RESEARCH OF SDN NETWORK PERFORMANCE PARAMETERS USING MININET NETWORK EMULATOR

Existing technologies and methods for building an SDN network with a hybrid, interdomain topology based on the Mininet network emulator, using different types of controllers, are considered. As a result, a segment of the SDN network was created to test the process of its functioning in the overload mode of various information directions based on the MiniEdit GUI. It is a powerful and flexible tool for visualizing the topology of an SDN network, and allows you to: simulate SDN networks of a rather complex structure; change the performance of branches and the magnitude of the load in the directions of communication; create a network-wide overload mode. In the process of modeling, it is possible to determine a number of network performance indicators: the RTT (Round Trip Time) parameter for each information direction; bandwidth of communication links and directions; the amount of delay on network elements, the number of functioning information directions; number of served and lost packets. Although GUI MiniEdit has a number of advantages due to the visualization of the process of building the required custom topology of the SDN network, as well as convenient configuration of network elements, however, in the case of building a domain structure using different types of controllers, it requires additional installation and more complex configuration of external software packages. Also, the editor with a graphical interface does not allow you to explicitly set the rules for the distribution of information flows in case of congestion in certain sections of the network.

Software Defined Network (SDN) Technology made tremendous changes in networking field by controlling the hardware with remote software by decoupling data plane and control plane. The focus here is on the controller which is part of control plane. A controller is a central part of SDN; it is an intermediary between Data plane and Forwarding plane. It takes prime place in SDN architecture like Operating System in Computers. SDN Controller is a software which directs the packets using flow rules and also contains statistical information of network. The controller orchestrates the networking devices such as switches and routers by channelizing the packets. SDN controller has different flavor based on the commercial requirement achieved by including new pluggable module. This paper discusses some of the SDN Controller with their feature; the controllers are POX, NOX, Floodlight, ODL, Open Contrail. This paper also compares the characteristic of centralized and distributed controller by focusing on performance, bandwidth and round-trip time of Floodlight and Open Daylight (ODL) controller. The simulation is conducted using Mininet.

As the traditional network architecture can not meet the requirements of network users for high-quality network services, software defined network (SDN) has been proposed as a new network architecture. SDN divides the data plane and control plane in the network equipment, so that the controller can schedule the data in the network flexibly through openflow protocol. Floodlight and Ryu are two typical SDN controllers proposed for different purposes. In this paper, we first introduce Floodlight and Ryu, and then introduce the tools used in the paper: mininet and qperf. Then, we simulate the two controllers of Floodlight and Ryu, and compare their bandwidth and delay performance under different network topologies. The experimental results show that in all kinds of topology, the Floodlight controller has higher bandwidth and lower latency than Ryu controller, so the Floodlight controller has better performance.

Software-defined networks (SDNs) are novel networking architectures that decouple the network control and forwarding functions from the data plane. Unlike traditional networking, the control logic of SDNs is implemented in a logically centralized controller which provides a global network view and open programming interface to the applications. While SDNs have become a hot topic among both academia and industry in recent years, little attention has been paid on the security aspect. In this paper, we introduce a novel attack, namely, packet injection attack, in SDNs. By maliciously injecting manipulated packets into SDNs, attackers can affect the services and networking applications in the control plane, and largely consume the resources in the data plane. The consequences could be the disruption of applications built on the top of the topology manager service and rest API, as well as a huge consumption of network resources, such as the bandwidth of the OpenFlow channel. To defend against the packet injection attack, we present PacketChecker, a lightweight extension module on SDN controllers to effectively detect and mitigate the flooding of falsified packets. We implement a prototype of PacketChecker in floodlight controller and conduct experiments to evaluate the efficiency of the defense mechanism. The evaluation shows that the PacketChecker module can effectively mitigate the attack with a minor overhead to the SDN controller.

In light of the existence of the software defined networking (SDN) southbound communication protocol OpenFlow, and manufacturers’ neglect of network security, in this paper, we propose a protection scheme for encryption at the source of the communication data that is based on the Kerberos authentication protocol. This scheme not only completes the identity authentication of and session key assignment for the communication parties on an insecure channel but also employs an efficient AES symmetric encryption algorithm to ensure that messages always exist in the form of ciphertext before they reach the end point and thus obtain end-to-end security protection of communication data. At the end of this paper, we present our experimental results in the form of a forwarding agent. After that, the performance of the Floodlight controller is tested using a CBench testing tool. Our results indicate that the proposed source encryption scheme provides end-to-end encryption of communication data. Although the communication latency increases by approximately 12% when both transport layer security (TLS) and source-encrypted are enabled, the source-encrypted part of the increase is only approximately 4%.

