Search

Reinforcement learning (RL) is a promising approach for intelligent agents to protect a given system under highly hostile environments. RL allows the agent to adaptively make sequential defense decisions based on the perceived current state of system security aiming to achieve the maximum defense performance in terms of fast, efficient, and automated detection, threat analysis, and response to the threat. In this paper, we propose a deep reinforcement learning (DRL)-based adaptive traffic inspection and moving target defense countermeasure framework, called 'DIVERGENCE,' for building a secure networked system. The DIVERGENCE provides two main security services: (1) a DRL-based network traffic inspection mechanism to achieve scalable and intensive network traffic visibility for rapid threat detection; and (2) an address shuffling-based moving target defense (MTD) technique to defend against threats as a proactive intrusion prevention mechanism. Through extensive simulations and experiments, we demonstrate that the DIVERGENCE successfully caught malicious traffic flows while significantly reducing the vulnerability of the network through MTD. International Technology Center Pacific (ITC-PAC) [FA520920C0022]; Army Research Office [W91NF-20-2-014]; NSF [2107450] Published version This material is based upon work supported by the International Technology Center Pacific (ITC-PAC) under Contract No. FA520920C0022, and the research was partly supported by the Army Research Office under Grant Contract Numbers W91NF-20-2-014 and NSF Grant 2107450.

​© 2022 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. Software-defined networking (SDN) logically separates the control and data planes, thus opening the way to more flexible configurations and management of low-Earth orbit (LEO) satellite networks. Since one or, more generally, multiple distributed controllers are needed, a significant challenge in SDN is the controller placement problem (CPP). Due to characteristics such as the dynamic network topology, limited bandwidth and traffic variations, the CPP is quite complex in SDN-based satellite networks. In this paper, we propose solving the CPP by means of a static placement with dynamic assignment (SPDA) method for LEO satellite networks. The SPDA method has two parts: the first is to incorporate SDN controllers into some fixed satellites by formulating a mixed integer programming model; the second is to dynamically assign switches to existing controllers according to the switch-controller latency and the traffic load of controllers. The SPDA method takes the topological dynamics into account by effectively dividing time snapshots, and it has a lower bandwidth consumption compared with methods involving controller migrations. Real satellite constellations are used to evaluate the performance of our controller placement solution. The results show that SPDA outperforms existing methods in terms of reducing the switch-controller latency, and it also has good load balancing performance.

In software defined networking, the flat design of distributed control plane enables the management of multi-domain networks that are incapable of deploying a root controller. However, it is very difficult to avoid policy conflicts between independent local controllers due to the lack of centralized arbitration. Moreover, domains without trust may not be always cooperative and could even cheat to maximize their own interests. In this paper, we first consider the cooperative scenario and address the problem of traffic engineering in a flat distributed control plane. We propose a fully distributed algorithm, called DisTE, which can provide max-min fair bandwidth allocation for flows and maximize resource utilization. DisTE also preserves the local topology of each domain and achieves policy consistency by multiple rounds of synchronizations. We then consider the non-cooperative scenario, where selfish domains may discriminate bandwidth requests from other domains or overstate their owns to squeeze more bandwidths. DisTE is enhanced to defend against such behaviors. Experiments on a 717-switches 5-domain network demonstrate that DisTE could drive the link utilization ratio to more than 93%, and reduce up to 95% convergence time at cost of 3% relative error on fairness, compared to the centralized approach. The countermeasures against selfish behaviors are also demonstrated to be extremely effective.

Geographically distributed applications hosted on cloud are becoming prevalent. They run on cross-datacenter network that consists of multiple data center networks (DCNs) connected by a wide area network (WAN). Such a cross-DC network imposes significant challenges in transport design because the DCN and WAN segments have vastly distinct characteristics (e.g., butter depths, RTTs). In this paper, we find that existing DCN or WAN transports reacting to ECN or delay alone do not (and cannot be extended to) work well for such an environment. The key reason is that neither of the signals, by itself, can simultaneously capture the location and degree of congestion. This is due to the discrepancies between DCN and WAN. Motivated by this, we present the design and implementation of GEMINI that strategically integrates both ECN and delay signals for cross-DC congestion control. To achieve low latency, GEMINI bounds the inter-DC latency with delay signal and prevents the intra-DC packet loss with ECN. To maintain high throughput, GEMINI modulates the window dynamics and maintains low butter occupancy utilizing both congestion signals. GEMINI is implemented in Linux kernel and evaluated by extensive testbed experiments. Results show that GEMINI achieves up to 53%, 31% and 76% reduction of small flow average completion times compared to TCP Cubic, DCTCP and BBR; and up to 58% reduction of large flow average completion times compared to TCP Vegas.

