Intelligent SDN based traffic (de)Aggregation and Measurement Paradigm (iSTAMP)

Accurate traffic and latency measurements are the foundation of many network management tasks, including traffic engineering and network provision, network diagnosis and fault recovery. However, SNMP-based traffic measurement techniques in traditional IP networks only provide measurements for link loads, which cannot lead to accurate measurements. For link latency measurement, it has been shown that a traditional IP network needs to deploy a large number of monitors to achieve accurate measurements. The software-defined network (SDN) architecture opens up new opportunities to tackle the traffic matrix estimation and latency measurement problems. For the traffic estimation problem, the counter in a flow table entry of an SDN switch can directly measure the size of a matched flow. This dramatically increases the number and type of flows that can be measured accurately. For link latency measurement, SDN switches provide flexible routing and hence allow even non-shortest paths to be measured in the network. This routing flexibility can reduce the number of monitors deployed in the network to achieve a complete measurement of all the link latencies. But the additional measurement capabilities of SDNs also have limitations: the flow table entries added for measurements must be limited due to the high cost of ternary content-addressable memory (TCAM), and the amount of additional traffic for measurement should also be confined. Under these constraints, this research investigates the traffic matrix estimation and link latency measurement problems for a pure SDN network and a hybrid SDN network. A hybrid network, which consists of SDN switches and conventional routers, will exist for some time to come since it is economically impossible to replace every conventional router overnight. For the traffic matrix estimation problem, we propose a new estimation framework, which can be used in both SDNs and hybrid SDNs. Performance evaluation results show that the new framework can achieve highly accurate traffic measurement with a small number of TCAM entries. For the link latency measurement problem, we first present minimum monitor placement schemes in hybrid SDNs. It has been shown that our schemes not only reduce the number of required monitors but also guarantee full link measurements even when link weights change. We then present two time-stamp-based link latency measurement schemes for pure SDNs and show that the proposed schemes can minimize the number of consumed TCAM entries and the amount of traffic generated for measurement.

The Internet has reached a breaking point, enabling ubiquitous accessibility to all digital demands. Though people have accelerated their use of overall digital demands due to the convenience of the Internet, where nearly everything is connected and accessible, it is becoming increasingly difficult to manage and modify networks. It is always a challenge to meet the emerging needs of network industry. SDN framework was proposed to overcome traditional network architecture (TNA) restrictions in order to cope with contemporary network management in terms of flexibility, agility, responding to faults, and dynamic changes. SDN assists network operators by uncoupling the control plane from its underlying ternary content-addressable memory (TCAM) hardware often called as forwarding plane by allowing the networks to programme as per the anticipated network functionality. Now, switching from traditional to software-defined networking styles, it is worth to check the robustness of the open flow (south bound interface)-based controller platform and the capability of its fault tolerance attribute to approach the successful SDN implementation. The performance of SDN open flow controllers plays a vital role in SDN implementation, which is meant for the separation between control and data plane to leverage the life of network industry. This paper comprehensively surveys the contrast between traditional network architecture (TNA) and software-defined network architecture. This research work discusses about the best feasible SDN implementation, as well as the selection of a useful controller platform for overcoming traditional network constraints and the performance assessment criteria for SDN open flow controllers. Further, the survey is continued with possible literature or work done by various researchers on performance analysis and evaluation of open flow-based SDN controllers as well as in a group of two or more controllers with respect to multifarious network condition, network criteria/parameter/metric, scaling of network load resources with most important varying network topology design. Ultimately, it strives to point ongoing research omission with respect to controller’s performance bottleneck benchmark suggesting optimized solution when it is well experimented.KeywordsTraditional network architecture (TNA)Software-defined networking (SDN)SDN open flow controllersOpen flow protocolPerformance evaluation/analysis

Chapter 3 - HetNet/M2M/D2D communication in 5G technologies

Providing fine-grained traffic measurement is crucial for many network management and optimization tasks such as traffic engineering, anomaly detection, load balancing, power management, and traffic matrix estimation. Software-defined networks can potentially enable fine-grained measurement by providing statistics for each forwarding rule. However, the TCAMs that are used for rule matching and statistics generation have limited size due to their high cost and power consumption. This allows only a fraction of the flows to be monitored. In this article, we present DeepFlow, a framework for scalable software-defined measurement that relies on an efficient mechanism that a) adaptively detects the most active source and destination IP prefixes, b) collects fine-grained measurements for the most active prefixes and coarse grained for the less active ones, and c) uses historical measurements in order to train a Long Short-Term Memory (LSTM) model that can be used to provide short-term predictions whenever exact flow counters cannot be placed at a switch due to its limited resources. Thus the number of fine-grained flows measured can increase significantly without the need to use other flow sampling solutions that suffer from low accuracy. An extensive experimental evaluation study using real network traces shows that DeepFlow outperforms the baselines in terms of the total number of flows measured.

