Search

AFDX (Avionics Full Duplex Switched Ethernet) is developed to support mission-critical communications while providing deterministic Quality of Service (QoS) across cyber-physical avionics systems. Currently, AFDX utilizes FP/FIFO QoS mechanisms to guarantee its real-time performance. To analyze the real-time performance of avionic systems in their design processes, existing work analyzes the deterministic delay bound of AFDX using NC (Network Calculus). However, existing analytical work is based on an unrealistic assumption leading to assumed worst cases that may not be achievable in reality. In this paper, we present a family of algorithms that can search for realistic worst-case delay scenarios in both preemptive and non-preemptive situations. Then we integrate the proposed algorithms with NC and apply our approach to analyzing tandem AFDX networks. Our reality-conforming approach yields tighter delay bound estimations than the state of the art. When there are 100 virtual links in AFDX networks, our method can provide delay bounds more than 25% tighter than those calculated by the state of the art in our evaluation. Moreover, when using our reality-conforming method in the design process, it leads to 27.2% increase in the number of virtual links accommodated by the network in the tandem scenario.

In network function virtualization (NFV), network functions (NFs) are chained as a service function chain (SFC) to enhance NF management with high flexibility. Recent solutions indicate that the processing performance of SFCs can be significantly improved by offloading NFs to programmable switches. However, such offloading requires a deep understanding of NF properties to achieve the maximum SFC performance, which brings non-trivial burdens to network administrators. In this paper, we propose LightNF, a novel system that simplifies NF offloading in programmable networks. LightNF automatically dissects comprehensive NF properties (e.g., NF performance behaviors) via code analysis and performance profiling while eliminating manual efforts. It then leverages the analyzed NF properties in its SFC placement so as to produce the performance-optimal offloading. We have implemented a LightNF prototype. Our experiments show that LightNF outperforms state-of-the-art solutions with an orders-of-magnitude reduction in per-packet processing latency and 9.5× improvement in SFC throughput.

Current Industrial Internet faces serious threats where attackers propagate malicious flows, resulting in communication failures in the Industrial Internet. In this work, we propose a practical and novel method to detect malicious traffic attack in real time with high accuracy. Our primary idea is to capture network flow, extract adequate network flow features, construct a long short-term memory (LSTM) based deep learning model, and identify the property of the corresponding network flow. Whether the network suffers attack or not is then determined according to the detection results. The corresponding prototype is also implemented in the Industrial Internet which is equipped with Software Defined Networking (SDN). Experimental results validate that the proposed method is effective in defending against malicious traffic attack in real-world network.

Hybrid renewable energy system (HRES) is a promising way to promote the supply stability of renewable energy and reduce carbon emission. This paper focuses on designing a novel HRES with equipment type consideration. Multiple types of equipment can improve the flexibility and reliability of the HRES, meanwhile more types means higher investment and maintenance cost. The optimization of such system involves a large number of discrete variables and complex performance equations. To deal with this problem, A two-step approach is proposed in this study. The minimum total annual cost and minimum equipment types are set as the optimization goals. A group of Pareto sets are generated after optimization process. These results can help engineers evaluate the impact of multiple factors and assist them in decision-making.

An adaptive dynamic programming value iteration algorithm is designed to solve nonlinear continuous-time nonzero-sum games in this paper. Since existing studies were developed on policy iteration, the initial condition of control policy requires to be admissible and thus the application has been limited. The proposed algorithm can be started with a more relaxed condition compared with policy iteration based methods, which relaxes the initial condition of the existing works. A simulation example is displayed to show the effectiveness.

The value iteration mechanism is introduced to design the constrained optimal tracking controller for continuous-time nonlinear system in this paper. Unlike most studies were developed by policy iteration, the proposed VI algorithm is designed to be started with arbitrary semi-definite positive function, and thus no restriction is in the initial condition. The iterative property of the proposed algorithm is discussed and the optimality of the iterated results are obtained. To verify the effectiveness, a nonlinear case is simulated.