Wireless virtualization has emerged as one of the efficient ways to overcome numerous wireless networking challenges such as RF resource sharing. RF spectrum sharing in wireless networks focuses on increasing the usage efficiency of radio frequency (RF) spectrum with its increasing demand. To reduce uncertainties that accompany the spectrum sharing process caused by RF sensing, database-based spectrum sharing allows opportunistic spectrum access through occupancy information query of a spectrum database. In this paper, we propose a 2-level hierarchical spectrum allocation framework for multiple service-based virtual networks (VN) by leasing wireless resources from Wireless Infrastructure Providers (WIPs). The software defined network (SDN)-enabled virtualization configures the operating environment on the fly. This paper focuses on the competition between multiple VNs to get best RF channels to serve their users while eliminating the need for one-to-one contracts between VNs and WIPs. We develop a mathematical model for the spectrum allocation scheme which allows heterogeneous network configurations with better economic benefit. A trust-based security mechanism is also proposed for early detection and prevention of security attacks to maintain the availability attribute of the resource allocation process. Simulation results show that spectrum sharing is efficient, and assures service availability to perceived legitimate VN users.

Future mobile networks are envisioned to become multi-service systems, enabling the dynamic deployment of services with vastly different performance requirements, accommodating the needs of diverse service providers. Virtualizing the mobile network infrastructure is of fundamental importance for realizing this vision in a cost-effective manner. While there have been extensive research efforts in virtualization for the mobile core network, virtualization in the radio access network (RAN) is still at an early stage. In this paper, we present AIRTIME, a new RAN slicing system that enables the dynamic on-the-fly virtualization of RANs, with the programmability required by service providers to customize any aspect of their virtual RAN to meet their service needs. We present a prototype implementation of AIRTIME and evaluate the: (i) capacity to create virtual RANs on-the-fly, (ii) performance experienced by slice owners, (iii) isolation among multiple virtual RANs sharing the same physical infrastructure, and (iv) scalability to accommodate a large number of virtual RANs. Accepted version

The densified deployment of heterogeneous networks coexisting with cells with overlapping coverage has emerged as a viable solution for next generation wireless networks. Despite numerous advantages, heterogeneity and denseness also raise complicated handover management issue. Nonetheless, most existing handover methods generally depend on one or more objective attributes, and rarely consider subjective demands of personalized users and specific applications that demand differentiated services. Through decomposing control plane and data plane, SDN (Software Defined Network) offers a flexible architectural paradigm to overcome these challenges. In this paper, we first develop an SDN-driven handover architecture that perceives global network status and requirements from various perspectives, including physical layer, users, and applications. Then, a context-aware multi-criteria handover mechanism is developed in SDN edge to provide differentiated services. Considering numerous complicated factors, the handover decision is made based on a hierarchical fuzzy inference system to process diverse attributes and vague requirements described in natural language. Finally, we evaluate the performance of our proposed scheme through a combination of extensive simulations and real-world experiments. The results demonstrate that our solution outperforms baseline handover schemes, more efficiently providing differentiated services with respect to throughput, bandwidth cost, and application satisfaction, and is efficient and feasible in practice.

To minimize operating expenses (OPEX) and enhance flexibility for network service provisioning, network function virtualization (NFV) is used to chain an ordered sequence of virtualized network functions (VNFs), also known as service function chain (SFC), which can be placed on commodity servers. As a highly complementary to NFV, softwaredefined networking (SDN) can offer an agile way of VNF orchestration with the capability of fine-granularity network control over flows. However, one-step migration to SDN is impossible in ISP networks. Thus, in this paper we resort to hybrid SDN to implement SFC provisioning. By jointly optimizing SDN deployment that largely determines capital expenditures (CAPEX) and VNF placement that decides OPEX, we manage to make a tradeoff between CAPEX and OPEX, and to find out an appropriate SDN deployment rate for network operator. We first formulate the problem as an integer linear programming (ILP) model P, then, reformulate it with column generation technique and decomposition theory to develop a distributed approximation algorithm CGPD which obtains a tight upper bound of optimal solution to P. In order to better decrease CAPEX, a dynamic programmingbased heuristic EOES giving importance to effective resource sharing is further designed based on a hidden Markov model. The simulation results indicate that, the difference between P and CGPD is marginal. CGPD outperforms EOES in terms of total cost, average delay and bandwidth utilization, and EOES on the other hand demands 20% SDN deployment rate which is half of that of CGPD.

