Downloads & Free Reading Options - Results

This paper describes a content centric network architecture which uses software defined networking principles to implement efficient metadata driven services by extracting content metadata at the network layer. The ability to access content metadata transparently enables a number of new services in the network. Specific examples discussed here include: a metadata driven traffic engineering scheme which uses prior knowledge of content length to optimize content delivery, a metadata driven content firewall which is more resilient than traditional firewalls and differentiated treatment of content based on the type of content being accessed. A detailed outline of an implementation of the proposed architecture is presented along with some basic evaluation.

Machine-to-machine (M2M) communications have attracted great attention from both academia and industry. In this paper, with recent advances in wireless network virtualization and software-defined networking (SDN), we propose a novel framework for M2M communications in software-defined cellular networks with wireless network virtualization. In the proposed framework, according to different functions and quality of service (QoS) requirements of machine-type communication devices (MTCDs), a hypervisor enables the virtualization of the physical M2M network, which is abstracted and sliced into multiple virtual M2M networks. Moreover, we formulate a decision-theoretic approach to optimize the random access process of M2M communications. In addition, we develop a feedback and control loop to dynamically adjust the number of resource blocks (RBs) that are used in the random access phase in a virtual M2M network by the SDN controller. Extensive simulation results with different system parameters are presented to show the performance of the proposed scheme.

Software Defined Networking (SDN) transfers all forwarding decisions to a single controller and provides the network with the same degree of control and flexibility as the cloud. And with all the major vendors onboard, it will soon be supporting networks everywhere. But current implementations are full of weaknesses that could easily turn this utopian dream of the future into a nightmare and leave networks world-wide exposed. With clear-text wire protocol implementations, little support for switch TLS, no authentication for nodes, poorly conceived rate-limiting features in the controllers, controller APIs that don’t require authentication , and back-door netconf access, the leading platforms Floodlight and OpenDaylight, are ripe for attack. And in this session, using a new toolkit that I developed, I’ll demonstrate by showing you how to locate and identify these controllers, impersonate switches to DoS them, and engage their wide-open APIs and backdoors to map the network, locate targets, and control access to the network … even hide from sensors. But all is not lost, because I’ll show how to protect them too. Because dream or nightmare, SDN can make a difference in the real world if we just protect it right. Gregory Pickett CISSP, GCIA, GPEN has a background in intrusion analysis for Fortune 100 companies but now heads up Hellfire Security’s Managed Security Services efforts and participates in their assessment practice as a network security subject matter expert. As a security professional, his primary area of focus and occasional research is networks with an interest in using network traffic to better understand, to better defend, and sometimes to better exploit the hosts that live on them. He holds a B.S. in Psychology which is completely unrelated but interesting to know. While it does nothing to contribute to how he makes a living, it does demonstrate how screwed up he actually is. site: www.hellfiresecurity.com projects: sourceforge.net/users/shogun7273 twitter: @shogun7273

Recent optimizations in blockchain technology and increased utilization of software defined networking (SDN) have led to new opportunities in data center network management. The research problem presented in this study is whether a blockchain protocol can be efficiently used in east/west communications between geographically separated SDN domains. To evaluate blockchain geographic scalability in SDNs, experiments were performed utilizing latency measurements on a GENI testbed coupled with a blockchain transaction discrete-event simulator modeling an open-source permissioned blockchain system. Results reveal that additional network latency imposed by increased geographic separation between SDNs does not introduce a significant detriment to blockchain-enabled SDN communication because the current blockchain systems typically incur relatively high processing delays. However, the relative newness and poor quality of available permissioned blockchain software impose significant challenges in terms of ease of adoption and deployment. Experience gained in this research suggests that such software likely needs to mature more through real-world deployment and testing in order to support further efforts of integrating blockchain and SDN.

The Open Network Install Environment, or ONIE, makes commodity or WhiteBox Ethernet possible. By placing a common, Linux-based, install environment onto the firmware of the switch, customers can deploy the Network Operating Systems of their choice onto the switch and do so whenever they like without replacing the hardware. The problem is, if this gets compromised, it also makes it possible for hackers to install malware onto the switch. Malware that can manipulate it and your network, and keep doing it long after a Network Operating System reinstall. With no secure boot, no encryption, no authentication, predictable HTTP/TFTP waterfalls, and exposed post-installation partition, ONIE is very susceptible to compromise. And with Network Operating Systems such as Switch Light, Cumulus Linux, and Mellanox-OS via their agents Indigo and eSwitchd not exactly putting up a fight with problems like no authentication, no encryption, poor encryption, and insufficient isolation, this is a real possibility. In this session, we'll cover the weaknesses in ONIE, ways to reach the platform through these Network Operating Systems, and what can happen if we don't properly protect the Control Plane these switches run on. I'll even demonstrate with a drive-by web-attack that is able to pivot through a Windows management station to reach the isolated control plane network, and infect one of these ONIE-based switches with malware, malware that's there even after a refresh. You'll even get the source code to take home with you to see how easily it's done. Finally, we'll talk about how to compensate for these issues so that your network doesn't become infected with and manipulated by this sort of persistent firmware-level malware. Speaker Bio: Gregory Pickett CISSP, GCIA, GPEN has a background in intrusion analysis for Fortune 100 companies but now heads up Hellfire Security’s Managed Security Services efforts and participates in their assessment practice as a network security subject matter expert. As a security professional, his primary area of focus and occasional research is networks with an interest in using network traffic to better understand, to better defend, and sometimes to better exploit the hosts that live on them. He holds a B.S. in Psychology which is completely unrelated but interesting to know. While it does nothing to contribute to how he makes a living, it does demonstrate how screwed up he actually is. Twitter: @Shogun7273 Source: https://www.youtube.com/watch?v=zHDAg8UVTLc Uploader: DEFCONConference

Software-defined networks have been proposed as a viable solution to decrease the power consumption of the networking component in data center networks. Still the question remains on which scheduling algorithms are most suited to achieve this goal. We propose 4 different linear programming approaches that schedule requested traffic flows on SDN switches according to different objectives. Depending on pre-defined software quality requirements such as delay and performance, a single variation or a combination of variations can be selected to optimize the power saving and the performance metrics. Our simulation results demonstrate that all our algorithm variations outperform the shortest path scheduling algorithm, our baseline on power savings, less or more strongly depending on the power model chosen. We show that in FatTree networks, where switches can save up to 60% of power in sleeping mode, we can achieve 15% minimum improvement assuming a one-to-one traffic scenario. Two of our algorithm variations privilege performance over power saving and still provide around 45% of the maximum achievable savings.

