Single Failure Routing Protection Algorithm in the Hybrid SDN Network

Loop free alternate(LFA)is a routing protection scheme that is currently deployed in commercial routers.However,LFA cannot handle all single network component failure scenarios in traditional networks.As Internet service providers have begun to deploy software defined network(SDN)technology,the Internet will be in a hybrid SDN network where traditional and SDN devices coexist for a long time.Therefore,this study aims to deploy the LFA scheme in hybrid SDN network architecture to handle all possible single network component failure scenarios.First,the deployment of LFA scheme in a hybrid SDN network is described as a 0-1 integer linear programming(ILP)problem.Then,two greedy algorithms,namely,greedy algorithm for LFA based on hybrid SDN(GALFAHSDN)and improved greedy algorithm for LFA based on hybrid SDN(IGALFAHSDN),are proposed to solve the proposed problem.Finally,both algorithms are tested in the simulation environment and the real platform.Experiment results show that GALFAHSDN and IGALFAHSDN can cope with all single network component failure scenarios when only a small number of nodes are upgraded to SDN nodes.The path stretch of the two algorithms is less than 1.36.

Application-aware routing with QoS support in SDN networks

Software defined networking( SDN) offers programmable interface to effectively control their networks by decoupling control and data plane. The network operators utilize a centralized controller to deploy advanced network management strategies. An architecture for application-aware routing which can support dynamic quality of service( Qo S) in SDN networks is proposed. The applicationaware routing as a multi-constrained optimal path( MCOP) problem is proposed,where applications are treated as Qo S flow and best-effort flows. With the SDN controller applications,it is able to dynamically lead routing decisions based on application characteristics and requirements,leading to a better overall user experience and higher utilization of network resources. The simulation results show that the improvement of application-aware routing framework on discovering appropriate routes,which can provide Qo S guarantees for a specific application in SDN networks.

Threshold-Based Software-Defined Networking(SDN)Solution for Healthcare Systems against Intrusion Attacks

The healthcare sector holds valuable and sensitive data.The amount of this data and the need to handle,exchange,and protect it,has been increasing at a fast pace.Due to their nature,software-defined networks(SDNs)are widely used in healthcare systems,as they ensure effective resource utilization,safety,great network management,and monitoring.In this sector,due to the value of thedata,SDNs faceamajor challengeposed byawide range of attacks,such as distributed denial of service(DDoS)and probe attacks.These attacks reduce network performance,causing the degradation of different key performance indicators(KPIs)or,in the worst cases,a network failure which can threaten human lives.This can be significant,especially with the current expansion of portable healthcare that supports mobile and wireless devices for what is called mobile health,or m-health.In this study,we examine the effectiveness of using SDNs for defense against DDoS,as well as their effects on different network KPIs under various scenarios.We propose a threshold-based DDoS classifier(TBDC)technique to classify DDoS attacks in healthcare SDNs,aiming to block traffic considered a hazard in the form of a DDoS attack.We then evaluate the accuracy and performance of the proposed TBDC approach.Our technique shows outstanding performance,increasing the mean throughput by 190.3%,reducing the mean delay by 95%,and reducing packet loss by 99.7%relative to normal,with DDoS attack traffic.

一种基于SDN的网络安全框架及安全策略设计

软件定义网络(Softeware Defined Network, SDN)是一种新型的网络体系架构,目前已成为下一代互联网研究的热点。为了解决SDN中的网络信息安全问题,文章对SDN中的控制平面、数据平面和应用平面进行分析,梳理并总结了SDN管理中的相关网络安全问题。提出了一种基于SDN的网络安全框架及安全策略,有效弥补传统网络结构中的网络安全缺陷问题,增强SDN网络安全级别,并建立一种基于终端用户限定与管理的SDN的网络安全框架及其安全策略。

基于SDN的校园网络管理与优化方案研究

为探讨基于软件定义网络(Software Defined Network,SDN)理念的校园网络管理与优化方案,本文从校园网络管理需求、SDN网络架构特点以及基于SDN的校园网络管理优势与场景出发,探讨基于SDN的校园网络管理与优化方案,以网络结构设计、功能融合以及接口结构、网络安全、负载均衡等角度予以阐述。