Relying on ofloading computation tasks to the network edge, ultra dense networks (UDNs) are capable of providing delay-aware service to nearby users. Meanwhile, software defined networking (SDN) is deemed as an effective technology to ease the management of infrastructure plane and control plane in UDNs. Specifically, the centralized SDN controller is capable of managing the whole network globally. With the increasing demands for various applications as well as the limitation of computation, storage and communication resource, how to allocate spectrum resource appropriately is imperative. In this paper, we mainly show solicitude for spectrum sharing and edge computation ofloading problems in SDN-based ultra dense networks. To address this issue, we propose a second-price auction scheme for ensuring the fair bidding for spectrum rent. Moreover, the MBS edge cloud is termed as the buyer, and the SBS edge clouds are the sellers who sell the ofloading resource to the MBS edge cloud. To be specific, the spectrum sharing and computation ofloading scheme is executed in the SDN controller, and the controller is responsible for distributing spectrum allocation instructions to the infrastructure plane. Finally, experimental results validate the effectiveness of our proposed scheme in SDN-based ultra dense networks.

With increasing availability and use of Internet of Things (IoT) devices large amounts of streaming data is now being produced at high velocity. Applications which require low latency response such as video surveillance demand a swift and efficient analysis of this data. Existing approaches employ cloud infrastructure to store and perform machine learning based analytics on this data. This centralized approach has limited ability to support analysis of real-time, large-scale streaming data due to network bandwidth and latency constraints between data source and cloud. We propose RealEdgeStream (RES) an edge enhanced stream analytics system for large-scale, high performance data analytics. The proposed approach investigates the problem of video stream analytics by proposing (i) filtration and (ii) identification phases. The filtration phase reduces the amount of data by filtering low value stream objects using configurable rules. The identification phase uses deep learning inference to perform analytics on the streams of interest. The stages are mapped onto available in-transit and cloud resources using a placement algorithm to satisfy the Quality of Service (QoS) constraints identified by a user. The job completion in the proposed system takes 49\% less time and saves 99\% bandwidth compared to a centralized cloud-only based approach.

To increase the flexibility and the dynamism of communication networks, Software Defined Networking (SDN) has emerged as the challenging approach to decouple control and data planes, using a logically centralized controller able to manage the underlying network resources. However, traditional network solutions can not be always used in SDN. In this paper, we deal with routing issued in the setup of dynamic SDNs spanning Fog/Edge and IoT systems for the support of new generation applications. In particular, we propose a modified version of the Dijkstra's routing algorithm that can optimize complex routing metrics and uses MapReduce to speed up the configuration of routers in the network. The system can optimize the packet routing in according to different parameters including, e.g., hops, latency, and energy efficiency policies. In order to validate our work, we performed evaluations on the revised MapReduce version of the Dijkstra routing algorithm considering a high scalable network topology with thousands of virtual nodes.

With an ambitious increase in the number of Internet of Things (IoT) terminals, IoT networks face a huge challenge which is providing diverse and complex network services with different requirements on a common infrastructure. To solve this challenge, Software Defined Network (SDN) and Network Function Virtualization (NFV) are adopted to build next-generation IoT networks which are softwarized and virtualized. This way, network functions are virtualized as Virtualized Network Functions (VNFs) and a network service consists of a set of VNFs. One of the main challenges for realizing this paradigm is the optimal resource allocation for VNFs. Most existing works assumed that services are represented as Service Function Chains (SFCs) which are chains. However, network services in IoT networks are more complex and diverse, therefore, more appropriate representations are Virtualized Network Function Forwarding Graphs (VNFFGs) which are Directed Acyclic Graphs (DAGs). Previous works failed to exploit this special graph structure, which makes them sub-optimal or non-applicable for IoT networks. In this paper, we investigate the VNF-FG placing problem in dynamic IoT networks where DAG-represented services arrive and depart. To fully exploit the graph structures of services and handle the complexity of dynamic IoT networks, we combine a novel neural network structure Graph Neural Network (GNN) with Deep Reinforcement Learning (DRL) and propose an efficient algorithm for VNF-FG placing, which is called Kolin. Extensive simulation results suggest that Kolin outperforms the state-ofthe-art solutions in terms of system cost, acceptance ratio, and computation complexity.

Software defined networking (SDN) is an emerging architecture used in many applications because of its flexible architecture. It is expected to become an essential enabler for the Internet of Things (IoTs). It decouples the control plane from the data plane, and the controller manages the whole underlying network. SDN has been used in wireless sensor networks (WSNs) for routing. The SDN controller uses some algorithms to calculate the routing path; however, none of these algorithms have enough ability to obtain the optimized routing path. Therefore, reinforcement learning (RL) is a helpful technique to select the best routing path. In this paper, we optimize the routing path of SDWSN through RL. A reward function is proposed that includes all required metrics regarding energy efficiency and network quality-of-service (QoS). The agent gets the reward and takes the next action based on the reward received, while the SDWSN controller improves the routing path based on the previous experience. However, the whole network is also controlled remotely through the Web. The performance of the RL-based SDWSN is compared with SDN-based techniques, including Traditional SDN and Energy-Aware Software Defined Networking (EASDN), QR-SDN, TIDE and non SDN-based techniques, such as Q-learning and RL-based Routing (RLBR). The proposed RL-based SDWSN outperforms in terms of lifetime from 8% to 33% and packet delivery ratio (PDR) from 2% to 24%. It is envisioned that this work will help the engineers for achieving the desired WSN performance through efficient routing.

