Security in Multi-Controller Software-Defined Networks: Present Trends and Future

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

Artificial intelligence based load balancing in SDN: A comprehensive survey

Over the years, the technological advancements have led to the restructuring of networks to cope up with the emerging requirements. In order to support network evolution, programmable features were introduced in the networks. This subsequently led to the development of open interfaces between control and data planes. This progress resulted in successful separation of control and data planes with respect to the feasibility and scalability perspectives. In this paper, we dilate upon the evolutionary process that led to the birth of today's software defined networks (SDN). We analyze various contributions that served as the milestones in the journey of SDN evolution and assess how the SDN of today has shaped up from its predecessor technologies. We also peep into the future with an aim to ascertain the future trends that might be emanated from the current architecture of SDN.

Software Defined Networks (SDN) is a new concept of network architecture that provides the separation of control plane (controller) and data plane (switches) in network devices. Hidden Markov Model (HMM) scheme is proposed for cluster management. The utilization of the bandwidth is an issue because of the extensibility of the control plane. The Control plane in SDN focuses on a centralized solution, where a single control entity has an overall view of the network. To meet the administration, the board necessities of large-scale network situations, the controls plane is regularly completed in the sort of distributed controller clusters, Cluster management technology monitors all sort of events and should keep up a reliable global network status, which usually leads to big data in SDNs. Cluster management technology monitors all types of events and must maintain a consistent global network status, which usually leads to big data in SDNs. Simultaneously, the cluster security is an open issue because of the programmable and dynamic features of SDNs.

The flexibility and programmability offered by Software Defined Networking (SDN) emerge as an approach to resolve some of the main challenges that the Internet of Things (IoT) deployments expose. In the present article, we explore the application of SDN components onto IoT deployments, together with the decoupling of typical gateway functions in two realms; the physical one and the virtual at the edge. This disengagement is a novel approach necessary since the computation resources on the physical part of the infrastructure are limited. Thus, the more resource-consuming processes are transferred to the edge of the network, in the virtual counterpart of the gateway. Additionally, within this infrastructure, different network applications can be running at the top of the SDN controller, in the control plane, for example, QoS policies application, management of network parameters, etc. Providing a holistic view of the IoT deployment. Between its advantages, this work focus on the ease of creation of an IoT infrastructure with the gateway and SDN architecture, and the behaviour of the IoT system. For validation, a small setup scenario and a use case is created where heterogeneous IoT sensors communicate with the physical part of the gateway, implemented with a Raspberry Pis and this, with its virtual part at the edge of the network, so finally sent the data to an IoT platform (FIWARE-ORION) at the core network managed by a virtual Switch (OpenVSwitch) and a RYU-based SDN controller.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

Operational, organizational and business challenges for network operators in the context of SDN and NFV

An Approach for Supervising the Security Threats using Software Defined Networks

It is Software defined networking (SDN) is a new network approach which allows separation of the forwarding plane from the control plane in network architecture, that aids in the efficient control of data flow and gives network administrators a software- based method for managing and configuring the networks. In contrast to SDN, which provides a centralized controller, traditional network topologies require the individual configuration of each network device. Due to a centralized control functionality, SDN is increasingly used by businesses, telecom service providers, cloud providers, and many other users, as it encourages flexibility and scalability in the network while also assisting in streamlining operations. There is significant demand of SDN for effective and adaptable networks. SDN adoption has also been rising in the campuses and corporate sectors. This paper provides a concise overview of the Software Defined Networks (SDN) topic, which is essential for comprehending the fundamental principles of SDN in order to conduct research and implement SDN in many sectors. The initial focus is on the discussion of traditional networks, including their limitations, as well as the many issues encountered by industries. The topic of Software Defined Networks is explored, encompassing their necessity, historical background, architectural structure, interfaces, and models. Next, the many applications of Software-Defined Networking (SDN) are examined. Additionally, the various SDN case studies, vendors, setup issues with SDN, and current research fields were elucidated. The discussion focuses on the role of Software-Defined Networking (SDN) in Artificial Intelligence (AI), specifically addressing the issues associated with implementing SDN in AI.

