Software Defined Networking in a Converged 5G Fiber-Wireless Network

Software Defined Network (SDN) Technology made tremendous changes in networking field by controlling the hardware with remote software by decoupling data plane and control plane. The focus here is on the controller which is part of control plane. A controller is a central part of SDN; it is an intermediary between Data plane and Forwarding plane. It takes prime place in SDN architecture like Operating System in Computers. SDN Controller is a software which directs the packets using flow rules and also contains statistical information of network. The controller orchestrates the networking devices such as switches and routers by channelizing the packets. SDN controller has different flavor based on the commercial requirement achieved by including new pluggable module. This paper discusses some of the SDN Controller with their feature; the controllers are POX, NOX, Floodlight, ODL, Open Contrail. This paper also compares the characteristic of centralized and distributed controller by focusing on performance, bandwidth and round-trip time of Floodlight and Open Daylight (ODL) controller. The simulation is conducted using Mininet.

Distributed Denial of Service (DDoS) attacks represent a major concern in modern Software Defined Networking (SDN), as SDN controllers are sensitive points of failures in the whole SDN architecture. Recently, research on DDoS attacks detection in SDN has focused on investigation of how to leverage data plane programmability, enabled by P4 language, to detect attacks directly in network switches, with marginal involvement of SDN controllers. In order to effectively address cybersecurity management in SDN architectures, we investigate the potential of Artificial Intelligence and Machine Learning (ML) algorithms to perform automated DDoS Attacks Detection (DAD), specifically focusing on Transmission Control Protocol SYN flood attacks. We compare two different DAD architectures, called Standalone and Correlated DAD, where traffic features collection and attack detection are performed locally at network switches or in a single entity (e.g., in SDN controller), respectively. We combine the capability of ML and P4-enabled data planes to implement real-time DAD. Illustrative numerical results show that, for all tested ML algorithms, accuracy, precision, recall and F1-score are above 98% in most cases, and classification time is in the order of few hundreds of upmu text {s} in the worst case. Considering real-time DAD implementation, significant latency reduction is obtained when features are extracted at the data plane by using P4 language.Graphic

The nature of computer network flash crowd traffic, which is generated by legitimate users accessing servers or other network resources are similar to the traffic generated by Distributed Denial of Service (DDoS) like attacks. With advancement in spoof packet generation tools, attacker may generate Multi-source Multi-destination Multi-protocol (MMM) traffic; characteristics of such traffic are very similar to on-going genuine/ flash crowd traffic in the network. In the case of Software Defined Network (SDN), attacker’s target is controller plane. Controller plane in SDN is a centralized processing unit of the underlying network, which manages several data planes. Controller plane frames the policies and pushes forwarding rules to the data planes. Data planes just maintain the forwarding rules. Thus by overloading the SDN controller, functionality of complete computer network will be hampered. In this paper, we have proposed Media Access Control (MAC) address based Model to Differentiate Flash crowd and Malicious traffic in SDN (MDFMS). Novelty of the proposed model is to detect, locate and mitigate the source of Traditional DDoS (T-DDoS) and MMMDDoS traffic. MDFSM has been implemented on separate machine to avoid any additional computing load on SDN controller. It also preserves the original design of the SDN architecture. Proposed model has been evaluated under various scenarios and encouraging results have been obtained to differentiate T-DDoS and MMM-DDoS from benign flash crowd traffic.

The flexibility and programmability offered by Software Defined Networking (SDN) emerge as an approach to resolve some of the main challenges that the Internet of Things (IoT) deployments expose. In the present article, we explore the application of SDN components onto IoT deployments, together with the decoupling of typical gateway functions in two realms; the physical one and the virtual at the edge. This disengagement is a novel approach necessary since the computation resources on the physical part of the infrastructure are limited. Thus, the more resource-consuming processes are transferred to the edge of the network, in the virtual counterpart of the gateway. Additionally, within this infrastructure, different network applications can be running at the top of the SDN controller, in the control plane, for example, QoS policies application, management of network parameters, etc. Providing a holistic view of the IoT deployment. Between its advantages, this work focus on the ease of creation of an IoT infrastructure with the gateway and SDN architecture, and the behaviour of the IoT system. For validation, a small setup scenario and a use case is created where heterogeneous IoT sensors communicate with the physical part of the gateway, implemented with a Raspberry Pis and this, with its virtual part at the edge of the network, so finally sent the data to an IoT platform (FIWARE-ORION) at the core network managed by a virtual Switch (OpenVSwitch) and a RYU-based SDN controller.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

