and software‐defined virtualization (SDNV). To this end, we examine the existing schemes and challenges in the literature toward next‐generation wireless networks (eg, 5G, Internet‐of‐Things [IoT], and machine to machine [M2M] communications), and we describe user mobility models that are used to analyze the network performance.

Software defined network (SDN) with disjoint control and data plane enables the controller to address network requirement better. A significant issue in such networks is how the network resources are allocated by the controller based on the demand, for instance, allocation of path with less delay, less error rate and so forth. The controller allocate such network resources by enabling link discovery between switches. SDN utilizes protocol like link layer discovery protocol (LLDP) for links to be identified in OpenFlow devices. The detection of links in OpenFlow devices requires a huge number of PACKET OUT (P <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">out</inf> ) messages from the controller to be sent across every active interfaces of the switch which might limit the controller performance. This paper introduces a Broadcast based Link Discovery (BBLD) scheme which lowers messages required to obtain the link discovery in OpenFlow switches (OFS’s) by dispatching a solitary P <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">out</inf> from the SDN controller (unlike a unicast message from the controller in case of LLDP) to any OpenFlow switch (OFS), which then circulates the same to the nodes successively. Experiments performed with Mininet reveal that messages required to obtain similar link discovery are reduced by an average of (28%-42.4%) under varied set of topologies.

This paper presents the study of the relationship between Autonomic Network Management (ANM) and Software-Defined Networking (SDN) under the prism of Long Term Evolution (LTE) Self-Organizing Networks (SONs). The ANM and SDN paradigms, besides sharing a few common goals, have shown to be complementary to each other in terms of level of abstractions and expectations. In particular, we consider the Unified Management Framework (UMF) introduced in the FP7 UNIVERSELF project, which focuses on higher level self-* functionality, often assuming as given a fictional adaptation layer between such autonomics and the managed infrastructure. On the other hand, SDN architectures provide by design a uniform control substrate for the programmatic management of network resources through vendor-agnostic APIs. However, despite the popularity of flow-based control in core networks and data centers, a similar widely-adopted abstraction to that of the "flow" have yet to be defined for radio access and SONs. In this work we propose such a novel abstraction layer designed to realize SON programmability. The prototype Autonomic SDN (AutoSDN) controller has been integrated with UMF to self-optimize an LTE-Advanced heterogeneous network, enabling SON functions to be provided by 3rd parties and to be hot-plugged into the network.

Network function virtualization, software-defined networking, and cloud computing are the key technologies that enable dynamic, resource-efficient service provisioning in 5G networks. Auto-scaling mechanisms are an essential factor for efficient resource utilization and improved quality of experience in such networks. Autoscaling is also a defence against attacks such as Distributed Denial of Service (DDoS) but with a price. Service providers can use different European Telecommunications Standards Institute (ETSI) stack-based Network functions virtualization (NFV) management and orchestration platforms for autoscaling and dynamic resource provisioning. However, such platforms pose a risk of side channel information leak between the orchestrator and cloud. Tapping this side channel information, an adversary can infer the auto-scaling policy, scale-up/down, and cloud platform in order to launch an attack. We emulate a scalable 5G network OpenAirInterface5G bundle using Juju as a service. Using this open-source realistic 5G emulator testbed, we carry out experiments with various cloud platforms such as Openstack, Amazon Web Services (AWS), and Microsoft Azure clouds. We use MIT tale of many cities spatio-temporal load patterns that traces mobile traffic as dataset for our experiments. We show how an adversary could infer the resource scalability and type of cloud platform by analyzing as simple information as packet flow between the orchestration platform and the cloud. We use the opensource tool Zeek for intrusion detection and showed its effectiveness in detecting volume based DDoS attack in 5G. In order to evade the intrusion detection mechanism, we propose an algorithm and demonstrate a way to intelligently craft the DDoS attack with User Equipment (UE) bots.

Fifth generation (5G) cellular networks demand high throughput with low levels of delay and congestion within the core network. Excessive throughput demands at the core network with the exponential increase in the number of mobile users and devices have become major challenges for 5G. Several techniques have been developed for offloading traffic at the front line of cellular networks. For example, Local IP access (LIPA) and selective IP traffic offload (SIPTO) are current data offloading technologies. In this article, we propose femtocell IP access (FIPA) and selective local controller traffic offloading (SLCTO) technique to offload traffic at the edge of the cellular network without forwarding it through the core network. Our proposed FIPA and SLCTO technologies rely on our previously proposed 3-Tiered software defined networking (SDN) architecture for dense networks (DenseNets). According to our simulations, FIPA and SLCTO over a 3-Tiered SDN architecture outperform existing offloading techniques with low delay, high throughput, and low cost.