The integrated satellite-terrestrial network (ISN) is an emerging framework that complements the ground 5G network with global network access. The satellite layer consists of Low Earth Orbit (LEO) and Geosynchronous (GEO) satellites for long-distance and high-throughput data transmission with low latency. However, traditional ground routing strategies are not appropriate in ISN, considering the dynamic motion and different capabilities of satellites. Moreover, multi-type tasks need to be allocated with optimal inter-satellite transmission links (ISL) to ensure both the load balance of ISN and the quality of experience (QoE) of subscribers. In this paper, we combine the Software Defined Networking (SDN), AI technique, and fuzzy logic to optimize multi-task routing in ISN. The GEO satellites and the ground computing center (GCC) are set as the joint control plane. The load information of ISN at different times is collected by GEO controllers and made into a multi-D matrix. The GCC collects the historical traffic data from GEO controllers for convolutional neural network (CNN) model training and updating. The GEO satellites utilize the trained CNN model to make path allocation decisions and issue flow tables to LEO satellites. Further, considering the CNN judgment may contradict the user QoE, we use fuzzy logic to evaluate task requirements to improve the CNN output for optimal ISN path allocation. The simulation results demonstrate that the fuzzy-CNN based multi-task routing (FCMR) method has better traffic control performance and path finding flexibility under different ISN conditions.

For the future open 5G internet of vehicles (IoV), due to the flexibility and load sharing, the popular network architecture of IoV proposed by many studies is mobile edge computing (MEC) framework combining with software defined networking (SDN). However, under this architecture, moving vehicles and MEC devices are not like the cloud SDN with strong security protection. Thus, identity verification is an important security issue. We find that if the identity credentials of vehicles and infrastructures are obtained by adversaries (i.e., identity theft), the current cryptography-based authentication methods cannot cope with this problem. In this paper, we propose a behavior-based verification method, named Crowd-Learning, by utilizing the idea of crowd in software-defined vehicular networks with a mobile edge computing framework. In Crowd-Learning, we design an incentive mechanism to stimulate some MEC infrastructures to provide accurate and appropriate amount of data for future correct behavior estimation. Without knowing the model of the dynamic environment, this incentive mechanism needs to apply reinforcement learning to let MEC infrastructures learn how to send data based on the current state. Our Crowd-Learning method verifies vehicles and reduces the verification latency by estimating vehicles’ behavior in advance. Meanwhile, it verifies infrastructures during the process of reinforcement learning based on the idea of crowd intelligence. The fake infrastructures and anomalous vehicles expose themselves when learning. In experiments, we use the traffic simulation tool called simulation of urban mobility (SUMO) to generate extensive vehicle traces and evaluate the performance of Crowd-Learning verification method. The results show that Crowd-Learning verification method can ensure high verification accuracy for vehicles and infrastructures with satisfying low verification latency.

Emerging next-generation Internet yields proper administration of a wide-ranging dynamic network to assist rapid ubiquitous resource accessibility, whilst providing higher channel bandwidth. Since its inception, the traditional static network infrastructure-based solutions involve manual configuration and proprietary controls of networked devices. It then leads to improper utilization of the overall resources, and hence experiences various security threats. Although transport layer security (TLS)-based solution is presently advocated in the said framework, it is vulnerable to many security threats like man-in-the-middle, replay, spoofing, privileged-insider, impersonation, and denial-of-service attacks. Moreover, the current settings of the said tool do not facilitate any secure and reliable mechanisms for data forwarding, application flow routing, new configuration deployment, and network event management. Also, it suffers from the single point of controller failure issue. In this paper, we propose a new private blockchain-enabled fine-grained access control mechanism for the SDN environment. In this regard, attribute-based encryption (ABE) and certificate-based access control protocol are incorporated. This proposed solution can resist several well-known security threats, and alleviate different system-level inconveniences. The formal and informal security inspections and performance-wise comparative study of the proposed scheme endorse better qualifying scores as compared to the other existing competing state-of-art schemes. Besides, the experimental testbed implementation and blockchain simulation show the implementation feasibility of the proposed mechanism.