基于人工智能的SDN网络中流量优化与拥塞控制方法

文章深入研究基于强化学习的流量优化与拥塞控制方法在软件定义网络(Software Defined Network,SDN)中的应用。首先,详细阐述SDN网络的架构与原理。SDN网络的灵活性和可编程性为网络管理提供了全新的范式。其次,提出了一种基于强化学习的流量优化与拥塞控制方法,通过建模状态、动作、奖励等要素,实现网络流量智能调整。最后,在Mininet仿真环境中进行了实验验证。通过监测吞吐量、延迟、拥塞情况等性能指标,验证所提方法的有效性。实验结果表明,在网络性能方面,所提方法相较于传统方法取得了显著改善,具备更好的适应性和优化能力。

ADAFT:SDN大规模流表的适应性深度聚合存储架构

为解决软件定义网络(SDN)数据平面中的三态内容可寻址存储器(TCAM)资源紧张问题,提出了一种基于内容表项树的SDN流表深度聚合方法,进而构建一种SDN大规模流表的适应性深度聚合存储架构ADAFT。该架构放宽了聚合表项之间的汉明距离要求,构建内容表项树聚合动作集不同的流表项,显著提高了流表聚合程度。设计了一种TCAM装载率感知的内容表项树动态限高机制,以降低流表查找开销。同时,提出了一种TCAM装载率感知的表项聚合适应性选择策略,以均衡流表聚合程度和查找开销。实验结果表明,ADAFT架构的流表压缩率明显高于现有方法,最高可达65.74%。

智慧校园网络及安全的SDN架构选择分析

重点研究智慧校园网络与安全的软件定义网络(Software Defined Network,SDN)架构选择,分别讨论SDN架构应用的必要性、实现方法、网络与安全维护建议等内容。从智慧校园的集中部署、意图网络与智慧校园的融合、以零信任为核心构建网络安全架构3个维度出发,提出保护智慧校园网络安全的建议。旨在强调SDN架构对于智慧校园建设的运行安全维护作用,以期为今后智慧校园的深化建设提供技术支持。

基于SDN弹性光网络的电力通信网智能业务编排方法

针对电力通信网差异化业务编排问题,首先构造基于SDN弹性光网络的电力通信网框架,通过业务层与SDN控制层完成配电网数据交互,支撑配网多种不同优先级电力通信网业务的正常运行。其次,提出基于自适应业务优先级感知的电力通信网智能业务编排算法,根据不同业务优先级自适应调节探索因子,权衡不同优先级业务摇臂选择时的探索和利用的倾向,从而保证高优先级业务的高可靠传输的同时降低网络开销。最后,通过算例分析验证所提技术在能效、时延等方面的性能优势。文章的研究内容能为电力通信网差异化业务数据流低时延高效传输提供参考,从而支撑电力通信网高效运行。

一种面向SDN的传统网络功能集成方法设计与实现

软件定义网络(SDN)通过将控制平面与数据平面分离并使网络可编程来改变网络的管理方式。控制器是SDN网络的关键组成部分。对于诸如DHCP中继功能、动态路由功能等传统网络功能,目前已存在成熟的第三方网络组件。基于能够更便捷地开发面向SDN的传统网络应用,设计与实现一种通用的传统网络功能集成方法,该方法通过将底层网络流量同步给第三方网络组件,由第三方网络组件完成核心的网络功能。文中基于ONOS控制器利用该集成方法开发了一款通用的传统网络应用,并通过集成DHCP Relay功能的实验完成了对该集成方法的功能性验证。

A 5G Perspective of an SDN-Based Privacy-Preserving Scheme for IoT Networks

The ever-increasing needs of Internet of Things networks (IoTn) present considerable issues in computing complexity, security, trust, and authentication, among others. This gets increasingly more challenging as technology advances, and its use expands. As a consequence, boosting the capacity of these networks has garnered widespread attention. As a result, 5G, the next phase of cellular networks, is expected to be a game-changer, bringing with it faster data transmission rates, more capacity, improved service quality, and reduced latency. However, 5G networks continue to confront difficulties in establishing pervasive and dependable connections amongst high-speed IoT devices. Thus, to address the shortcomings in current recommendations, we present a unified architecture based on software-defined networks (SDNs) that provides 5G-enabled devices that must have complete secrecy. Through SDN, the architecture streamlines network administration while optimizing network communications. A mutual authentication protocol using elliptic curve cryptography is introduced for mutual authentication across certificate authorities and clustered heads in IoT network deployments based on IoT. Again, a dimensionality reduction intrusion detection mechanism is introduced to decrease computational cost and identify possible network breaches. However, to leverage the method’s potential, the initial module's security is reviewed. The second module is evaluated and compared to modern models.