Most Software Defined Networks (SDN) traffic engineering applications use excessive and frequent global monitoring in order to find the optimal Quality-of-Service (QoS) paths for the current state of the network. In this work, we present the motivations, architecture and initial evaluation of a SDN application called Cognitive Routing Engine (CRE) which is able to find near-optimal paths for a user-specified QoS while using a very small monitoring overhead compared to global monitoring which is required to guarantee that optimal paths are found. Smaller monitoring overheads bring the advantage of smaller response time for the SDN controllers and switches. The initial evaluation of CRE on a SDN representation of the GEANT academic network shows that it is possible to find near-optimal paths with a small optimality gap of 1.65% while using 9.5 times less monitoring.

xxv, 325 pages : 24 cm

After many years of development, Software Defined Networks (SDN) have started to see mainstream acceptance. Considerable work has established standards for the northbound and southbound interfaces of SDN controllers, but much work remains on the development of an east/west protocol. In this research, we take security, autonomy, and privacy as essential requirements for an east/west interface. We believe that the properties of permissioned blockchains, serializability, immutability, verifiability, and smart contracts, meet these requirements. Using Hyperledger Fabric as our blockchain protocol, we were able to develop a proof-of-concept for an east/west protocol on the ONOS SDN platform. We demonstrate successfully requesting a connection between separately managed SDN networks which leads to the installation of flows and data transfer between the networks. We further evaluate the impact of network latency on Hyperledger Fabric nodes to complete transactions; the results show a linear relationship between per hop network latency and transaction completion time.

The OpenFlow-based SDN is widely studied to better network performance through planning fine-grained paths. However, being designed to configure path hop-by-hop, it faces the scalability issue that both the flow table overhead and path setup delay are unacceptable for large-scale networks. In this paper, we propose PACO, a framework based on Source Routing to address that problem through quickly pushing paths into the packet header at network edges and pre-installing few rules at the network core. The straightforward implementation of SR is inefficient as it would incur too many path labels; other efficient approaches would sacrifice path flexibility (e.g., DEFO). To implement SR efficiently and flexibly, PACO presents each path as a concatenation of pathlets and introduces algorithms to compute pathlets and concatenate paths with minimum path labels. Our extensive simulations confirm the scalability of PACO as it saves the flow table overhead up to 94% compared with OpenFlow-SDN solutions and show that PACO outperforms SR-SDN solutions by supporting more than 40% paths with few label overhead.

For the past 30 years, networks have been built the same way: out of special-purpose devices running distributed algorithms that provide functionality such as topology discovery, routing, traffic monitoring, and access control. Recent years, however, have seen growing interest in a new kind of network architecture in which a logically-centralized controller machine manages a distributed collection of programmable switches. These software-defined networks (SDNs) make it possible for programmers to directly control the behavior of the network by configuring the packet- forwarding rules installed on switches [6]. Figure 1 depicts the architecture of a traditional network, where each independent switch consists of tightly-integrated control and data planes, and of an SDN, where a collection of switches are managed by a single program running on the controller.1

SDN transforms a network from a calcified collection of hardware into a logically centralized and programmable method of interconnectivity. Changing the networking paradigm shifts a networks security posture. Changes visible to a host connected to the network include small latency differences between a traditional network environment and an SDN environment. This thesis aims to reliably distinguish SDN environments from traditional environments by observing latency behavior. Additionally, this thesis determines whether latency information contributes to the unique fingerprint of SDN controllers. Identifying the controller software gives an adversary information contributing to a network attack. An SDN and traditional network environment consisting of two hosts, one switch, and one controller are created. Within both environments, packet RTT values are compared between SDN and traditional environments to determine if both sets differ. Latency analysis is used to observe features of an SDN controller. Collected features contribute to a table of information used to uniquely fingerprint an SDN controller. Results show that packet RTTs within a traditional network environment significantly (p-value less than 1:0 10(-15)) differ from SDN environments. The predicted controller inactivity timeout within the simulated environment differs from the true timeout by a mean value of 0.44956 seconds. The emulated environment shows that the observed inactivity timeout depends on the network switch implementation of the controllers set value, leading to incorrect observed timeouts. Within the SDN environment, the host is not able to directly communicate with the SDN controller, leading to an inability to collect the number of features needed to uniquely identify the SDN controller.

Now a days, Network Security is becoming the most challenging task. As a result in the growth of internet, the attacks in the network has also been increased. This can be hold back by the intrusion detection system, it identifies the unwanted attacks and unauthorized access in the network. The comprehensive overview of the detailed survey is analyzed with the existing dataset for identifying the unusual attacks in the network. Here machine learning classification algorithms is used to detect several category of attacks. The machine learning techniques can result in higher detection rates, lower false alarm rates and reasonable computation and communication costs. In this paper KDD cup99 is used to evaluate the machine learning algorithms for intrusion detection system. Here we have implemented the experiment on intrusion detection system which uses machine learning algorithms like Naïve Bayes and k-means clustering algorithm.

