Implementing Static Router based on Software Defined Networking

Artificial intelligence based load balancing in SDN: A comprehensive survey

Software-defined networking is a new paradigm that overcomes problems associated with traditional network architecture by separating the control logic from data plane devices. It also enhances performance by providing a highly-programmable interface that adapts to dynamic changes in network policies. As software-defined networking controllers are prone to single-point failures, providing security is one of the biggest challenges in this framework. This paper intends to provide an intrusion detection mechanism in both the control plane and data plane to secure the controller and forwarding devices respectively. In the control plane, we imposed a flow-based intrusion detection system that inspects every new incoming flow towards the controller. In the data plane, we assigned a signature-based intrusion detection system to inspect traffic between Open Flow switches using port mirroring to analyse and detect malicious activity. Our flow-based system works with the help of trained, multi-layer machine learning-based classifier, while our signature-based system works with rule-based classifiers using the Snort intrusion detection system. The ensemble feature selection technique we adopted in the flow-based system helps to identify the prominent features and hasten the classification process. Our proposed work ensures a high level of security in the Software-defined networking environment by working simultaneously in both control plane and data plane.

The implementation of Software-Defined Network(SDN) across multiple data centers aims to simplify thecontrol and management of networks. However, the increasingpopularity of SDN has also attracted the attention of attackers.To tackle this problem, it is essential to have an intrusiondetection system (IDS) in place, which plays a crucial role incybersecurity by addressing external threats. The advantageof SDN’s centralized nature is that it facilitates the training ofan IDS based on machine learning. However, there is a scarcityof research specifically focused on intrusion detection in SDN.Existing literature often treats SDN intrusion detection assimilar to traditional computer systems and relies on intrusiondatasets generated for those systems. We explore the issueof intrusion detection in SDN using the most recent publicdataset (InSDN). However, InSDN is an imbalanced data set.In this paper, we have recommended a method to balance thedata as well as a method to find the best features to improvethe quality of IDS using Machine Learning. In addition, wealso suggest a method of classifying SDN network traffic andnormal network traffic. At the same time, we also evaluate theefficiency of the SDN system with the load balancing systemand without the load balancing system.

Software-Defined Networking (SDN) is a networking design approach, which separates the data plane from the control plane, providing the network with certain benefits due to centralized programmatic control. SDN provides a centralized view and enables management of the entire network. It offers flexibility in configuration, reduces time to deploy, provides automation and facilitates building a network without requiring the knowledge of any vendor-specific software/hardware. SDN offers the datacenter network benefits such as improving traffic and security management as well as providing a scalable infrastructure. Load balancing enhances the performance of the network by distributing traffic among servers and therefore preventing congestion and server underutilization. This paper aims to explore SDN and test its implementation and demonstrate how to implement its concepts within a datacenter network. The experiment considers the datacenter network implemented in Sudan University of Science and Technology as a case study. The edited network topology is made up of a Demilitarize Zone (DMZ) having three servers, a Local Area Network (LAN) and a main switch. The Hub, Switch and Load balancer scenarios are implemented using Mininet emulator. In addition, the three scenarios are tested using external devices and analyzed using Wireshark. Moreover, the connectivity of HTTP and FTP is verified.

On the use of the genetic programming for balanced load distribution in software-defined networks

Security elements of data communication networks such as packet filters, firewalls, intrusion detection and prevention systems are in first line of defense against cyber security threats and various attacks such as DDoS and many others. With constantly increasing demand of compute power and grow of various cloud services, complexity of traditional networks makes it more difficult to maintain security policies in fast and safe manner. To simplify management and overcome limitations of traditional networks concept of software-defined networking (SDN) was proposed. The main idea of SDN is separation of control and data planes of devices. Combined control plane into network controller brings intelligence into network and open wider possibilities for automation. Separated data plane makes it possible for devices to run in headless mode during critical situations when control plane is not functioning. SDN also simplifies managing of security policies, it helps to ensure intime deploying and minimize possibility of mistake. However, SDN architecture has some places which can be used as main point of cyber-attack. Purpose of this paper is to describe security benefits and drawbacks of software-defined network.

Software-defined networking (SDN) is a network approach achieved by decoupling of the control and data planes. The control plane is logically centralized and the data plane is distributed across the network elements. The real-time network is in need of the incorporation of distributed controllers to maintain distributed state information of the traffic flows. Software-based solutions aid distributed SDN controllers to handle fluctuating network traffic and the controller’s configurations are dynamically programmed in real time. In this study, SDN controllers were programmed with a stateful firewall application to provide firewall functionalities without the support of committed hardware. A stateful firewall filtered traffic based on the complete context of incoming packets; it continuously evaluated the entire context of traffic flows, looking for network entry rather than specific traffic flows. In addition, a flow-based scheduling module was implemented in the distributed controllers to improve network scalability. A network cluster was configured with three distributed controllers and we experimented with three independent network topologies. The performance of the proposed network model was evaluated by measuring and analyzing metrics such as network throughput (kbps), delay (ms) and network overhead (pkt/ms) for various combinations of controllers and topologies. The results of the analysis were determined using the mininet emulator. The findings of the performance evaluation indicate that the distributed SDN controllers performs better than a centralized controller. When comparing distributed SDN with two controllers and distributed SDN with three controllers the overall network throughput is increased by 64%, the delay is decreased by 43% and network overhead is reduced by 39%.