Software-defined networking (SDN) has reformed the traditional approach to managing and configuring networks by isolating the data plane from control plane. This isolation helps enable centralized control over network resources, enhanced programmability, and the ability to dynamically apply and enforce security and traffic policies. The shift in architecture offers numerous advantages such as increased flexibility, scalability, and improved network management but also introduces new and notable security challenges such as Distributed Denial-of-Service (DDoS) attacks. Such attacks focus on affecting the target with malicious traffic and even short-lived DDoS incidents can drastically impact the entire network’s stability, performance and availability. This comprehensive review paper provides a detailed investigation of SDN principles, the nature of DDoS threats in such environments and the strategies used to detect/mitigate these attacks. It provides novelty by offering an in-depth categorization of state-of-the-art detection techniques, utilizing machine learning, deep learning, and federated learning in domain-specific and general-purpose SDN scenarios. Each method is analyzed for its effectiveness. The paper further evaluates the strengths and weaknesses of these techniques, highlighting their applicability in different SDN contexts. In addition, the paper outlines the key performance metrics used in evaluating these detection mechanisms. Moreover, the novelty of the study is classifying the datasets commonly used for training and validating DDoS detection models into two major categories: legacy-compatible datasets that are adapted from traditional network environments, and SDN-contextual datasets that are specifically generated to reflect the characteristics of modern SDN systems. Finally, the paper suggests a few directions for future research. These include enhancing the robustness of detection models, integrating privacy-preserving techniques in collaborative learning, and developing more comprehensive and realistic SDN-specific datasets to improve the strength of SDN infrastructures against DDoS threats.

Network virtualization is seen as a key networking paradigm for building diverse network services and architectures over a shared network infrastructure. Assigning network resources to virtual links and, more generally to virtual network topologies, efficiently and on-demand is one of the most challenging components of any network virtualization solution. This paper addresses the problem of on-line resource allocation of multiple virtual links on a Software Defined Network (SDN) infrastructure. The application context that is targeted is primarily the online provisioning of virtual overlay networks even if it can be broadened to address more general virtual networks. Considering an SDN physical infrastructure allows a complete freedom in choosing the optimal physical paths and the associated resources that support the virtual links with no interference from any other network function (such as routing). However, for the time being, forwarding in an SDN network is resource consuming with a noticeable impact on the size of the flow tables. Hence, forwarding (i.e. switching) resources should be carefully considered by the network resource allocation algorithm. This paper proposes a novel Integer-Linear formulation of the above cited problem by taking into account: (1) point-to-point as well as point-to-multipoint virtual links, each with an associated bandwidth requirement and a maximum transfer delay requirement, (2) two types of network resources, namely network links' bandwidth and nodes' switching resources, and (3) optionally, path splitting which allows a virtual link to be established on multiple physical paths. We report preliminary experimental results on a real network topology in an overloaded scenario (bandwidth requests largely exceed network capacity); they show that our algorithm outperforms shortest path heuristics with a gain on the admission rate (of virtual links requests) that ranges from 5 to 15% (compared to the most efficient heuristic) and with a computation time less than a few seconds.

The emerging networking standards such as 5G and 6G, coupled with technologies like Software Defined Networks (SDN) and Network Function Virtualization (NFV), are increasingly moving towards a multi-tenant and multi-vendor deployment model. Under these circumstances, the hardware vendors rent their networking and computation resources to multiple service providers and application developers. Such a deployment model lets various vendors collaboratively offer networking services to the tenants and the end-users at far greater efficiency and better affordability. However, the issues around trust, ownership, and data security become a concern for tenants and vendors in such multi-tenant and multi-vendor setting. In particular, the centralized nature of SDN controllers, together with the limitations of the contemporary authentication and access control mechanisms, make multi-stakeholder SDN deployments susceptible to several Sybil and trust-related exploits. We present EDISON, a blockchain-based authentication and access control framework, for multi-stakeholder SDN infrastructure that adheres to the Zero-trust security model. It allows the network vendors and third-party service providers to securely set up a service-level agreement while enabling the concerned stakeholders to audit the network operations through an end-to-end encrypted tamper-proof ledger. EDISON creates an ecosystem structured on smart contracts, wherein the network elements rented and used by the tenants interact with the services deployed in the form of contracts to enable decentralized and transparent orchestration.

Dynamic resource provisioning is a challenging technique to meet the service level agreement (SLA) requirements of multi-tier applications in virtualization-based cloud computing. Prior efforts have addressed this challenge based on either a cost-oblivious approach or a cost-aware approach. However, both approaches may suffer frequent SLA violations under flash crowd conditions. Because they ignore the benefit gained that a multi-tier application continuously guarantees the SLA in the new configuration. In this paper, we propose a benefit-aware approach with feedback control theory to solve this problem. Experimental results based on live workload traces show that our approach can reduce resource provisioning cost by as much as 30% compared with a costoblivious approach, and can effectively reduce SLA violations compared with a cost-aware approach.