Network Function Virtualization (NFV) on Software-Defined Networks (SDN) can effectively optimize the allocation of Virtual Network Functions (VNFs) and the routing of network flows simultaneously. Nevertheless, most previous studies on NFV focus on unicast service chains and thereby are not scalable to support a large number of destinations in multicast. On the other hand, the allocation of VNFs has not been supported in the current SDN multicast routing algorithms. In this paper, therefore, we make the first attempt to tackle a new challenging problem for finding a service forest with multiple service trees, where each tree contains multiple VNFs required by each destination. Specifically, we formulate a new optimization, named Service Overlay Forest (SOF), to minimize the total cost of all allocated VNFs and all multicast trees in the forest. We design a new $3\rho_{ST}$-approximation algorithm to solve the problem, where $\rho_{ST}$ denotes the best approximation ratio of the Steiner Tree problem, and the distributed implementation of the algorithm is also presented. Simulation results on real networks for data centers manifest that the proposed algorithm outperforms the existing ones by over 25%. Moreover, the implementation of an experimental SDN with HP OpenFlow switches indicates that SOF can significantly improve the QoE of the Youtube service.

Software-defined networking (SDN) eases network management by centralizing the control plane and separating it from the data plane. The separation of planes in SDN, however, introduces new vulnerabilities in SDN networks since the difference in processing packets at each plane allows an adversary to fingerprint the network's packet-forwarding logic. In this paper, we study the feasibility of fingerprinting the controller-switch interactions by a remote adversary, whose aim is to acquire knowledge about specific flow rules that are installed at the switches. This knowledge empowers the adversary with a better understanding of the network's packet-forwarding logic and exposes the network to a number of threats. In our study, we collect measurements from hosts located across the globe using a realistic SDN network comprising of OpenFlow hardware and software switches. We show that, by leveraging information from the RTT and packet-pair dispersion of the exchanged packets, fingerprinting attacks on SDN networks succeed with overwhelming probability. We also show that these attacks are not restricted to active adversaries, but can be equally mounted by passive adversaries that only monitor traffic exchanged with the SDN network. Finally, we discuss the implications of these attacks on the security of SDN networks, and we present and evaluate an efficient countermeasure to strengthen SDN networks against fingerprinting. Our results demonstrate the effectiveness of our countermeasure in deterring fingerprinting attacks on SDN networks.

The current traditional network paradigm used in the Marine Corps has a demonstrated pattern of success in decades of austere environment operations. However, the adoption of a new idea to reduce time, effort, and manpower related to the installation, operation, and maintenance of tactical networks that simultaneously improves current network capability and capacity is attractive. That new idea is software-defined networks. Three primary keys will encourage the Marine Corps to embrace this new network technology: it must work with current network inventory, it must be capable of maintaining current configuration standards, and it must have the potential to greatly improve upon the current network model. On a physical test bed, this work seeks to evaluate all three requirements. Working topologies that consist of both software-defined and traditional network elements seamlessly connect to create a hybrid solution with near-term relevance. Then, the effective inclusion of virtual local area networks and access control lists on software-defined switches validate the ability to maintain current configuration standards. Lastly, instances of scripted configuration, resident topology constructs, and local central configuration tools show the automation potential of software-defined networks.

The radio access networks (RANs) need to support massive and diverse data traffic with limited spectrum and energy. To cope with this challenge, software-defined radio access network (SDRAN) architectures have been proposed to renovate the RANs. However, current researches lack the design and evaluation of network protocols. In this paper, we address this problem by presenting the protocol design and evaluation of hyper-cellular networks (HyCell), an SDRAN framework making base station (BS) operations globally resource-optimized and energy-efficient (GREEN). Specifically, we first propose a separation scheme to realize the decoupled air interface in HyCell. Then we design a BS dispatching protocol which determines and assigns the optimal BS for serving mobile users, and a BS sleeping protocol to improve the network energy efficiency. Finally, we evaluate the proposed design in our HyCell testbed. Our evaluation validates the feasibility of the proposed separation scheme, demonstrates the effectiveness of BS dispatching, and shows great potential in energy saving through BS sleeping control.

This paper describes an FPGA-based SDR transceiver that may be used for ad-hoc wireless mesh networking on the VHF and UHF amateur bands. The architecture allows simultaneous use of two channels, a fixed frequency control channel and a variable frequency data channel, to overcome bandwidth limitations and prevent inter-node interference. Multiple transceivers may cooperate to form a layer-2 mesh network that looks like an Ethernet switch to users. Internal software implements derivatives of AODV and ODMRP with source multi-point relays for efficient unicast, broadcast and multicast transmission.

Software-defined networks (SDNs) are attractive to businesses and the military because they enable centralized and policy-based control at per flow level. However, current SDN standards by the Open Networking Foundation do not require the use of encryption or authentication for communication between controllers and switches. We propose a novel method to add message authentication to SDN control plane traffic via the use of a protocol dialect. A protocol dialect is a variation of an existing implementation of an open-source protocol such as OpenFlow, achieved by either adding proxies or directly modifying the binary code to incorporate new security measures or remove unused features. This research provides a framework for systematic creation and evaluation of a protocol dialect, and presents a novel design of a protocol dialect for OpenFlow. The protocol dialect includes three derivatives and provides authentication that not only is independent of Transport Layer Security (TLS) but also may mitigate some attacks, e.g., cipher-suite downgrade attacks, against TLS. Performance measurements from a Mininet experiment show that the derivatives did not significantly impact the communication latency of OpenFlow, adding less than 1% overhead when TLS is not enabled and less than 22% with TLS enabled.