How AI-enabled SDN technologies improve the security and functionality of industrial IoT network:Architectures,enabling technologies,and opportunities

The ongoing expansion of the Industrial Internet of Things(IIoT)is enabling the possibility of effective Industry 4.0,where massive sensing devices in heterogeneous environments are connected through dedicated communication protocols.This brings forth new methods and models to fuse the information yielded by the various industrial plant elements and generates emerging security challenges that we have to face,providing ad-hoc functions for scheduling and guaranteeing the network operations.Recently,the large development of SoftwareDefined Networking(SDN)and Artificial Intelligence(AI)technologies have made feasible the design and control of scalable and secure IIoT networks.This paper studies how AI and SDN technologies combined can be leveraged towards improving the security and functionality of these IIoT networks.After surveying the state-of-the-art research efforts in the subject,the paper introduces a candidate architecture for AI-enabled Software-Defined IIoT Network(AI-SDIN)that divides the traditional industrial networks into three functional layers.And with this aim in mind,key technologies(Blockchain-based Data Sharing,Intelligent Wireless Data Sensing,Edge Intelligence,Time-Sensitive Networks,Integrating SDN&TSN,Distributed AI)and improve applications based on AISDIN are also discussed.Further,the paper also highlights new opportunities and potential research challenges in control and automation of IIoT networks.

Detecting and Mitigating DDOS Attacks in SDNs Using Deep Neural Network

Distributed denial of service(DDoS)attack is the most common attack that obstructs a network and makes it unavailable for a legitimate user.We proposed a deep neural network(DNN)model for the detection of DDoS attacks in the Software-Defined Networking(SDN)paradigm.SDN centralizes the control plane and separates it from the data plane.It simplifies a network and eliminates vendor specification of a device.Because of this open nature and centralized control,SDN can easily become a victim of DDoS attacks.We proposed a supervised Developed Deep Neural Network(DDNN)model that can classify the DDoS attack traffic and legitimate traffic.Our Developed Deep Neural Network(DDNN)model takes a large number of feature values as compared to previously proposed Machine Learning(ML)models.The proposed DNN model scans the data to find the correlated features and delivers high-quality results.The model enhances the security of SDN and has better accuracy as compared to previously proposed models.We choose the latest state-of-the-art dataset which consists of many novel attacks and overcomes all the shortcomings and limitations of the existing datasets.Our model results in a high accuracy rate of 99.76%with a low false-positive rate and 0.065%low loss rate.The accuracy increases to 99.80%as we increase the number of epochs to 100 rounds.Our proposed model classifies anomalous and normal traffic more accurately as compared to the previously proposed models.It can handle a huge amount of structured and unstructured data and can easily solve complex problems.

SDN网络系统管理平台的设计与实现

文章主要设计一种软件定义网络(Software Defined Network,SDN)管理系统平台,首先分析系统的用户需求,其次提出其整体框架、模块设计以及数据库设计,并进行系统测试。文章所设计的平台能够优化网络维护的流程,提升网络管理员开展日常网络维护工作的效率。

基于SDN和集成学习的工业控制网络安全防护系统

针对工业控制网络通信信息安全与稳定问题,设计一种基于SDN和集成学习的工业控制网络安全防护系统。该系统采用SDN技术,分为物理层、现场层、转发层、控制层和应用层等5个层次。物理层包含现场终端设备;现场层通过控制模块与操作员站实现对现场终端的控制;转发层使用SDN交换机进行通信数据传输,并将数据镜像传输至应用层进行安全分析;控制层中的SDN控制器管理和控制SDN交换机,并执行应用层下发的安全防护策略;应用层利用集成学习算法对工业控制网络进行入侵行为检测,通过安全响应模块分析入侵信息并选择相应的防御机制。实验结果表明,所设计系统满足工业控制网络通信的实时性要求,能准确地实施入侵检测,从而保障工业控制网络的安全性和正常通信。