The convergence of Software-Defined Networking (SDN) and Internet of Vehicular (IoV) integrated with fog computing, known as software-defined vehicle network-based fog computing (SDV-F), has recently been established to take advantage of both paradigms and efficiently control the wireless networks. SDV-F tackles numerous problems, such as scalability, load-balancing, energy consumption, and security. It lags, however, in providing a promising approach to enable ultra-reliable and delay-sensitive applications with high vehicle mobility over SDV-F. We propose ARTNet, an AI-based Vehicle-to-Everything (V2X) framework for resource distribution and optimized communication using the SDV-F architecture. ARTNet offers ultra-reliable and low-latency communications, particularly in highly dynamic environments, which is still a challenge in IoV. ARTNet is composed of intelligent agents/controllers, to make decisions intelligently about i) maximizing resource utilization at the fog layer, and ii) minimizing the average end-to-end delay of time-critical IoV applications. Moreover, ARTNet is designed to assign a task to fog nodes based on their states. Our experimental results show that considering a dynamic IoV environment, ARTNet can efficiently distribute the fog layer tasks while minimizing the delay.

Software defined networking (SDN) with separated control plane and data plane brings new opportunities for traffic measurement in data center networks. However, in the SDNenabled switches, available TCAM (Ternary Content Addressable Memory) resources for traffic measurement are limited. Thus, it is necessary to utilize traffic matrix (TM) estimation to derive a hybrid network monitoring scheme through combining the partial direct measurement offered by SDN with some inference techniques. Although large size flows play an important role in improving TM estimation accuracy, directly monitoring each flow and finding out large size flows consume massive channel bandwidth resource between control plane and data plane. Therefore, in this paper, we identify large size flows from multiple historical TMs instead of monitoring each flow. First, we analyze multiple historical TMs and observe that origin-todestination (OD) pair whose flow size is selected as large size flow at last time slot is most likely to be selected for per-flow monitoring at next time slot, so these OD pairs are identified by gradient boosting machine and are directly regarded as sampled OD pairs in order to reduce resource consumption. Then, we propose a greedy heuristic algorithm to solve SDN-enabled switch selection problem to best utilize the TCAM resources and guarantee that most of sampled OD pairs are measured in the flow table. We also present a source node prefix tree based bit merging aggregation (SPTBMA) scheme to design feasible forwarding rules to be inserted in TCAM of SDN-enabled switches and reserve more TCAM space for sampled OD pairs. Finally, the experimental results based on real traffic dataset demonstrate that our proposed scheme outperforms the existing algorithms in terms of improving TM estimation accuracy and overcoming limitation of TCAM resources.

Software-defined network (SDN) allows traffic engineering and flow management by decoupling the control and data planes. SDN has attracted a lot of attention recently because of its centralized control, flow programmability and flexible resource management. However, to support centralized control, flow programmability and flexible resource management, most of the advanced SDN designs require per-flow management, which would easily make the flow table of a software switch overflow and incur undesired processing overhead when a network scales up. To overcome such huge traffic demands, we propose a cluster-based macro-flow management framework to balance the trade-off between customized services and management costs. The key idea of our design is to group similar flows into a cluster and replace per-flow management with per-cluster management. To achieve this goal, we cluster flows with consideration of the similarity of their traffic patterns. To adapt to varying traffic load, we further propose a hierarchical cluster merging scheme to dynamically merge clusters and make the best tradeoff between flow entry saving and routing performance guarantee. Our evaluation demonstrates that the proposed cluster-based flow management framework can significantly reduce the flow table usage, while producing minimum negative impact on routing performance.

In the traditional distributed control network, due to the difficulty in detection and the ambiguous defense responsibility, it is not efficient and effective to detect Distributed Denial of Service (DDoS) attacks in the network where they are launched, which is so-called source-based defense mechanism. Moreover, with the development of cloud computing, Internet of Things (IoT), and mobile Internet, the number of terminals and the communication bandwidth in a single autonomous domain have increased significantly, providing much more easy conditions for organizing large-scale botnets to launch a threatening DDoS attack. Therefore, there is an urgent need for source-based defense against DDoS attacks. The emerging Software-Defined Networking (SDN) provides some new ideas and advantages to solve this problem, such as centralized control and network programmability. In this paper, we proposed a defense method based on sFlow and improved Self-Organizing Map (SOM) model in SDN. This method consists of an sFlow-based macro-detection, which could cover the entire network to perceive DDoS attacks, a SOM-based micro-detection, which is used to recognize the attack traffic, and a response strategy based on the global view given by the controller. The experimental results under open data and simulated attack scenarios have proved the effectiveness of the proposed method, and it also has better overall detection performance than k-means and k-medoids.