Software-Defined Network (SDN) is expected to have a significant impact on future networking. Although exciting progress has been made toward realizing SDN, application of this new networking paradigm in the future Internet to support end-to-end QoS provisioning faces some new challenges. The autonomous network domains coexisting in the Internet and the diverse user applications deployed upon the Internet call for a uniform Service Delivery Platform (SDP) that enables high-level network abstraction and inter-domain collaboration for end-to-end service provisioning. However, the currently available SDN technologies lack effective mechanisms for supporting such a platform. In this paper, we first present a SDP framework that applies the Network-as-a-Service (NaaS) principle to provide network abstraction and orchestration for end-to-end service provisioning in SDN-based future Internet. Then we focus our study on two enabling technologies for such a SDP to achieve QoS guarantee; namely a network abstraction model and an end-to-end resource allocation scheme. Specifically we propose a general model for abstracting the service capabilities offered by network domains and develop a technique for determining the required amounts of bandwidth in network domains for end-to-end service delivery with QoS guarantee. Both the analytical and numerical results obtained in this paper indicate that the NaaS-based SDP not only simplifies SDN service and resource management but also enhances bandwidth utilization for end-to-end QoS provisioning.

The past century of telecommunications has shown that failures in networks are prevalent. Although much has been done to prevent failures, network nodes and links are bound to fail eventually. Failure recovery processes are therefore needed. Failure recovery is mainly influenced by (1) detection of the failure, and (2) circumvention of the detected failure. However, especially in SDNs where controllers recompute network state reactively, this leads to high delays. Hence, next to primary rules, backup rules should be installed in the switches to quickly detour traffic once a failure occurs. In this work, we propose algorithms for computing an all-to-all primary and backup network forwarding configuration that is capable of circumventing link and node failures. Omitting the high delay invoked by controller recomputation through preconfiguration, our proposal's recovery delay is close to the detection time which is significantly below the 50 ms rule of thumb. After initial recovery, we recompute network configuration to guarantee protection from future failures. Our algorithms use packet-labeling to guarantee correct and shortest detour forwarding. The algorithms and labeling technique allow packets to return to the primary path and are able to discriminate between link and node failures. The computational complexity of our solution is comparable to that of all-to-all-shortest paths computations. Our experimental evaluation on both real and generated networks shows that network configuration complexity highly decreases compared to classic disjoint paths computations. Finally, we provide a proof-of-concept OpenFlow controller in which our proposed configuration is implemented, demonstrating that it readily can be applied in production networks.

With the rapid growth of services that stream to groups of users comes an increased importance of and demand for reliable multicast. In this paper, we turn to software-defined networking and develop a novel general-purpose multi-failure protection algorithm to provide quick failure recovery, via Fast Failover (FF) groups, for dynamic multicast groups. This extends previous research, which either could not realize fast failover, worked only for single link failures, or was only applicable to static multicast groups. However, while FF is know to be fast, it requires pre-installing back-up rules. These additional memory requirements, which in a multicast setting are even more pronounced than for unicast, are often mentioned as a big disadvantage of using FF. We develop an OpenFlow application for resilient multicast, with which we study FF resource usage, in an attempt to better understand the trade-off between recovery time and resource usage. Our tests on a realistic network suggest that using FF groups can reduce the recovery time of the network significantly compared to other methods, especially when the latency between the controller and the switches is relatively large.

The objective of Software Defined Networking architectures is to prevent the excessive usage of energy required for routing and enabling devices across the network. The predominant measure of energy optimization technique is facilitated by proper planning of the routing mechanisms, where the algorithms determine the approach involved in sharing the messages around the devices at different locations. The proposed research article summarizes the techniques included in planning and mapping strategies for a green policy adhering to critical approaches and establishment of Data Centers. There are two significant planes that define, monitor and regulate the traffic of messages between the various devices of the network. The proposed strategy follows multiple-level planning and addresses the mapping problem which is persistent in existing approaches. The controlling plane is responsible for the effective placement of data center’s and switches for energy-saving traffic routing. The controllers are placed in predefined locations that are marked to be optimal locations by the mapping algorithm. The proposed algorithm follows the NP-hardness algorithm to define the various routes between different devices such as controllers and switches. The defined paths and immediate routes taken in situations of peak hours and other failures are clearly identified by the proposed algorithm well in advance for effective energy conservation. Effective mapping is also ensured by proper reallocation of routes which are defined as cost effective and fail-proof route to ensure completion of traffic. The defined algorithm enabled the Software Defined Networks to conserve energy up to 72% when compared to existing state of art techniques.

Obtaining flow-level measurements, similar to those provided by Netflow/IPFIX, with OpenFlow is challenging as it requires the installation of an entry per flow in the flow tables. This approach does not scale well with the number of concurrent flows in the traffic as the number of entries in the flow tables is limited and small. Flow monitoring rules may also interfere with forwarding or other rules already present in the switches, which are often defined at different granularities than the flow level. In this paper, we present a transparent and scalable flow-based monitoring solution that is fully compatible with current off-the-shelf OpenFlow switches. As in NetFlow/IPFIX, we aggregate packets into flows directly in the switches and asynchronously send traffic reports to an external collector. In order to reduce the overhead, we implement three different traffic sampling methods depending on the OpenFlow features available in the switch. We developed our complete flow monitoring solution within OpenDaylight and evaluated its accuracy in a testbed with Open vSwitch. Our experimental results using real-world traffic traces show that the proposed sampling methods are accurate and can effectively reduce the resource requirements of flow measurements in OpenFlow.