Efficient network monitoring is an important basis work for network management. Generally, many management applications require accurate and timely statistics about network states at different aggregation levels at low cost, such as malicious traffic detection, traffic engineering, etc. Moreover, the network environment to be monitored is constantly changing and expanding, including not only the data center for cloud computing but also the Internet of Things (IoT) for smart urban sensing, which requires the intensive study of more fine-grained network monitoring. As is well known, the development of efficient network monitoring approaches greatly relies on a flexible monitoring framework. Software defined network (SDN) can provide dramatic advantages for network management by separating the control plane and data plane. Therefore, it is a good choice to design a flexible monitoring framework based on the advantages of SDN. However, most research works only take advantage of the centralized control feature in SDN, which leads to limited improvement in the flexibility of the monitoring framework. This paper proposes a flexible monitoring framework named FlexMonitor, which can realize greater flexibility based on not only the centralized control feature, but also the high programmability in the controller and the limited programmability in the openflow switches in SDN. There are two key parts in FlexMonitor, namely the monitoring strategy deployment part and the monitoring data collection part, which can enrich the deployment methods of monitoring strategies and increase the kinds of monitoring data sources, respectively. Based on the NetMagic platform, this monitoring framework was implemented and evaluated through realizing a distributed denial of service (DDoS) detection approach. The experimental results show that the proposed DDoS detection approach has a better detection performance compared with other related approaches as well as indirectly show that FlexMonitor can flexibly support a variety of efficient monitoring approaches.

Network administrators employ a variety of security policies to protect the data and services. However, the lack of standard control protocol and distributed network control causes these policies to be complicated in traditional networks. An ideal paradigm is provided by Software Defined Network (SDN) to address these challenges through separating the control plane from data plane. Security policies are enforced by logically centralized control's which take advantage of SDN. In this paper, we present a fully configurable system for an institution using POX which is a famous SDN controller. A network administrator can enforce the policies related to security, access and control through it. So that a single change in policy will be reflected in all the OpenFlow switches, attached to the SDN, resulting in reduced cost and time, as compare to the conventional networks where each switch is managed individually. The purpose of this research is to achieve a secure and controllable SDN by blocking the malicious and restricting the anonymous users in the network.

Intent-Based Networking (IBN) is an emerging networking paradigm while Moving Target Defense (MTD) is an active security technique. In this paper, the Intent-based Moving Target Defense (INMTD) framework using Software Defined Networks is proposed. INMTD is the first effort in exploiting IBN for the design of an efficient Moving Target Defense (MTD) framework. INMTD uses the concept of shadow servers in order to counter the first stage of cyber-attacks, i.e. reconnaissance attacks targeted against servers running in SDN networks. INMTD comprises of an MTD application running on an SDN controller. The MTD application has reconnaissance detection, MTD movement, and MTD monitoring modules. The MTD application is integrated with the intent-based northbound API of SDN controller. INMTD not only provides protection against probing attacks, but it also provides high availability due to shadow servers. The proposed framework was implemented using Mininet and ONOS SDN controller. The proposed framework was assessed in terms of defender cost, attacker’s effort, and introduced complexity in the system. The results substantiate the efficient protection against reconnaissance attacks at lower computational cost.

The performance characteristics of optical transport communication networks based on the technology of spectral separation of channels using a transmitting and receiving optical module (TOM and ROM) are analyzed. The performance indicators of optical transport networks based on optical WDM & DWDM technologies are investigated and a method for calculating an optical signal transmission system (OSTS) is proposed. This method takes into account the principles of spectral separation of optical channels and operation algorithms, the functioning scheme of the studied fiber-optic transmission systems, as well as information security indicators of fiber-optic communication lines using quantum cryptography. Based on the calculation method, important analytical expressions were obtained that evaluate the performance indicators of multiservice optical telecommunication networks based on the FN (Future Network) architectural concept using SDN (Software Defined Network) technology.

Software-defined networking (SDN) is a state-of-the-art architectural approach to network management that allows more flexible management of a complicated large-scale network. For providing services with high performance, availability, and scalability, server clustering is widely used. This study develops a server cluster based on OpenFlow, which is the most common SDN protocol. To utilize cluster resources effectively, this study focuses on the server-side load-balancing issue and increases the performance for a cluster of servers with different processing capabilities. We have proposed a novel load balancing algorithm, named dynamic weighted random selection (DWRS). DWRS considers the real-time server loads when dispatching requests to servers. Underutilized servers are assigned higher weights, so they have a higher possibility of being selected to process requests. To increase system performance, we modify the flow of packet handling in the Floodlight controller. A multi-threaded technique is used to effectively utilize the parallel processing capability of multiple cores, which speeds up the processing of packet-in messages when selecting the target server. This prevents the controller from becoming overloaded, especially when a large number of packet-in messages arrive. To demonstrate effectiveness and feasibility, we deploy our experimental environment using real hardware, instead of using Mininet to set up a virtual SDN testbed. Experimental results show that the proposed DWRS with multi-threaded implementation outperforms other policies, especially in a heterogeneous environment.