Extensive redundant links and dedicated network components are deployed in existing networks to avoid network congestion caused by peak traffic. These network components are underutilized, leading to an extreme waste of electrical energy and negative environmental consequences. Most energy efficiency schemes have little consideration of the subsequent traffic load as well as the impact of energy saving on network performance, which brings many challenges, such as frequent flow rerouting, continual device state transition, and network load imbalance. In this article, we propose an energy efficiency optimization framework based on traffic prediction in software-defined networking, aiming at reducing network energy consumption while ensuring communication quality. First, we design a real-time traffic prediction mechanism based on gated recurrent unit neural network of deep learning to capture the temporal characteristics of network traffic and provide data basis for the deployment of energy-saving strategies. Second, we propose a heuristic algorithm for energy efficiency optimization to balance flow demand and energy consumption and to achieve dynamic load balancing and energy saving. Finally, simulation is carried out through Ryu controller, Mininet, and TensorFlow. Experimental results show that our algorithm achieves about 47.71% reduction in terms of the overall energy consumption with good network load balancing.

Within the current global context, the coronavirus pandemic has led to an unprecedented surge in the Internet traffic, with most of the traffic represented by video. The improved wired and guided network infrastructure along with the emerging 5G networks enables the provisioning of increased bandwidth support while the virtualization introduced by the integration of Software Defined Networks (SDN) enables traffic management and remote orchestration of networking devices. However, the popularity and variety of multimediarich applications along with the increased number of users has led to an ever increasing pressure that these multimedia-rich content applications are placing on the underlying networks.\ud \ud Consequently, a simple increase in the system capacity will not be enough and an intelligent traffic management solution is required to enable the Quality of Service (QoS) provisioning. In this context, this paper proposes a Reinforcement Learning (RL)-based framework within a multimedia-based SDN environment, that decides on the most suitable routing algorithm to be applied on the QoS-based traffic flows to improve QoS provisioning. The proposed RL-based solution was implemented and evaluated using an experimental setup under a realistic SDN environment and compared against other state-of-the-art solutions from the literature in terms of throughput, packet loss, latency, peak signal-to-noise ratio (PSNR) and mean opinion score (MOS). The proposed RL-based framework finds the best trade-off between QoS vs. Quality of User Experience (QoE) when compared to other state-of-the-art approaches.

Caching content close to the end users, e.g., at cellular base stations (BSs), WiFi access points (APs), and end user devices is known to improve efficiency and effectiveness of content delivery. This motivates the development of caching-as-a-service where edge networks and devices provide storage capacity to content providers, and enable them to strategically populate these caches to improve user experience in the targeted network. In this paper, we describe Wi-Cache, a prototype for providing caching-as-a-service at the WiFi edge. Wi-Cache is an SDN (Software Defined Networking) based distributed content caching system at the WiFi edge that uses storage at the APs for caching content. Wi-Cache caches content on wireless APs and delivers them to mobile clients when they are requested. It allows content providers to have fine-grained control over the AP-caches and also execute efficient content placement and delivery algorithms at the WiFi edge using a set of APIs that are provided by Wi-Cache. We also show the effectiveness of the Wi-Cache system using an extensive set of experiments.

The Software Defined Network in Internet of Things (SDN-IoT) is enjoying growing popularity due to its flexibility, automaticity and programmability. However, there still lack proper permission management on SDN-IoT applications (SIApps), especially when the SIApp’s required northbound interfaces are located in multiple heterogeneous controllers without mutual trust. Existing access control methods are usually based on centralized models, proprietary controllers, trusting conditions or manual operation. It can incur unnecessary performance degradation and poor scalability. To solve this problem, this paper proposes the SIApps’ ledger (SILedger), an open, trusted, and decentralized access control mechanism based on blockchain and attribute-based encryption (ABE). It can not only support effective authorization of SIApps in heterogeneous and untrusted SDN-IoT control domains, but also record all interactions between SIApps and resources, and thus facilitate SIApps’ further charging, analysis and audit. The main idea is that the SIApps are authorized using access tokens encrypted by ABE, and these tokens are seen as the currency of blockchain to be distributed. Specifically, we re-design blockchain transaction, token encryption, token initialization and token update schemes to achieve cross-domain, fine-grained and flexible SIApps’ permission management. In order to mitigate the delay and complexity problem of blockchain and ABE, we devise the access control framework that separates authorization from call process of SIApps. Finally, we perform security analysis and implement a FISCO-BCOS-based prototype for SILedger. The experimental results show that it can provide effective access control for SIApps with negligible overheads.

