Scalable Hybrid Switching-Driven Software Defined Networking Issue: From the Perspective of Reinforcement Learning Standpoint

Security on the Internet today is treated mostly as a data plane problem. IDS's, firewalls, and spam filters all operate on the simple principle of detecting malicious data plane behavior and erecting data plane filters. In this paper we explore how breaking down the barrier between the control and data plane can significantly enhance our understanding of how to detect and filter Internet threats like worms and botnets. Our investigation is guided by two specific goals: using information and anomalies detected on the data plane to inform control plane decision support and using anomalies detected on the control plane to inform data plane filtering. We begin by analyzing the source of persistent worms and other persistent malicious and misconfigured data plane traffic to understand the scope of this behavior on the control plane. We then analyze how anomalies on the control plane associated with poorly managed networks and are correlated with the sources of malicious and misconfigured traffic detected on the data plane. Our results show that malicious and misconfigured data plane behavior is widely spread across the control plane suggesting that constructing a few control plane filters to block the most infected organizations will not have a significant impact. We demonstrate that networks with data plane anomalies tend to exhibit more routing misconfigurations. Finally, we discuss how these correlations could be used to reject or filter routes and help stop recurring threats like persistent worms.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

Distributed denial of service (DDoS) attacks challenge software-defined networks (SDN), primarily due to vulnerabilities present in the separation between the control and data planes. The control plane maintains continuous communication with the data plane switches to direct traffic according to forwarding policies. Although the literature presents various solutions to detect DDoS attacks, most of them concentrate on the control plane. The controller facilitates automated network management, making it easier to integrate and administer applications. On the other hand, the development of security solutions on the control plane imposes an additional load on the controller’s duties. As an alternative to this problem, the research community proposed security solutions adapted to work on the data plane. However, due to the complexity of acting in this layer, the proposed solutions are restricted to statistical analysis of the network flow. This work proposes DataPlane-ML, a machine learning (ML) solution that acts on the data plane to detect DDoS attacks. To realize the use of ML techniques at the data plane, DataPlane-ML makes use of white box switches enhanced with P4 constructs to handle input flow and ML libraries to run ML models. This strategy allows the use of ML techniques on the data plane to provide more elaborated solutions that operate close to the input flow, reducing the impact on the SDN controller. The proposed DataPlane-ML was evaluated using the KNN, SVM and RF algorithms to detect DDoS attacks on real network traces. The experimental results show that DataPlane-ML is ≈23% faster than statistical-based solutions while providing better accuracy and similar CPU usage.

While Wireless Local Area Network (WLAN) gains growing popularity during the last two decades, it faces several new challenges in meeting the requirements of emerging applications due to spectrum shortage, complicated network management and inefficient radio resource allocation (RRA) in densely deployed scenarios. The operating band has evolved from microwave band (a.k.a. sub-6 GHz) to millimeter-wave band (mmWave for short) or even multi-band to provide higher data rates. However, the existing distributed WLAN architecture works in different bands separately and doesn't support the coordination among access points (APs), making it difficult for efficient network management and improved quality of service (QoS) provisioning. In overcoming these challenges, a centralized control architecture for WLAN with decoupled control and data planes can be used to orchestrate the RRA within the whole network while achieving improved communication performance. Therefore, a new control/data plane decoupled WLAN architecture is designed in this paper to realize efficient network management and optimized RRA by separating the control plane and data plane into sub-6 GHz and mmWave respectively. Then, we propose the sub-6 GHz assisted mmWave beamforming protocol, which can significantly reduce the overhead of beamforming training (BFT). Last, we investigate joint RRA for the control/data plane decoupled WLAN since the control plane affects the RRA in the data plane. Performance analysis and simulation show that the joint RRA mechanism in the control/data plane decoupled network can significantly improve the number of successfully scheduled users and the sum-rate compared with the traditional RRA.