The software defined networks (SDN) system has modern techniques in networking, it separates the forwarding plane from the control plane and works to collect control functions in a central unit (controller), and this separation process leads to many advantages, such as cost reduction and programming ability. Concurrently, because of its centralized architecture, it is prone to a variety of attacks. Distributed denial of service (DDoS) attack has a significant impact on SDN, it is characterized by its ability to consume network resources as well as its ability to turn off the entire network. The work in this study aims to improve and increase the security and robustness of SDN systems against the attack or intrusion, by using a machine learning model to detect attack traffic and classify traffic of SDN as (attack or normal), and optimization algorithm (genetic algorithm) for improving the accuracy of the classification. After preparing and preprocessing the dataset, we used the genetic algorithm (GA) to optimize the hyperparameters of the decision tree (DT) model, and the proposed evolutionary decision tree (EDT) model was used to classify traffic into normal and attack traffic. The results indicate that the suggested model achieved a high classification accuracy of 99.46. 

Traditional networking solutions are unable to meet modern computing needs due to the expanding popularity of the internet, which requires increased agility and flexibility. To meet these objectives, software-defined networking (SDN) arises. A controller is a major element that will determine if SDN succeeds or fails. Various current SDN controllers in many sectors must be evaluated and compared. The performance of two well-known SDN controllers, POX and Ryu, is evaluated in this research. We used the Mininet-WiFi emulator to implement our work and the distributed internet traffic generator (D-ITG) to assess the aforementioned controllers using delay, jitter, packet loss, and throughput metrics. What is new in our research is the study of network performance in two different types of transmission media: wired and wireless. The speed of the wired medium was chosen to be fast ethernet, which was not previously studied. In addition, the size of the packet was varied among 128, 256, 512, and 1,024 bytes. The comparison was performed on three topologies (single, linear, and tree). The experimental results showed that Ryu offers significantly lower latency, jitter, and packet loss than POX in most scenarios. Also, the Ryu controller has higher throughput than POX, especially on wireless networks.

https://media.ccc.de/c/zeteco2017/zeteco-46-trends_im_netzwerk_software_defined_networks_linux_programmierbare_chips Drei interessante Themen werden angeschat, welche der Votragende als Trends im Netzwerkbereich emofindet: * Linux * Software Defined Networks * programmierbare Chips Tomasim Pospiisek Source: https://www.youtube.com/watch?v=rCizUSRtjIg Uploader: media.ccc.de

Current naval networks vary in size and implementation, but have one thing in common: poor network device connectivity oversight. Poor network oversight can lead to unauthorized network access, but there is a potential solution with software-defined networking (SDN). SDN technology provides the management oversight and capability to maintain a complete network picture of all connected devices. SDN is the network technology that separates the control plane from the forwarding plane of the network while providing ability to program the entire network from a central controller. This thesis reviews the current network access control solution deployed for the NPS unclassified network and creates a SDN solution aimed to provide improvements in the following areas: a centralized network topology, low management overhead, and reduction in hardware and operational costs.

Although Software-Defined Networking (SDN) enables flexible network resource allocations for traffic engineering, current literature mostly focuses on unicast communications. Compared to traffic engineering for multiple unicast flows, multicast traffic engineering for multiple trees is very challenging not only because minimizing the bandwidth consumption of a single multicast tree by solving the Steiner tree problem is already NP-Hard, but the Steiner tree problem does not consider the link capacity constraint for multicast flows and node capacity constraint to store the forwarding entries in Group Table of OpenFlow. In this paper, therefore, we first study the hardness results of scalable multicast traffic engineering in SDN. We prove that scalable multicast traffic engineering with only the node capacity constraint is NP-Hard and not approximable within, which is the number of destinations in the largest multicast group. We then prove that scalable multicast traffic engineering with both the node and link capacity constraints is NP-Hard and not approximable within any ratio. To solve the problem, we design an approximation algorithm, named Multi-Tree Routing and State Assignment Algorithm (MTRSA), for the first case and extend it to the general multicast traffic engineering problem. The simulation and implementation results demonstrate that the solutions obtained by the proposed algorithm outperform the shortest-path trees and Steiner trees. Most importantly, MTRSA is computation-efficient and can be deployed in SDN since it can generate the solution with numerous trees in a short time.

Slides Here: /redirect?redir_token=bieYCcQifZc1Tvx8rpelyeE9E5V8MTUzNzM5NTkxOUAxNTM3MzA5NTE5&q=https%3A%2F%2Fdefcon.org%2Fimages%2Fdefcon-22%2Fdc-22-presentations%2FPickett%2FDEFCON-22-Gregory-Pickett-Abusing-Software-Defined-Networks-UPDATED.pdf&v=9_toldlQpgI&event=video_description Abusing Software Defined Networks Gregory Pickett CYBERSECURITY OPERATIONS, HELLFIRE SECURITY Software Defined Networking (SDN) transfers all forwarding decisions to a single controller and provides the network with the same degree of control and flexibility as the cloud. And with all the major vendors onboard, it will soon be supporting networks everywhere. But current implementations are full of weaknesses that could easily turn this utopian dream of the future into a nightmare and leave networks world-wide exposed. With clear-text wire protocol implementations, little support for switch TLS, no authentication for nodes, poorly conceived rate-limiting features in the controllers, controller APIs that don’t require authentication , and back-door netconf access, the leading platforms Floodlight and OpenDaylight, are ripe for attack. And in this session, using a new toolkit that I developed, I’ll demonstrate by showing you how to locate and identify these controllers, impersonate switches to DoS them, and engage their wide-open APIs and backdoors to map the network, locate targets, and control access to the network … even hide from sensors. But all is not lost, because I’ll show how to protect them too. Because dream or nightmare, SDN can make a difference in the real world if we just protect it right. Gregory Pickett CISSP, GCIA, GPEN has a background in intrusion analysis for Fortune 100 companies but now heads up Hellfire Security’s Managed Security Services efforts and participates in their assessment practice as a network security subject matter expert. As a security professional, his primary area of focus and occasional research is networks with an interest in using network traffic to better understand, to better defend, and sometimes to better exploit the hosts that live on them. He holds a B.S. in Psychology which is completely unrelated but interesting to know. While it does nothing to contribute to how he makes a living, it does demonstrate how screwed up he actually is. site: www.hellfiresecurity.com projects: sourceforge.net/users/shogun7273 twitter: @shogun7273 Source: https://www.youtube.com/watch?v=9_toldlQpgI Uploader: DEFCONConference