The nature of computer network flash crowd traffic, which is generated by legitimate users accessing servers or other network resources are similar to the traffic generated by Distributed Denial of Service (DDoS) like attacks. With advancement in spoof packet generation tools, attacker may generate Multi-source Multi-destination Multi-protocol (MMM) traffic; characteristics of such traffic are very similar to on-going genuine/ flash crowd traffic in the network. In the case of Software Defined Network (SDN), attacker’s target is controller plane. Controller plane in SDN is a centralized processing unit of the underlying network, which manages several data planes. Controller plane frames the policies and pushes forwarding rules to the data planes. Data planes just maintain the forwarding rules. Thus by overloading the SDN controller, functionality of complete computer network will be hampered. In this paper, we have proposed Media Access Control (MAC) address based Model to Differentiate Flash crowd and Malicious traffic in SDN (MDFMS). Novelty of the proposed model is to detect, locate and mitigate the source of Traditional DDoS (T-DDoS) and MMMDDoS traffic. MDFSM has been implemented on separate machine to avoid any additional computing load on SDN controller. It also preserves the original design of the SDN architecture. Proposed model has been evaluated under various scenarios and encouraging results have been obtained to differentiate T-DDoS and MMM-DDoS from benign flash crowd traffic.

The traditional networks, with the control and data plane integrated into the same network devices, do not provide a global view of the network performance like degree of congestion, bandwidth utilization, etc. Software defined network (SDN) is an approach towards this problem which separates the control plane of the switch from its data plane and provide a centralized control plane so as to get a global view of the network performance and thus make decisions of how to regulate flows. In SDN, network monitoring can be achieved more efficiently than traditional networks using OpenFlow statistics. SDN controller can keep track of available bandwidth on each link and thus estimate end-to-end available bandwidth of a path simply by composing individual link bandwidths thus avoiding end-to-end probing. We have made two contributions in this paper: (i) proposed and validated a method to estimate end-to-end available bandwidth on any given path by composing link-wise available bandwidths (ii) proposed a method to measure link capacity using OpenFlow protocol. We compared our results to the ones obtained using the state-of-the-art bandwidth measurement tool, Yaz.

In the fast moving space of technology, everything and everyone is on the Internet accessing the world. The creation of large networks and data centers required for managing and analyzing data will increase in the future, so traditional networking technologies and skills will not be enough to solve the future complications arising in the networking industry. The present networks are more static and rigid where else they need to be more dynamic and flexible. Software Defined Networking (SDN) pledges to solve these issues and change the status quo of the industry. The key ideas behind Software Defined Networking are the separation of control and data plane, centralization of network policies and programmability of the networks. Software Defined Networking also claims to solve the perplexing network management issues with some related technologies. This paper provides an insight into this new paradigm. In the inception, we introduce Software Defined Networking and what exactly led to SDN. The fundamental difference between SDN and traditional networking is discussed next. Then, we discuss the different definitions of SDN proposed by different communities covering every aspect of this new paradigm namely: standardization efforts, history, architectural framework with three planes of networking, northbound and southbound interfaces, SDN controllers, and network applications. We also take a look at the ongoing research work especially from the eye of industry giants like Microsoft, Google, AT&T, etc. specifically in the field of deployment and interoperability among different carrier vendors and cloud service providers. We conclude the paper by explaining how SDN has brought the whole ecosystem under one roof.

Software Defined Networking (SDN) is a recently proposed networking pattern that facilitates a centralized system of computer networks where a controller maintains the management of a global view of the network. One of the characteristics of SDNs is that by decoupling the control and data plane from each other, the controllability and manageability of a network is improved. In this arrangement, the connections between the controller (control plane) and the switches (data plane) are established by either an in-band or an out-of-band control mechanism. Despite all the advantages of SDNs, new challenges arise regarding the connection availability between the data and control planes. A disconnection between the two planes could result in performance degradation. To achieve reliable control traffic between data and control planes, in this work, we design and implement an in-band control protection approach that finds a set of ideal paths for control channel, where as much control traffic as possible can be protected by the proposed protection mechanism. This design enables switches to locally react to failures without involving the controller. Through simulation experiments, we show that our proposed approach significantly improves the control reliability of an in-band control network.