The intrusion response system is dedicated to automatically respond to sophisticated network intrusions, which is a sequential decision-making problem for autonomous agents. The current Markov decision process (MDP) or stochastic games based solutions suffer from several weaknesses: (i) The MDP- based approach is unable to explicitly model the opponents; (ii) The Nash equilibrium approach of stochastic games cannot handle the condition with multi equilibria. Existing studies have not considered the cognitive ability of the agent and lack of explicit opponent modeling. Inspired by recursive reasoning, this paper introduces a theory of mind (ToM)-based stochastic game-theoretic approach to reason about the beliefs and behaviors of the attackers. Each agent maintains different order ToM beliefs concerning his opponent with explicit opponent modeling. In order to accurately predict the attacker's action with nested beliefs, we utilize the Bayesian attack graph (BAG) to model multi-step attacks scenarios. In addition, the agent is allowed to learn from new information to adjust his beliefs and learning speed. Simulation results validate that ToM modeling performs well in the intrusion response system than random defense actions. Besides, a defender with first-order ToM beliefs always wins an attacker with zero-order ToM beliefs.

Recently, link flooding attacks (LFA) have been observed as a serious threat for cutting off the Internet connectivity through congesting critical links. A LFA typically utilizes legitimate and low-rate flows, which makes it extremely hard to be detected and, subsequently, to be mitigated. In this paper, we present LF-Shield, that is a deep convolutional neural network (ConvNet) based countermeasure to accurately detect and efficiently mitigate LFAs using software-defined network (SDN) paradigm. LF-Shield can identify malicious bots that launch LFA flows by extracting end-hosts’ traffic features and afterwards, classifying the type of end-hosts based on deep ConvNet. Then, LF-Shield mitigates LFAs without affecting legitimate end-hosts through blocking the classified malicious bots and limiting the bandwidths of inactive or newly-accessed end-hosts. A LF-Shield prototype is implemented for evaluating its performance by several experiments. The experimental results demonstrate that LF-Shield can identify malicious bots with an accuracy of 96.4% and mitigate LFAs with the 93.1% reduction in link degradation ratio, with negligible impact on legitimate end-hosts.

Programming a network for innovative services or for function improvements has never been easier using Software-Defined Networking (SDN). However, the programming tasks can also be significantly complicated by the asynchrony of data plane states and complexities of service control states. In order to reduce the complexity for programming a network service in Distributed Control Plane of SDN, we propose a proGRAmming Control (GRACE) layer as a generic solution, which provides two key features, namely, reconfigurability and reusability. Their implementations deal with aforementioned challenges, thus to achieve the consistency of the data plane states and the reusability of the service control states at the distributed controllers. This paper introduces the reconfigurability and reusability with their design goals and their impact on the programmability of DCP. We further use two popular network services, ICN (Information-Centric Networking) and CDN (Content Distribution Networks) to illustrate these concepts. NS-3 simulations and PlanetLab emulations are conducted to show the advantage of using the GRACE layer for ICN and CDN. Results show that the ICN Interest delay is reduced by 19.6% and CDN request delay is reduced by 81% in extremely harsh network conditions.

Software-Defined Networking (SDN) separates the control plane from the data plane to improve the control flexibility, supporting multiple services with their isolated physical resources. In SDN, the virtual network (VN) mapping is required by network services for allocating these resources in the multidomain SDN. Such mapping problem is challenged by the NP-Completeness of the mapping and business privacy to protect the domain topology. We propose a novel multi-domain mapping algorithm for SDN using a distributed architecture to achieve a better efficiency and flexibility than the traditional PolyViNE approach, meanwhile protecting the privacy. By simulating on a large synthesized topology with 10 to 40 domains, our approach shows 25% and 15% faster than the PolyViNE in time, and 30% better in balancing load on multiple controllers.