We propose a Distributed and Collaborative Monitoring system, DCM, with the following properties. First, DCM allow switches to collaboratively achieve flow monitoring tasks and balance measurement load. Second, DCM is able to perform per-flow monitoring, by which different groups of flows are monitored using different actions. Third, DCM is a memory-efficient solution for switch data plane and guarantees system scalability. DCM uses a novel two-stage Bloom filters to represent monitoring rules using small memory space. It utilizes the centralized SDN control to install, update, and reconstruct the two-stage Bloom filters in the switch data plane. We study how DCM performs two representative monitoring tasks, namely flow size counting and packet sampling, and evaluate its performance. Experiments using real data center and ISP traffic data on real network topologies show that DCM achieves highest measurement accuracy among existing solutions given the same memory budget of switches.

In the current scenarios most of the business growth comes from the user experience, while using the business applications. Any enterprise network performance depends on the fundamental process of securely serving the user with applications. The network usage patterns have completely changed from just data transfer, voice, and video transmissions to serving entire applications over the networks. With all the modern applications served over the private and public clouds the network resources utilization must be optimized and take full advantage of them which is not possible with current network architectures. The enterprises are currently shifting towards software defined implementation due to many reasons like consistent policy application across the network, run time analytics for troubleshooting the problems and making the network cloud computing ready. Software defined approaches provide centralized security monitoring and control, user data and identity-based segmentation over the network, dynamic recovery from network infrastructure failure and finally virtualization of almost everything. This paper is an overview of the functioning of enterprises in the networking perspective along with current software defined approaches being used in enterprise networking which will soon take over the traditional networks by solving the challenges present in the software defined networking. 

The requirements for the network are increasing by the expanding and spreading the Internet. The Previous techniques of the network do not meet the modern needs, thus, a new technical presents software-defined networking (SDN). SDN recognizes as a promising new model that separates the control plane (traffic routing and network topology) from the data plane (network architecture layers). The architecture of SDN has some features that find in a single controller or many controllers instance of programmable, flexible, and scalable. In the current SDN, multiple controllers are essential. Therefore, the optimal number of the controllers and their locations is the most significant challenge, known as the controller placement problem (CPP). It deploys the optimal number of controllers within the network while meeting presentations requirements considered conflicting in nature example: credibility, load balancing, latency, energy efficiency, and computation time. Many studies researched the ways to develop solutions for improving scalability, place selection for SDN. This paper presents the CPP and gives a comprehensive review of SDN issues based on the recent well-known research to extract available solution strategies. Finally, it discusses the limitations and future study directions that can support researchers in this field.

Software-defined networks are revolutionizing networking by providing unprecedented visibility into and control over data communication networks. The focus of this work is to develop a method to extract network features, develop a closed-loop control framework for a software-defined network, and build a test bed to validate the proposed scheme. The method developed to extract the network features is called the dual-basis analysis, which is based on the eigendecomposition of a weighted graph that accounts for the network topology and traffic load. A software-defined network closed-loop control scheme is developed; the scheme is modeled after a closed-loop control system that includes an observer and a controller. A particle filter and phantom node are used to estimate link data rates and identify the onset of congestion. Based on the outputs of the observer, the controller is able to balance traffic throughout the network to minimize congestion. A software-defined network test bed is developed to evaluate the proposed dual-basis representation and the closed-loop control scheme. The test bed is a real-world implementation of a software-defined network that consists of 13 switches and one controller. The test bed ensures that the proposed schemes are suitable even when applied in a hardware or software implementation.

Dramatic mobile data traffic growth has spurred a dense deployment of small cell base stations (SCBSs). Small cells enhance the spectrum efficiency and thus enlarge the capacity of mobile networks. Although SCBSs consume much less power than macro BSs (MBSs) do, the overall power consumption of a large number of SCBSs is phenomenal. As the energy harvesting technology advances, base stations (BSs) can be powered by green energy to alleviate the on-grid power consumption. For mobile networks with high BS density, traffic load balancing is critical in order to exploit the capacity of SCBSs. To fully utilize harvested energy, it is desirable to incorporate the green energy utilization as a performance metric in traffic load balancing strategies. In this paper, we have proposed a traffic load balancing framework that strives a balance between network utilities, e.g., the average traffic delivery latency, and the green energy utilization. Various properties of the proposed framework have been derived. Leveraging the software-defined radio access network architecture, the proposed scheme is implemented as a virtually distributed algorithm, which significantly reduces the communication overheads between users and BSs. The simulation results show that the proposed traffic load balancing framework enables an adjustable trade-off between the on-grid power consumption and the average traffic delivery latency, and saves a considerable amount of on-grid power, e.g., 30%, at a cost of only a small increase, e.g., 8%, of the average traffic delivery latency.

To address latency and throughput challenges in software defined networks (SDNs), the research investigates cognitive routing's revolutionary implications. In today's data-driven world, network performance optimisation is crucial. Cognitive routing is a dynamic and potentially disruptive network management technology. Cognitive routing, strengthened by reinforcement learning and adaptive decision-making, is crucial to network efficiency and responsiveness, according to our study. The results show that cognitive routing optimises performance by limiting delay and maximising throughput. SDN application cognitive routing engine (CRE) driving forces, design, and preliminary assessment are described in this article. The CRE finds almost optimal paths for a user's quality of service (QoS) need while minimising monitoring overhead. Instead of global monitoring to find optimal paths, local monitoring achieves this. In ad-hoc networks, finding a trustworthy path reduces latency and ensures network stability. The proposed system was simulated utilising many parameters. Compared to previous SDN-based systems, end-to-end latency and ping round-trip time were better.