面向多模态网络的SDN交换机流量调度方法

多模态网络需要识别和解析多种新型模态流量,以实现面向流表的定制化调度。SDN交换机的数据包调度能力决定整个系统的负载分配,对于系统性能起着至关重要的作用。通常情况下采用网卡提供的分流策略将数据包分发至不同的CPU核,但网卡分流策略仅适用于支持的数据包类型,难以满足多种新型模态流量的解析需求。针对上述问题,本文提出一种用于多核SDN交换机的支持预分类和适配分流策略加载的流量分发调度方法。通过协议无关的预分类确定模态所属的流水线集合,同时支持为不同模态加载适配分流策略,将模态流量均衡调度至对应流水线。在基于DPDK的POF交换机中实现了本文提出的调度方法,实验结果表明,相比原生POF交换机,新方法在处理多模态流量时提升约1.54倍的系统吞吐性能,并有效地降低了时延。

基于AI的SDN网络安全方案浅析

随着SDN技术的快速发展和网络安全威胁的日益复杂,对SDN网络进行有效的安全防护变得至关重要。然而,传统的网络安全防护手段和方案,无法快速准确检测SDN网络安全隐患并快速做出响应。为了解决这一问题,提出了一种基于AI的SDN网络安全方案。该方案将SDN网络面临的主要网络安全场景进行综合分析,并结合主流AI技术和威胁情报,及时发现SDN网络面临的安全风险,以帮助企业快速有效定位SDN网络安全问题,并做出快速响应。

SDN网络中的故障检测与修复技术研究

【目的】虽然软件定义网络(SDN)是一种开放的架构,但也存在着各类网络错误。为实现SDN的高可用性,对故障检测与修复机制进行研究是至关重要的。【方法】首先,对SDN架构与OpenFlow协议进行分析,总结出SDN网络中可能出现的错误,并设计出数据平面错误检测方法。其次,基于主动修复与被动修复机制,并考虑数据流量服务的质量(QoS)需求,从而提出主动与被动相结合的故障修复机制。在此基础上,本研究设计出基于开源代码的故障检测与修复方法,其使用的是非同步报警机制监测网络,根据故障数量和影响程度选择3种修复模式。【结果】试验结果表明,本研究设计的方法能有效检测出SDN数据平面中常见的错误,在保障QoS的前提下,能最大限度恢复网络功能。【结论】该方法在处理多类故障和考虑QoS需求方面超过现有机制,为SDN高可用性和应用提供理论与实践基础,而进一步提高对复杂故障的处理能力和增强自修复智能性是后续的研究方向。

基于ACTN和SDOTN标准的SDN跨域管控研究

【目的】为了实现云光智能一体化,解决现有光网络业务部署慢的问题,文章给出了一种跨域跨厂商的端到端业务快速部署方法。【方法】通过分析现网跨域跨厂商业务部署现状,并结合基于流量工程网络抽象与控制(ACTN)标准和软件定义光传送网(SDOTN)标准,发现并解决现有软件定义网络(SDN)管控系统光业务智能一体化部署存在的问题,提出设备厂商SDN管控系统需要改进的方法和方向。【结果】测试验证表明,通过优化改进设备厂商的同步数字体系(SDH)管控系统,能够提升域内端到端业务的开通效率并实现跨域端到端业务的智能一键部署。【结论】测试结果证明,优化和改进设备厂商的SDN管控系统有利于云光智能一体化的业务开通。

基于多层Sketch的SDN网络流量测量技术研究

针对大流检测、突变流检测和基数估计等的网络流量测量对保障网络安全具有重要意义.但当前相关研究存在实时性不足、测量精度不高等问题.针对上述问题,设计了一种基于多层Sketch(multiple layer sketch, ML Sketch)的网络流量测量模型.首先,该模型采用自主设计的ML Sketch结构,使用分类存储结构提高了流量测量的精度.其次,在SDN(software defined network)环境下利用流量实时回放技术,模拟了流量的动态发生场景.最后,在SDN控制平面实现了对大流、突变流和基数估计类流量的实时动态检测.在UNSW-NB15上的实验结果表明,与传统Sketch结构相比,所设计的ML Sketch结构在F1_Score指标上最高提高4.81%,相关误差最高降低81.12%,验证了该模型的有效性.