The cybersecurity concerns get increasingly intricate as the digital world progresses. In light of the increasing complexity of cyber threats, it is imperative to develop and implement advanced and flexible security strategies. Machine Learning (ML) has become a potent tool in strengthening cybersecurity, providing the capacity to scrutinise extensive information, recognise trends, and improve threat detection and defence methods. This paper examines the significance of ML in the field of cybersecurity, with a special emphasis on the identification of threats and the implementation of protective measures. By incorporating ML algorithms into cybersecurity frameworks, organisations may automate decision-making processes, facilitating prompt responses to ever-changing threats. The initial segment explores the terrain of cyber threats, highlighting the necessity for dynamic and aggressive security methods. Conventional solutions that rely on signatures are frequently inadequate when it comes to handling sophisticated, shape-shifting attacks. ML algorithms, in contrast, have exceptional proficiency in identifying nuanced patterns and irregularities within extensive datasets, therefore offering a more efficient method of detecting potential threats. The second section delves into several ML methodologies utilised in cybersecurity, including supervised and unsupervised learning, deep learning, and reinforcement learning. Every approach is assessed based on its suitability for threat detection, demonstrating its advantages and constraints. Furthermore, the relevance of feature engineering and data pretreatment in improving machine learning models for cybersecurity applications. The versatility of ML algorithms allows them to grow with emerging threats, making them a useful tool in the ever-changing arena of cyber warfare. The final segment focuses on real-world applications of machine learning in cybersecurity, presenting successful use cases across sectors. From anomaly detection to behavior analysis, ML algorithms contribute to the discovery of dangerous activity, lowering false positives and strengthening the overall security posture. Lastly, the paper covers the obstacles and ethical issues related to the adoption of ML in cybersecurity. Issues like as adversarial assaults, skewed datasets, and the interpretability of ML models are examined, highlighting the necessity for a holistic strategy that integrates modern technology with ethical considerations. The fusion of human expertise and machine intelligence offers a formidable defense against evolving cyber threats, paving the way for a more resilient and secure digital future.

Software Defined Networking (SDN) is a recently proposed networking pattern that facilitates a centralized system of computer networks where a controller maintains the management of a global view of the network. One of the characteristics of SDNs is that by decoupling the control and data plane from each other, the controllability and manageability of a network is improved. In this arrangement, the connections between the controller (control plane) and the switches (data plane) are established by either an in-band or an out-of-band control mechanism. Despite all the advantages of SDNs, new challenges arise regarding the connection availability between the data and control planes. A disconnection between the two planes could result in performance degradation. To achieve reliable control traffic between data and control planes, in this work, we design and implement an in-band control protection approach that finds a set of ideal paths for control channel, where as much control traffic as possible can be protected by the proposed protection mechanism. This design enables switches to locally react to failures without involving the controller. Through simulation experiments, we show that our proposed approach significantly improves the control reliability of an in-band control network.

During regional seismic monitoring, data is automatically analyzed in real-time to identify events and provide initial locations and magnitudes. Monitoring networks may apply automatic post-processing to small events (M < 3) to add and refine picks and improve the event before analyst review. Recently, machine learning algorithms, particularly for phase picking, have matured enough for use in regional monitoring systems. The Southern California Seismic Network has implemented the deep-learning picker PhaseNet in our event post-processing, resulting in about 2-3 times as many picks, particularly S phases, with slightly better pick accuracy than the previous STA/LTA picker (relative to analyst picks). These improvements have led to better epicenter accuracy. We have also developed an automatic post-processing pipeline (ST-Proc) for sub-network triggers, which are collections of nearby phase picks that the real-time system could not associate into an event. ST-Proc uses PhaseNet to find phase picks and the machine learning algorithm GaMMA to associate events. This pipeline is capable of correctly detecting events in 65-70% of triggers containing events with a low false event rate around 5%. Additionally, the GaMMA-determined epicenters are generally accurate (within a few kilometers of the final). Both pipelines have helped to reduce analyst workload and streamline event processing.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Software-defined networking (SDN) attracts the attention of the research community in recent years, as evidenced by a large number of survey and review papers. The architecture of SDN clearly recognizes three planes: application, control, and data plane. The application plane executes network applications; control plane regulates the rules for the entire network based on the requests generated by network applications; and based on the set rules, the controller configures the switches in the data plane. The role of the switch in the data plane is to simply forward packets based on the instructions given by the controller. By analyzing SDN-related research papers, it is observed that research, from the very beginning, is insufficiently focused on the data plane. Therefore, this paper gives a comprehensive overview of the data plane survey with particular emphasis on the problem of programmability and flexibility. The first part of the survey is dedicated to the evaluation of actual data plane architectures through several definitions and aspects of data plane flexibility and programmability. Then, an overview of SDN-related research was presented with the aim of identifying key factors influencing the gradual deviation from the original data plane architectures given with ForCES and OpenFlow specifications, which we called the data plane evolution. By establishing a correlation between the treated problem and the problem-solving approaches, the limitations of ForCES and OpenFlow data plane architectures were identified. Based on identified limitations, a generalization of approaches to addressing the problem of data plane flexibility and programmability is made. By examining generalized approaches, open issues have been identified, establishing the grounds for future research directions proposal.