Multicast data delivery can significantly reduce traffic in operators' networks, but has been limited in deployment due to concerns such as the scalability of state management. This paper shows how multicast can be implemented in contemporary software defined networking (SDN) switches, with less state than existing unicast switching strategies, by utilising a Bloom Filter (BF) based switching technique. Furthermore, the proposed mechanism uses only proactive rule insertion, and thus, is not limited by congestion or delay incurred by reactive controller-aided rule insertion. We compare our solution against common switching mechanisms such as layer-2 switching and MPLS in realistic network topologies by modelling the TCAM state sizes in SDN switches. The results demonstrate that our approach has significantly smaller state size compared to existing mechanisms and thus is a multicast switching solution for next generation networks.

In this paper, we examine the problem of how to schedule the migrations and how to allocate network resources for migration when multiple VMs need to be migrated at the same time. We consider the problem in the Software-defined Network (SDN) context since it provides flexible control on routing. More specifically, we propose a method that computes the optimal migration sequence and network bandwidth used for each migration. We formulate this problem as a mixed integer programming, which is NP-hard. To make it computationally feasible for large scale data centers, we propose an approximation scheme via linear approximation plus fully polynomial time approximation, and obtain its theoretical performance bound. Through extensive simulations, we demonstrate that our fully polynomial time approximation (FPTA) algorithm has a good performance compared with the optimal solution and two state of-the-art algorithms. That is, our proposed FPTA algorithm approaches to the optimal solution with less than 10% variation and much less computation time. Meanwhile, it reduces the total migration time and the service downtime by up to 40% and 20% compared with the state-of-the-art algorithms, respectively.

Redistribution of the intelligence and management in the software defined networks (SDNs) is a potential approach to address the bottlenecks of scalability and integrity of these networks. We propose to revisit the routing concept based on the notion of regions. Using basic and consistent definition of regions, a region-based packet routing called SmartRegion Routing is presented. The flexibility of regions in terms of naming and addressing is then leveraged in the form of a region stack among other features placed in the associated packet header. In this way, most of complexity and dynamicity of a network is absorbed, and therefore highly fast and simplified routing at the inter-region level along with semi-autonomous intra-region routing will be feasible. In addition, multipath planning can be naturally realized at both inter and intra levels. A basic form of SmartRegion routing mechanism is provided. Simplicity, scalability, and manageability of the proposed approach would also bring future potentials to reduce energy consumption and environmental footprint associated to the SDNs. Finally, various applications, such as enabling seamless broadband access, providing beyond IP addressing mechanisms, and also address-equivalent naming mechanisms, are considered and discussed.

The exponential growth of users in data networks presents significant challenges in terms of availability and traffic management. The advent of software-defined networking (SDN) technology offers new opportunities for enhancing performance and reducing operational costs. This article compares traditional data networks using conventional routing protocols like OSPF with SDN networks. An evaluation scenario was designed to assess the performance of conventional data networks configured with OSPF against those implemented with SDN using OpenFlow. Performance tests were conducted with various packet sizes, evaluating round-trip time (RTT) and jitter metrics using GNS3 and Mininet software to simulate conventional and SDN networks, respectively. The results demonstrated superior performance in SDN, with shorter transmission times; RTT values reached a maximum of 0.18 ms for packets ranging from 32 to 512 bytes, and jitter values remained below 1 ms. Furthermore, a routing analysis highlighted the need for specifying path redundancy in SDN environments via simulation scripts, a limitation not observed in conventional networks. This emphasizes the importance of addressing this issue when deploying SDN in production environments. 

Nowadays, Internet of things (IoT) is imminent technology which enables billions of devices connected with network to interchange real-time information. With development of smart devices related to Internet, network security is hardest challenges for IoT. Maintaining and securing in heterogeneous and large scale networks is a challenging chore. Thus, Software Defined Networking (SDN) presents numerous opportunities and provides prospective to beat those security challenges. In this paper, SDN framework was proposed for presenting network security in gateways of IoT. An experimental validation of framework is focuses on security problems among all other challenges and results in enforcement of security at network edge. Results of our evaluation shows SDN architecture model can efficiently and effectively meet the security challenges created by the network.

The global data center market is growing as more and more enterprises are increasingly adopting cloud computing services and applications. Data centers are evolving towards highly virtualized architectures where transformation to software defined network (SDN) based solutions provides benefits in terms of network programmability, automation, and flow visibility. With the benefits, the need for securing network becomes essential as many critical applications are hosted on to such networking platforms. Anomaly detection is a continuous process of monitoring the traffic pattern and alerting the user about the anomalies if detected. For such real time analysis NoSQL and relational databases are less efficient. This paper proposes a framework for anomaly detection and alerting system using Elasticsearch database for SDN. Traffic patterns generated from SDN devices are continuously monitored and predefined actions are taken immediately if an anomaly is detected. The proof of concept is implemented in NOKIAs Nuage Networks Laboratory and the results showed a real time anomaly detection and took relevant actions within minimum time. 

The global data center market is growing as more and more enterprises are increasingly adopting cloud computing services and applications. Data centers are evolving towards highly virtualized architectures where transformation to software defined network (SDN) based solutions provides benefits in terms of network programmability, automation, and flow visibility. With the benefits, the need for securing network becomes essential as many critical applications are hosted on to such networking platforms. Anomaly detection is a continuous process of monitoring the traffic pattern and alerting the user about the anomalies if detected. For such real time analysis NoSQL and relational databases are less efficient. This paper proposes a framework for anomaly detection and alerting system using Elasticsearch database for SDN. Traffic patterns generated from SDN devices are continuously monitored and predefined actions are taken immediately if an anomaly is detected. The proof of concept is implemented in NOKIAs Nuage Networks Laboratory and the results showed a real time anomaly detection and took relevant actions within minimum time. 