SummaryIn smart cities, a large number of vehicles are connected into an intelligent transportation system and share information via the vehicular communication network (VCN). Accurate, fine‐grained, and comprehensive traffic measurements are very crucial for the controller's decision making in software‐defined networking (SDN) in VCN. Fine‐grained traffic measurements can accurately portray network behaviors for VCN. However, this will increase a large amount of measurement overhead. Therefore, how to effectively obtain accurate and fine‐grained traffic is a huge challenge for VCN. To the end, this paper proposes a novel accurate and SDN‐based fine‐grained traffic measurement approach to obtain comprehensive traffic in VCN. Firstly, based on SDN architecture, we exploit the pull‐based sampling mechanism to quickly obtain coarse‐grained traffic measurement values. Secondly, based on the matrix completion theory, we use both interpolation and optimization methods to obtain fine‐grained traffic measurements. Thirdly, the optimization model and detailed algorithm are proposed to attain accurate traffic. Finally, we conduct a larger number of simulations to validate the measurement approach proposed in this paper. Simulation results show that our approach exhibits better performance and is promising.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

General traffic analysis based on Deep Packet Inspection (DPI) techniques at the gateways or access points cannot grasp the detailed knowledge of network applications going among internal nodes, and the statistics-based reports of routers are also lack of flow-level recognition of the traffic in the form of only five tuple. Therefore, network-wise accurate flow-awareness by packet sampling is highly desired for fine-grained quality of service guarantee, internal network management, traffic engineering, and security analysis and so on. In this paper, we propose a Spatio-Temporal Collaborative Sampling (STCS) problem based on the Software-Defined Networking (SDN) technique. The goal of STCS is to maximize the network-wise sampling accuracy of both elephant and mice flows, which considers both of the comprehensive influences of nodes and the effect on sampling accuracy imposed by the collaborative strategy among nodes in the time dimension. We present a approach to calculate the near optimal solution of STCS in two steps: 1) Top—K nodes selection by iterative comprehensive influence, and 2) spatio-temporal co-sampling solution based on the local value maximization strategy. We evaluate the proposed approach by a realistic large-scale topology, and the results show that the sampling accuracy can be effectively improved by the method, especially for mice flows, and the redundant ratio of sampled packets is reduced by 34.4%.

New applications such as soft real-time data center applications, algorithmic trading, and high-performance computing require extremely low latency (in microseconds) from networks. Network operators today lack sufficient fine-grain measurement tools to detect, localize, and repair delay spikes that cause application service level agreement (SLA) violations. A recently proposed solution called LDA provides a scalable way to obtain latency, but only provides aggregate measurements. However, debugging application-specific problems requires per-flow measurements since different flows may exhibit significantly different characteristics even when they are traversing the same link. To enable fine-grained per-flow measurements in routers, we propose a new scalable architecture called reference latency interpolation (RLI) that is based on our observation that packets potentially belonging to different flows that are closely spaced to each other exhibit similar delay properties. In our evaluation using simulations over real traces, we show that while having small overhead, RLI achieves a median relative error of 12% and one to two orders of magnitude higher accuracy than previous per-flow measurement solutions. We also observe RLI achieves as high accuracy as LDA in aggregate latency estimation, and RLI outperforms LDA in standard deviation estimation.

The SDN (Software Defined Network) characteristics of logically centralized control and programmability contribute on resolving security management and control problems of networking comprehensively and flexibly, however, there are still considerable issues presented by itself remaining to be solved. Based on the analysis of SDN architecture and security, this paper works on the security of south channel and gives a secure solution based on the OTR protocol. The proposed method has the forward security and safety certification characteristics, which can give a solution to the SDN for the security of authentication, key security save and SDN component hidden protection.