Attack-aware Security Function Management

In traditional networking devices, there is a tight coupling of data plane and control plane. It handles a huge volume of traffic on the Internet which is not possible in traditional networking devices. The strategy emerged of disassociating the control plane from the data plane is defined as software-defined networking (SDN). The rapid increase in the number of Internet users is becoming a difficult task for conventional load balancers to handle network traffic. SDN provides power over the network from the centralized controller to distinguish between the control plane and the data plane. SDN is a prominent technology in today’s Internet. Nowadays, our networks handle the extensive amount of traffic that serves the hundreds and thousands of clients where it is very difficult for the single server to handle such a huge load. To overcome this problem, the load balancing technique came into existence. The main purpose of this work is to show how SDN applications can be created without using any controller and analyze the efficiency/effectiveness of load balancing algorithms based on SDN.

The traditional networks, with the control and data plane integrated into the same network devices, do not provide a global view of the network performance like degree of congestion, bandwidth utilization, etc. Software defined network (SDN) is an approach towards this problem which separates the control plane of the switch from its data plane and provide a centralized control plane so as to get a global view of the network performance and thus make decisions of how to regulate flows. In SDN, network monitoring can be achieved more efficiently than traditional networks using OpenFlow statistics. SDN controller can keep track of available bandwidth on each link and thus estimate end-to-end available bandwidth of a path simply by composing individual link bandwidths thus avoiding end-to-end probing. We have made two contributions in this paper: (i) proposed and validated a method to estimate end-to-end available bandwidth on any given path by composing link-wise available bandwidths (ii) proposed a method to measure link capacity using OpenFlow protocol. We compared our results to the ones obtained using the state-of-the-art bandwidth measurement tool, Yaz.

The traditional load balancers suffer from inflexibility and difficulty to manage network flows and they are very expensive hardware dedicated devices. Software-Defined Networking (SDN) gives a promising solution for traditional load balancer limitations. SDN is a new paradigm which enables programmability and centralized control for the network which offers inexpensive and flexible solutions. This paper aims to develop a new load balancing approach using SDN. We propose a “Bandwidth-based” load balancing approach that distributes the network requests among multiple servers based on the servers' bandwidth consumption. The performance of the proposed scheme is evaluated and compared with different load balancing schemes (Round-robin and Connections-based) under a mininet emulation and a Raspberry Pi-based implementation. Emulation and hardware implementation results reveal a better performance of the proposed approach compared to the two reference schemes.

The Internet is definitely the greatest contributor to globalization which has brought together the whole world and has made every nook and corner attainable. The conventional IP networks have not been able to serve the purpose of a simplified infrastructure even after their extensive acquisition. Service provider networks are not fully fledged in providing (1) fast switching in the core network without any routing lookup, load balancing and retort to faults, (2) reorganize the network according to prevailing network policies and terms simultaneously. Software-defined network (SDN) which operates on OpenFlow protocol is a revolution in networking which aims to remodel the traditional network by disintegrating the data and control planes. It bifurcates the control logic from the various network devices like routers and switches, by providing a core supervisory control logic for the entire network and delivering aptness to code the network. In traditional routing, the information is flooded to the entire network which causes overutilization of resources, high bandwidth requirements, and many other drawbacks. Compared to the legacy routing, SDN is more effective in route computations and provides complete control for packet transmission. The paper proposes a method to find the shortest path routing between the source and destination using the Bellman–Ford routing algorithm. Secondly, the routing emulations for various network topologies are presented and compared using Mininet which implements routing for SDN. The comparative analysis of both the scenarios shows that the routing algorithm proposed in this paper contributes utmost QoS.

An intrusion detection system (IDS) is an essential component of any modern network. The purpose of an IDS is to detect intrusion and generate appropriate alarms so that the intrusion can be mitigated. Implementing an IDS in a Software Defined Network (SDN) is easier since an SDN controller has a centralized view of the whole network. Researchers have made many efforts to use machine learning (ML) for developing network-based IDS in SDN. The network-based IDS analyzes different characteristics of incoming network traffic to detect intrusion. Early detection of intrusion is crucial for an IDS because if the intrusion is not detected quickly enough, it can cause severe damage, such as data breaches and service shutdowns. This paper focuses on detecting intrusion in SDN as early as possible using real-time flow-based features. Our aim is to detect intrusion with less amount of packets per flow, which not only facilitates early intrusion detection but also is useful when an intrusion flow has less number of packets. We show that although ML models perform well in offline training on a dataset, their performance decreases ~25% when fewer packets are used to generate features for the ML model. In all our experiments, a simple Random Forest (RF) algorithm outperforms a complex deep learning model on a publicly available dataset for intrusion detection in SDN.

Software-defined networking (SDN) is an innovative network technology. It changed the world of computer networking by providing solutions to many challenges. SDN provides programmability, easy and centralized network management, dynamic configuration, and improved security. Although SDN offers remarkable benefits but it provides centralized network management which is prone to attacks. So, intrusion detection systems (IDS) are essential to detect and prevent security attacks in SDN. Traditional IDS follow a centralized machine learning approach which causes vulnerabilities in IDS. Old-style IDS lack data privacy preservation, and solution for training data unavailability due to privacy. Federated learning (FL) is a distributed machine learning approach which provides a collaborative training approach without data sharing. In FL, training is performed on multiple nodes creating a global model without sharing the data. To address challenges and the limitations of traditional IDS, we proposed a FL based multi class classification IDS for SDN. FL delivers an efficient and scalable solution to address challenges of traditional IDS. The proposed model enhances security of SDN by not requiring the centralization of data. To test the impact and efficiency of proposed model, we used a latest and realistic cybersecurity dataset. We also compared the proposed model with state of art existing multi class classification studies. The results and their comparison with existing studies highlight the potential of proposed model to enhance network security while providing a privacypreserving learning environment for intrusion detection.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.