In this paper, we present a novel cell outage management (COM) framework for heterogeneous networks with split control and data planes—a candidate architecture for meeting future capacity, quality-of-service, and energy efficiency demands. In such an architecture, the control and data functionalities are not necessarily handled by the same node. The control base stations (BSs) manage the transmission of control information and user equipment (UE) mobility, whereas the data BSs handle UE data. An implication of this split architecture is that an outage to a BS in one plane has to be compensated by other BSs in the same plane. Our COM framework addresses this challenge by incorporating two distinct cell outage detection (COD) algorithms to cope with the idiosyncrasies of both data and control planes. The COD algorithm for control cells leverages the relatively larger number of UEs in the control cell to gather large-scale minimization-of-drive-test report data and detects an outage by applying machine learning and anomaly detection techniques. To improve outage detection accuracy, we also investigate and compare the performance of two anomaly-detecting algorithms, i.e., $k$ -nearest-neighbor- and local-outlier-factor-based anomaly detectors, within the control COD. On the other hand, for data cell COD, we propose a heuristic Grey-prediction-based approach, which can work with the small number of UE in the data cell, by exploiting the fact that the control BS manages UE-data BS connectivity and by receiving a periodic update of the received signal reference power statistic between the UEs and data BSs in its coverage. The detection accuracy of the heuristic data COD algorithm is further improved by exploiting the Fourier series of the residual error that is inherent to a Grey prediction model. Our COM framework integrates these two COD algorithms with a cell outage compensation (COC) algorithm that can be applied to both planes. Our COC solution utilizes an actor-critic-based reinforcement learning algorithm, which optimizes the capacity and coverage of the identified outage zone in a plane, by adjusting the antenna gain and transmission power of the surrounding BSs in that plane. The simulation results show that the proposed framework can detect both data and control cell outage and compensate for the detected outage in a reliable manner.

Operational, organizational and business challenges for network operators in the context of SDN and NFV

In software-defined networking (SDN) paradigm, where the control and data plane are separated, the scalability of the SDN controller in the control plane is critical and can affect the overall network performance significantly. To improve controller scalability, efforts have been put into enhancing the capability of SDN switches in the data plane, to make them more autonomous in providing routine services without consulting the controller. In this regard, we investigate the service placement problem on SDN switches aiming at minimizing the average accumulated service costs for end users. To solve this problem, we propose a novel reinforcement-learning-based algorithm with guaranteed performance and convergence rate, called Q-placement. Comparing to traditional optimization techniques, Q-placement exhibits many appealing features, such as performance-tuneable optimization and off-the-shelf implementation. Extensive evaluations show that Q-placement consistently outperforms benchmarks and other state-of-the-art algorithms in both synthetic and real networks. Moreover, these evaluations reveal insights into how the network topological properties (e.g., density), servicing capacities, and controller's roles affect the accumulated service costs, which is useful in service planning tasks.

The concept that separates the network's control and forwarding planes has emerged. Since this approach simplifies network management and speeds up network innovations, taking advantage of centralized control, however, the centralized control faces some challenges in large scale networks such as the performance, scalability, reliability. An effective approach to solve this problem is to design distributed architecture of SDN control plane. In this paper, we propose a distributed controller cluster scheme called Cluster-Controller based on the idea of the traditional distributed cluster to load balancing and network performance enhancement, gather the health status of the controller node and keep the network status and topology consistency in each controller nodes to improve services to the data plane. In the end, we prove the feasibility of the solution by experimental proof and show the experiment result.

When the control and data planes are physically separate, it is important to maintain the established connections in the data plane even if the protocol plane fails. Channel status is maintained by a signalling protocol. Channel status information will be permanently lost as a result of a failure in the control plane having no recovery capability of the constrained-based routing label distribution protocol (CR-LDP). A recovery mechanism for channel status information is proposed in this paper. A downstream node stores a label information database (LID) of assignable (free) labels for each incoming link. A copy of the LID redundantly stored in the upstream node as a label information mirror (LIM). Each LIM and the corresponding LID are synchronised. The recovery of channel status information is guaranteed.

Software-defined networking (SDN) is a network approach achieved by decoupling of the control and data planes. The control plane is logically centralized and the data plane is distributed across the network elements. The real-time network is in need of the incorporation of distributed controllers to maintain distributed state information of the traffic flows. Software-based solutions aid distributed SDN controllers to handle fluctuating network traffic and the controller’s configurations are dynamically programmed in real time. In this study, SDN controllers were programmed with a stateful firewall application to provide firewall functionalities without the support of committed hardware. A stateful firewall filtered traffic based on the complete context of incoming packets; it continuously evaluated the entire context of traffic flows, looking for network entry rather than specific traffic flows. In addition, a flow-based scheduling module was implemented in the distributed controllers to improve network scalability. A network cluster was configured with three distributed controllers and we experimented with three independent network topologies. The performance of the proposed network model was evaluated by measuring and analyzing metrics such as network throughput (kbps), delay (ms) and network overhead (pkt/ms) for various combinations of controllers and topologies. The results of the analysis were determined using the mininet emulator. The findings of the performance evaluation indicate that the distributed SDN controllers performs better than a centralized controller. When comparing distributed SDN with two controllers and distributed SDN with three controllers the overall network throughput is increased by 64%, the delay is decreased by 43% and network overhead is reduced by 39%.