In a software-defined network (SDN), statistics information is of vital importance for different applications, such as traffic engineering, flow rerouting, and attack detection. Since some resources, e.g., ternary content addressable memory, SRAM, and computing capacity, are often limited in SDN switches, traffic measurements based on flow tables or sampling become infeasible. Sketch, a hash-based data structure, monitors every packet with fixed-size memory to provide a feasible approach of traffic measurement, but there exists a tradeoff between accuracy and memory. Currently, many efficient sketch algorithms have been designed to different purposes, but they focus on the performance and applications of one single sketch. In this paper, we present a scheme to reduce redundant flow statistics collected by sketches of different SDN switches. The proposed scheme could reduce measurement overhead in sketches, obtain more accurate estimate flow size, and find the elephant flow precisely.

In recent years, with the continuous expansion of the size of networks, the complexity of network structure and functionality and the volume of network traffic have immensely increased. This has resulted in severe challenges in configuring, operating and managing traditional networks. As a prominent way of monitoring and handling network status in order to optimize network structure, enhance the quality of service and achieve network error detection and recovery, software-defined networks, as a new emerging network structure, has considered all of these problems and suits these network applications well. This paper is a survey of the state-of-the-art research on measurement technologies in software-defined networks, of which we detail the design concept, performance approach, measurement objects, technical advantages and disadvantages from three standpoints: network performance, topology, and traffic measurement. We mainly cover latency, packet loss and bandwidth measurements when considering network performance measurement. Finally, the technological approaches are summarized and future research issues are discussed.

This study presents the development of a realistic and comprehensive SDN-ATK dataset designed to evaluate the effectiveness of machine learning (ML) and deep learning (DL) approaches for attack detection in Software-Defined Networking (SDN) environments. Unlike existing datasets, SDN-ATK explicitly includes attacks targeting key SDN components such as SDN controllers and OpenFlow switches, addressing a critical gap in current research. We evaluated three ML (XGBoost, Random Forest, and Decision Tree) and three DL (Convolutional Neural Network (CNN), Feed-forward Neural Network (FNN), and Long Short-Term Memory (LSTM)) algorithms across binary and multiclass classification tasks to assess detection performance. Our results demonstrate that DL models, particularly FNN and CNN outperform ML counterparts, achieving 98–99% accuracy, precision, and recall in binary classification. Explainability analyses were conducted using SHAP (SHapley Additive explanations) on the XGBoost model, offering valuable insights into the importance of feature and improving transparency in ML-based attack detection. The study’s findings provide critical guidance for both academia and industry, highlighting that within our Ryu-based SDN testbed, DL models demonstrated more reliable and balanced performance for large-scale attack detection. This work lays a solid foundation for future research, including developing real-time, intelligent, and explainable intrusion detection systems for SDN environments.

Software defined networking (SDN) has emerged as a new technology to enhance the flexibility, resilience, and automated centralized management of a network. Recently several reports have identified possible vulnerabilities, which may affect its authenticity, availability, confidentiality and integrity. This paper analyzes several types of security issues in SDNs, especially on how to secure the communication between the control plane and the data plane. The state-of-the-art security protocol TLS in SDNs has been verified using the Scyther Tool. Two security schemes, namely TLSHPS and TLSIHP are proposed to improve the handshaking procedures of the TLS. Security analysis with the Scyther tool shows that both proposed schemes work well to prevent various cyber attacks.

Software-Defined Networking (SDN) makes it possible to create networks that are adaptable and programmable through creating ways in which switches are able to forward the packets that are received based on the flow entries. The current work presents the model towards the visual representation of a network as well as evaluating its performance using OpenFlow SDN and MMPP. Mininet was used to evaluate the packet traffic in the network topology, whereas, the MMPP queue model was evaluated with matrix engineering. They help in network planning, in evaluating the consequences of traffic increase on the network and in understanding how various traffic rates are influenced by the network. It helps the network managers and planners to es-timate how much the performance of the whole network can change because of the difference in the traffic conditions and presents a precise tool facilitating the analysis, planning and scaling of IP networks. Further, it is suggested to apply the MMPP analysis to enhance knowledge of trends and performance indicators of the network. Lastly, issues and limitations of SDN and MMPP are discussed as part of reception improvements and to deal with areas that were considered in-sufficient in managing and evaluating the performance of the corresponding network.

This paper presents and evaluates a platform for monitoring service-level metrics in OpenFlow Software Defined Networks (SDN), named SDNMon. The platform supports frequent network observation, at different granularity levels, including per-flow observation, being able to present accurate on-the-fly statistics regarding throughput and delay. The evaluation considered two statistical data gathering approaches, a proposed polling-based mechanism which collects information kept by OpenFlow counters at the network elements, and an alternate sampling-based mechanism which uses sFlow.