The Internet has reached a breaking point, enabling ubiquitous accessibility to all digital demands. Though people have accelerated their use of overall digital demands due to the convenience of the Internet, where nearly everything is connected and accessible, it is becoming increasingly difficult to manage and modify networks. It is always a challenge to meet the emerging needs of network industry. SDN framework was proposed to overcome traditional network architecture (TNA) restrictions in order to cope with contemporary network management in terms of flexibility, agility, responding to faults, and dynamic changes. SDN assists network operators by uncoupling the control plane from its underlying ternary content-addressable memory (TCAM) hardware often called as forwarding plane by allowing the networks to programme as per the anticipated network functionality. Now, switching from traditional to software-defined networking styles, it is worth to check the robustness of the open flow (south bound interface)-based controller platform and the capability of its fault tolerance attribute to approach the successful SDN implementation. The performance of SDN open flow controllers plays a vital role in SDN implementation, which is meant for the separation between control and data plane to leverage the life of network industry. This paper comprehensively surveys the contrast between traditional network architecture (TNA) and software-defined network architecture. This research work discusses about the best feasible SDN implementation, as well as the selection of a useful controller platform for overcoming traditional network constraints and the performance assessment criteria for SDN open flow controllers. Further, the survey is continued with possible literature or work done by various researchers on performance analysis and evaluation of open flow-based SDN controllers as well as in a group of two or more controllers with respect to multifarious network condition, network criteria/parameter/metric, scaling of network load resources with most important varying network topology design. Ultimately, it strives to point ongoing research omission with respect to controller’s performance bottleneck benchmark suggesting optimized solution when it is well experimented.KeywordsTraditional network architecture (TNA)Software-defined networking (SDN)SDN open flow controllersOpen flow protocolPerformance evaluation/analysis

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Software Defined Networking (SDN) is a dynamic architecture that employs a variety of applications for making networks more adaptable and centrally controlled. It is easy to attack the entire network in SDN because the control plane and data plane are separated. DDoS attack is major danger to SDN service providers because it can shut down the entire network and stop services to all customers at any time. One of the key flaws of most SDN architectures is lack of susceptibility to DDoS attacks with its types like TCP flooding, UDP flooding, SYN flooding, ICMP flooding and DHCP flooding for detecting those kinds of attacks. The machine learning algorithms are widely used in recent years to identify DDoS attacks. This research utilizes Decision Tree Classifier for detection and classification of DDoS attacks on SDN. The Forward Feature Selection technique is also used in the research to select the best features from the dataset and from that dataset the data are employed to train and test the model by Decision Tree Classifier Algorithm. The decision Tree Classifier technique is a supervised method used to forecast desired values of observations using rudimentary machine learning decision rules derived from training data. Based on the accuracy of decision tree techniques, in future, a hybrid learning model will be designed for detecting the Distributed Denial of Services in an SDN environment with high accuracy and a low false negative rate.

The DFG project “SDN-enabled Application-aware Network Control Architectures and their Performance Assessment” (DFG SDN-App) focused in phase 1 (Jan 2017 – Dec 2019) on software defined networking (SDN). Being a fundamental paradigm shift, SDN enables a remote control of networking devices made by different vendors from a logically centralized controller. In principle, this enables a more dynamic and flexible management of network resources compared to the traditional legacy networks. Phase 1 focused on multimedia applications and their users’ Quality of Experience (QoE). This documents reports the achievements of the first phase (Jan 2017 – Dec 2019), which is jointly carried out by the Technical University of Munich, Technical University of Berlin, and University of Wurzburg. The project started at the institutions in Munich and Wurzburg in January 2017 and lasted until December 2019. In Phase 1, the project targeted the development of fundamental control mechanisms for network-aware application control and application-aware network control in Software Defined Networks (SDN) so to enhance the user perceived quality (QoE). The idea is to leverage the QoE from multiple applications as control input parameter for application-and network control mechanisms. These mechanisms are implemented by an Application Control Plane (ACP) and a Network Control Plane (NCP). In order to obtain a global view of the current system state, applications and network parameters are monitored and communicated to the respective control plane interface. Network and application information and their demands are exchanged between the control planes so to derive appropriate control actions. To this end, a methodology is developed to assess the application performance and in particular the QoE. This requires an appropriate QoE modeling of the applications considered in the project as well as metrics like QoE fairness to be utilized within QoE management. In summary, the application-network interaction can improve the QoE for multi-application scenarios. This is ensured by utilizing information from the application layer, which are mapped by appropriate QoS-QoE models to QoE within a network control plane. On the other hand, network information is monitored and communicated to the application control plane. Network and application information and their demands are exchanged between the control planes so to derive appropriate control actions.