Due to that Service Function Chain (SFC) permits the forwarding of flows along a predetermined sequence chain of Virtual Network Functions (VNFs), it has become a common service in Network Function Virtualization (NFV)-enabled Software Defined Networks (SDNs). Generally, since there are multiple same VNF-instances in NFV-Enabled SDNs, this brings a great challenge for selecting or placing the required VNFinstances to satisfy the routing of SFC Request flows (SRs). In this paper, we study the routing problem for SRs by jointly considering dynamical VNF placement and multiple Resources and Quality of Service (QoS) constraints in NFV-Enabled SDNs. Specifically, we first define two optimization problems: one is the Dynamical VNF Placement and Routing Problem for SRs (DVPRP) and the other is the Delay, packet Loss and Jitter Aware Dynamical VNF Placement and Routing Problem for SRs (DLJADVPRP). We then formulate the two problems as Integer Linear Programming (ILP) problems. Next, we creatively devise an auxiliary edge-weight graph and propose two efficient algorithms to solve the problems with the aim of minimizing the resource consumption costs as well as ensuring multiple QoS constraints. Especially, we utilize the shortest path algorithm based on Lagrange relaxation method to solve the DLJA-DVPRP with multiple QoS constraints. Compared with existing algorithms, simulation results demonstrate our proposed algorithms have better performance in terms of throughput, traffic acceptance rate and load balance.

Designing survivable communication networks to achieve carrier-grade five-nines reliability is of paramount importance for the network operators. This article addresses service reliability and its related aspects such as nodal reachability, network connectivity, and edge-disjoint routing in both traditional networks and software defined networks (SDNs). The proposed roadmap is based on two phases: Fundamental analytical phase and performance evaluation phase. In the first phase, a graph operator is defined to analyze the characteristics of the reliability metric and its associated reachability feature. This phase will focus on both the macro- and micro-level properties of reliability. In the second phase, we exploit the analysis in the former phase to get an insight into the performance evaluation of traditional and SDN-based networks against the reliability metric, and then calculate the statistical significance of the mean difference of their reliability values. Reliability under edge-disjoint paths to avoid resource competition is also investigated. Various types of topologies are utilized to test the service reliability of both architecture designs. Extensive simulation results show that SDN-based networks have comparable performance to its legacy counterpart against the operational reliability metric. Our findings not only shed light on enhancing reliability using edge-disjoint paths under link failure scenarios but also expected to benefit the operators to achieve their service level objectives while migrating from legacy to SDN-based platform.

Since heavy flows account for a significant fraction of network traffic, being able to predict heavy flows has benefited many network management applications for mitigating link congestion, scheduling of network capacity, exposing network attacks and so on. Existing machine learning based predictors are largely implemented on the control plane of Software Defined Networking (SDN) paradigm. As a result, frequent communication between the control and data planes can cause unnecessary overhead and additional delay in decision making. In this paper, we present pHeavy, a machine learning based scheme for predicting heavy flows directly on the programmable data plane, thus eliminating network overhead and latency to SDN controller. Considering the scarce memory and limited computation capability in the programmable data plane, pHeavy includes a packet processing pipeline which deploys pre-trained decision tree models for in-network prediction. We have implemented pHeavy in both bmv2 software switch and P4 hardware switch (i.e., Barefoot Tofino).Evaluation results demonstrate that pHeavy has achieved 85% and 98% accuracy after receiving the first 5 and 20 packets of a flow respectively, while being able to reduce the size of decision tree by 5.4x on average. More importantly, pHeavy can predict heavy flows at line rate on the P4 hardware switch.

This paper proposes a master and slave controller assignment model against multiple controller failures in software defined networks considering latency between switches and controllers. The survivability guarantee of each switch is satisfied by assigning a set of controllers, where one of them works as the master controller to control the switch. Given assigned controllers, we introduce a policy-based approach to automatically specify the master controllers in each failure pattern, which leads to a lightweight configuration on a switch. We define the average-case expected latency, the worst-case expected latency, and the expected number of switches within a latency bound, as three objectives to be optimized in three different problems. We prove that a low latency first policy achieves the optimal objective for each considered problem. We formulate the proposed controller assignment model with different goals as three mixed integer linear programming problems. We prove the NP-completeness for all the three problems. A greedy algorithm with polynomial time complexity is developed; we show that it provides a 1/2-approximation for the case without the survivability guarantee constraint. The numerical results observe that the proposed model obtains the optimal objective value with the computation time about 102 times shorter than that of a baseline that introduces decision variables to determine the master controllers.