ABSTRACTIn Software‐Defined Networking (SDN), the routing process involves packet forwarding based on flow rules managed by the controller. However, attackers could exploit this situation by launching Distributed Denial of Service (DDoS) attacks using spoofed source addresses, which can overwhelm the controller with a large number of fake packets. Most of the prior works in this scenario are based on an address binding method; the source address of each packet coming from a host_port of a switch is checked against the entries in a binding table. This table consists of the actual source address of each host attached to a host_port. This approach can identify the source points of attacks within a short time; however, it suffers from high controller overhead because each packet needs to be matched against the entries in the binding table. In this context, we propose a Hybrid Defense System (HDS) which consists of a two‐stage detection method. In the first stage, a lightweight entropy‐based method detects address spoofing in network traffic, which in the process, significantly reduces the overhead of checking every packet against the binding table. If an attack is detected, the second stage gets activated, in which a time‐based address binding approach identifies the source points of attacks. Thereafter, a mitigation method blocks the source points of the attacks. HDS is implemented in the Floodlight controller and is evaluated in different networking scenarios using Mininet. Our experimental results show that HDS reduces the controller overhead by 10%–12%, lowers the False Positive Rate by 20%, and reduces the False Negative Rate by 10% in comparison to the existing address binding methods.

Recently, a lot of research is focused on applying Software-Defined Networking (SDN) concepts on wireless networks. However, the current wireless systems are lack of SDN support and remain closed and (mostly) proprietary, which makes it difficult to integrate with SDN systems. The SDN agent is introduced to solve the above issues. An SDN agent is a software element bridging the SDN controller and any legacy wireless network elements (NEs) by providing the abstraction of these elements. The main advantage of this approach is that there is no modification to either the existing SDN elements or the 802.11 protocols, while the SDN controller is enabled to control and manage legacy wireless NEs. In this paper, we present an SDN agent framework for WLANs and describe an implementation of the proposed agent on the Wireless Open-Access Research Platform (WARP), an FPGA based open source Software-Defined Radio (SDR) platform. With the support from such an agent, innovative applications and functionalities can be developed for the WLAN access points (APs), such as dynamically slicing AP bandwidth among users and adapting the transmit power in flexible granularity, i.e. at per frame/per flow level.

With the progress of science and technology, the scale of the network structures built by people is getting larger and larger, and the types of network structures are becoming more and more complex. The Software-Defined Network makes operating and deploying the network more manageable by splitting the data forwarding and control functions. However, the complexity of application scenarios has significantly increased the difficulty of controlling the entire network. However, Cyberspace Traffic Situational Awareness enables multi-source network data extraction, fusion, analysis, and prediction of future trends. At present, most of the network situations such as traffic and survival type are less studied. The traditional situation prediction model is suitable for historical event sequence data that is relatively stable, less sudden, and less dynamic, which does not apply to SDN networks with strong dynamics. In order to solve the above problems, this paper proposes a traffic situational awareness system based on the software-defined network and related evaluation index system. By implementing the traffic situational assessment function and prediction function on the SDN framework, the performance management strategy of the SDN network is further improved.

IoT networks allow various new types of services, such as Location-Based Services (LBS), requiring an end-to-end Quality of Service (QoS) without any interruption. However, sustaining these networks is difficult when the devices can move and vanish at any time, as they can be carried around, might run out of battery, or be turned off by users. In this paper, we propose a new programmable multitier architecture and a continuity of service protocol named ConSerN, which are based on the Software Defined Network (SDN) approach and Connected Dominating Sets (CDS) techniques. Unlike the existing solutions, the proposed mechanism considers a dynamic topology where nodes are not static from a mobility and topology point of view. Furthermore, as most of the applications using LBS need to consider the geographic position of the connected objects, we have added it in the selection process of the dynamic gateways. The performance evaluation was conducted using experimentation and emulation tools allowing scenario generations. We used three main metrics i.e. the quality of link, the number of dominant nodes and the amount of control messages. The obtained results show that the proposed solution benefits from a high number of gateways to achieve great performance in terms of overhead and quality of link.

This study presents the development of a realistic and comprehensive SDN-ATK dataset designed to evaluate the effectiveness of machine learning (ML) and deep learning (DL) approaches for attack detection in Software-Defined Networking (SDN) environments. Unlike existing datasets, SDN-ATK explicitly includes attacks targeting key SDN components such as SDN controllers and OpenFlow switches, addressing a critical gap in current research. We evaluated three ML (XGBoost, Random Forest, and Decision Tree) and three DL (Convolutional Neural Network (CNN), Feed-forward Neural Network (FNN), and Long Short-Term Memory (LSTM)) algorithms across binary and multiclass classification tasks to assess detection performance. Our results demonstrate that DL models, particularly FNN and CNN outperform ML counterparts, achieving 98–99% accuracy, precision, and recall in binary classification. Explainability analyses were conducted using SHAP (SHapley Additive explanations) on the XGBoost model, offering valuable insights into the importance of feature and improving transparency in ML-based attack detection. The study’s findings provide critical guidance for both academia and industry, highlighting that within our Ryu-based SDN testbed, DL models demonstrated more reliable and balanced performance for large-scale attack detection. This work lays a solid foundation for future research, including developing real-time, intelligent, and explainable intrusion detection systems for SDN environments.