Multipath forwarding consists of using multiple paths simultaneously to transport data over the network. While most such techniques require endpoint modifications, we investigate how multipath forwarding can be done inside the network, transparently to endpoint hosts. With such a network-centric approach, packet reordering becomes a critical issue as it may cause critical performance degradation. We present a Software Defined Network architecture which automatically sets up multipath forwarding, including solutions for reordering and performance improvement, both at the sending side through multipath scheduling algorithms, and the receiver side, by resequencing out-of-order packets in a dedicated in-network buffer. We implemented a prototype with commonly available technology and evaluated it in both emulated and real networks. Our results show consistent throughput improvements, thanks to the use of aggregated path capacity. We give comparisons to Multipath TCP, where we show our approach can achieve a similar performance while offering the advantage of endpoint transparency.

Software defined networks (SDNs) is one of the most emerging field and will cause revolution in the Information Technology (IT) industry. The flexibility in the SDNs make it most attractive technology to adopt in all type of networks. This flexibility in the network made the SDNs more prone to the security issues so it is important to cater these issues in start from the SDN design up-to the deployment and operations. This Paper proposed a DNS based approach to prevent SDNs from botnet by applying one million web database concept without reading packet payload. To do any activity, Bot need to communicate with CnC and requires DNS to IP resolution. For any request having destination port 53 (DNS) will be checked. The protocol will get all matching traffic and will send it to 1Mdb. If URL Exists in 1Mdb then do not respond otherwise send reply with remove flow and block flow to the controller. This approach will use Machine learning algorithms to classify the traffic as BOT or normal traffic. Naive Bayes Classifier is used to classify the data using python programming language. The selection of dataset is very important task for machine learning based botnet detection and prevention techniques. The poor selection of dataset possibly lead to biased results. The real world and publically available dataset is a good choice for evaluation of botnet detection techniques. To meet these criteria, publicly available CTU-43 botnet dataset has been used. This dataset provide packet dumps (pcap files) of seven real botnets (Neris, Rbot, Virut, Murlo, Menti, Sogou, and NSIS). We will use these files to generate botnet traffic for evaluation and test our model. To generate normal traffic, we selected ISOT dataset. This dataset provides a single pcap file having normal traffic and traffic for weladec and zeus botnet.

The size of modern data centers is constantly increasing. As it is not economic to interconnect all machines in the data center using a full-bisection-bandwidth network, techniques have to be developed to increase the efficiency of data-center networks. The Software-Defined Network paradigm opened the door for centralized traffic engineering (TE) in such environments. Up to now, there were already a number of TE proposals for SDN-controlled data centers that all work very well. However, these techniques either use a high amount of flow table entries or a high flow installation rate that overwhelms available switching hardware, or they require custom or very expensive end-of-line equipment to be usable in practice. We present HybridTE, a TE technique that uses (uncertain) information about large flows. Using this extra information, our technique has very low hardware requirements while maintaining better performance than existing TE techniques. This enables us to build very low-cost, high performance data-center networks.

The emerging Software Defined Networking (SDN) paradigm separates the data plane from the control plane and centralizes network control in an SDN controller. Applications interact with controllers to implement network services, such as network transport with Quality of Service (QoS). SDN facilitates the virtualization of network functions so that multiple virtual networks can operate over a given installed physical network infrastructure. Due to the specific characteristics of optical (photonic) communication components and the high optical transmission capacities, SDN based optical networking poses particular challenges, but holds also great potential. In this article, we comprehensively survey studies that examine the SDN paradigm in optical networks; in brief, we survey the area of Software Defined Optical Networks (SDONs). We mainly organize the SDON studies into studies focused on the infrastructure layer, the control layer, and the application layer. Moreover, we cover SDON studies focused on network virtualization, as well as SDON studies focused on the orchestration of multilayer and multidomain networking. Based on the survey, we identify open challenges for SDONs and outline future directions.

With the proliferation of mobile demands and increasingly multifarious services and applications, mobile Internet has been an irreversible trend. Unfortunately, the current mobile and wireless network (MWN) faces a series of pressing challenges caused by the inherent design. In this paper, we extend two latest and promising innovations of Internet, software-defined networking and network virtualization, to mobile and wireless scenarios. We first describe the challenges and expectations of MWN, and analyze the opportunities provided by the software-defined wireless network (SDWN) and wireless network virtualization (WNV). Then, this paper focuses on SDWN and WNV by presenting the main ideas, advantages, ongoing researches and key technologies, and open issues respectively. Moreover, we interpret that these two technologies highly complement each other, and further investigate efficient joint design between them. This paper confirms that SDWN and WNV may efficiently address the crucial challenges of MWN and significantly benefit the future mobile and wireless network.

With the rising interest of expedient, safe, and high-efficient transportation, vehicular ad hoc networks (VANETs) have turned into a critical technology in smart transportation systems. Because of the high mobility of nodes, VANETs are vulnerable to security attacks. In this paper, we propose a novel framework of software-defined VANETs with trust management. Specifically, we separate the forwarding plane in VANETs from the control plane, which is responsible for the control functionality, such as routing protocols and trust management in VANETs. Using the on-demand distance vector routing (TAODV) protocol as an example, we present a routing protocol named software-defined trust based ad hoc on-demand distance vector routing (SD-TAODV). Simulation results are presented to show the effectiveness of the proposed software-defined VANETs with trust management.