Distributed denial of service (DDoS) attacks challenge software-defined networks (SDN), primarily due to vulnerabilities present in the separation between the control and data planes. The control plane maintains continuous communication with the data plane switches to direct traffic according to forwarding policies. Although the literature presents various solutions to detect DDoS attacks, most of them concentrate on the control plane. The controller facilitates automated network management, making it easier to integrate and administer applications. On the other hand, the development of security solutions on the control plane imposes an additional load on the controller’s duties. As an alternative to this problem, the research community proposed security solutions adapted to work on the data plane. However, due to the complexity of acting in this layer, the proposed solutions are restricted to statistical analysis of the network flow. This work proposes DataPlane-ML, a machine learning (ML) solution that acts on the data plane to detect DDoS attacks. To realize the use of ML techniques at the data plane, DataPlane-ML makes use of white box switches enhanced with P4 constructs to handle input flow and ML libraries to run ML models. This strategy allows the use of ML techniques on the data plane to provide more elaborated solutions that operate close to the input flow, reducing the impact on the SDN controller. The proposed DataPlane-ML was evaluated using the KNN, SVM and RF algorithms to detect DDoS attacks on real network traces. The experimental results show that DataPlane-ML is ≈23% faster than statistical-based solutions while providing better accuracy and similar CPU usage.

Software Defined Networking (SDN) is a new networking paradigm, with a great potential to increase network efficiency, ease the complexity of network control and management, and accelerate the rate of technology innovation. One of the core concepts of SDN is the separation of the network's control and data plane. The intelligence and the control of the network operation and management, such as routing, is removed from the forwarding elements (switches) and is concentrated in a logically centralised component, i.e. the SDN controller. In order for the controller to configure and manage the network, it needs to have up-to-date information about the state of the network, in particular its topology. Consequently, topology discovery is a critical component of any Software Defined Network architecture. In this paper, we evaluate the cost and overhead of the de facto standard approach to topology discovery currently implemented by the major SDN controller frameworks, and propose simple and practical modifications which achieve a significantly improved efficiency and reduced control overhead. We have implemented our new topology discovery approach on the widely used POX controller platform, and have evaluated it for a range of network topologies via experiments using the Mininet network emulator. Our results show that our proposed modifications achieve an up to 45% reduction in controller load compared to the current state-of-the-art approach, while delivering identical discovery functionality.

The traditional networks, with the control and data plane integrated into the same network devices, do not provide a global view of the network performance like degree of congestion, bandwidth utilization, etc. Software defined network (SDN) is an approach towards this problem which separates the control plane of the switch from its data plane and provide a centralized control plane so as to get a global view of the network performance and thus make decisions of how to regulate flows. In SDN, network monitoring can be achieved more efficiently than traditional networks using OpenFlow statistics. SDN controller can keep track of available bandwidth on each link and thus estimate end-to-end available bandwidth of a path simply by composing individual link bandwidths thus avoiding end-to-end probing. We have made two contributions in this paper: (i) proposed and validated a method to estimate end-to-end available bandwidth on any given path by composing link-wise available bandwidths (ii) proposed a method to measure link capacity using OpenFlow protocol. We compared our results to the ones obtained using the state-of-the-art bandwidth measurement tool, Yaz.

Software‐defined networking (SDN) is a relatively new approach in network management that proposes to separate the network control (Control plane) and the forwarding process (Data plane) to optimize the network infrastructure and improve network performance, controllability, manageability and flexibility. However, like every technology, SDN has brought its own new challenges in terms of security and scalability which are very important aspects that should be considered to design and build a resilient architecture in order to meet carrier grade network requirements. In this paper, we propose a secure SDN architecture with IEEE 802.1X port‐based authentication where we also consider the controller's scalability issue by devolving the access control capability to the data plane. In this way, we reduce the high demand and the workload on the SDN controller. Our proposed model presents a novel SDN network architecture and logical network segmentation which provides an optimal and secure network access with low latency. We have implemented and tested our architecture to show its performance (authentication delays). Copyright © 2016 John Wiley & Sons, Ltd.

Software-defined networking (SDN) attracts the attention of the research community in recent years, as evidenced by a large number of survey and review papers. The architecture of SDN clearly recognizes three planes: application, control, and data plane. The application plane executes network applications; control plane regulates the rules for the entire network based on the requests generated by network applications; and based on the set rules, the controller configures the switches in the data plane. The role of the switch in the data plane is to simply forward packets based on the instructions given by the controller. By analyzing SDN-related research papers, it is observed that research, from the very beginning, is insufficiently focused on the data plane. Therefore, this paper gives a comprehensive overview of the data plane survey with particular emphasis on the problem of programmability and flexibility. The first part of the survey is dedicated to the evaluation of actual data plane architectures through several definitions and aspects of data plane flexibility and programmability. Then, an overview of SDN-related research was presented with the aim of identifying key factors influencing the gradual deviation from the original data plane architectures given with ForCES and OpenFlow specifications, which we called the data plane evolution. By establishing a correlation between the treated problem and the problem-solving approaches, the limitations of ForCES and OpenFlow data plane architectures were identified. Based on identified limitations, a generalization of approaches to addressing the problem of data plane flexibility and programmability is made. By examining generalized approaches, open issues have been identified, establishing the grounds for future research directions proposal.