To meet the ever-increasing demands for high-quality network services, a software defined network (SDN) can support various virtual network functions (VNFs) using virtualization technology. Due to network dynamics, an SDN needs to be updated frequently to optimize various performance objectives, such as load balancing. Most previous solutions first determine a new network configuration (e.g., target VNF placement and flow routing) based on the current workload, and then update the VNF placement and routing paths of the existing flows. However, due to massive VNF's state migration and slow update of the flow table, unacceptable update delay may occur, especially in large or frequently changed networks. In this paper, we address the real-time network update, which jointly considers the optimization of the service function chain (SFC) update and the routing update. We propose the delay-satisfied NFV-enabled network update (DSNU) problem, and prove its NP-Hardness. We design an algorithm with bounded approximation factor to solve this problem. To further reduce the delay, we also design an efficient algorithm for the update scheduling. The experimental results show that our method can reduce the network update delay by about 86% compared with the previous network update methods while preserving a similar network performance, \ie, the VNF instance load ratio increases by less than 5%.

Packet classification is a critical component in network appliances. Software Defined Networking and cloud computing update the rulesets frequently for flexible policy configuration. Tuple Space Search (TSS), implemented in Open vSwitch (OVS), achieves fast rule updating at the sacrifice of the classification rate. In TSS, each tuple is managed by a hash table and classifying a packet needs to go through all hash tables. Merging tuples can reduce the number of hash tables, but inevitably increases the hash conflicts that may even worsen the classification performance in some cases. No existing algorithm meets the need of both fast packet classification and online rule updating. In this paper, we propose Convolutional Neural Network (CNN)-based Range Partition (CRP) to achieve fast packet classification and online update simultaneously. CRP exploits CNN-based image recognition to quickly partition tuples into range spaces upon the change of ruleset distribution, which reduces hash operations while avoiding rule overlapping caused by hashing many rules to the same location of the hash table. Experimental results demonstrate that CRP achieves 3.2x classification speed and 4.2x update speed on average compared with state-of-the-art algorithms. We also implement CRP in OVS. The throughput of CRP-OVS is 10x that of native OVS.

The application of Internet of Things (IoT) within industrial environments is fostering the adoption of the digital twin (DT) approach, applied at the edge of the network to handle heterogeneity stemming from siloed application management solutions and from protocols originated by different manufacturing tools and enterprise services. In this challenging context, network heterogeneity also represents a critical element that can significantly limit the design and deployment of DT-oriented applications. This article proposes the Application-driven digital twin networking middleware with the twofold objective of: 1) Simplifying the interaction among heterogeneous devices by allowing DTs to exploit IP-based protocols instead of specialized industrial ones and to enhance packet content expressiveness, by enriching data via well-defined standards. 2) Dynamically managing network resources in edge industrial environments, applying software defined networking to exploit the communication mechanisms most suitable to application requirements, ranging from native IP to more articulated based on packet content.

Efficient traffic control center (TCC) management requires roadside units (RSUs) to frequently update vehicles with traffic messages (TMs). RSUs are costly to road operators in terms of deployment and maintenance. Therefore, vehicular users expect the TCC to deliver high-quality and rapid responses to query requests on TMs through RSUs. This paper presents a novel RSU selection scheme based on a software-defined network (SDN) for traffic message transmission. In the proposed scheme, the RSU selection is determined by comparing the utility function calculated at the SDN controller. The SDN controller discovers the network connectivity topology through a cluster approach in which a cluster head (CH) is elected to report the network topology to the SDN controller. Furthermore, the SDN controller relies on the RSU selection manager to load existing RSU deployment techniques. In addition, a distance vector hop localization algorithm (DV-hop) is used to locate hidden RSUs to control signaling between the SDN controller and local controllers at RSUs. The proposed scheme achieves minimum latency and appropriate RSU management within a higher packet reception rate, which improves the selection of RSUs and traffic message delivery.

Aerial computing is a key enabling technique to provide seamless telecommunication and IT services for emerging computation-craving applications. As a drone employed in an aerial computing platform is limited in computation, caching, communication, and control capabilities, researchers have utilized multiple drones for efficient multi-modal multi-task processes, which also bring great challenges in massive data transmission and dynamic network management. Motivated by recent advancement of device-to-device communication and software defined networking technologies, we propose an air-ground integrated aerial computing framework where a cloudlet server and multiple mobile edge servers are mounted on drones to provide reliable and efficient edge computing services for ground devices. The joint implementation of computation offloading and trajectory design for the proposed framework is investigated. Extensive numerical results demonstrate that our aerial computing framework achieves better performance in terms of average task completion time than traditional ones.

The evolution of cyber–physical system (CPS) benefits from substantial supports of many cutting-edge technologies. However, as a significant medium to bridge virtual and reality parts, the dependability of various network components is facing unprecedented challenges and threats. In this article, we propose a smart collaborative balancing (SCB) scheme to dynamically adjust the orchestration of network functions and efficiently optimize the workflow patterns. First, mathematical models of bandwidth allocation for multiuser with appropriate probability distribution are established. Matrix operations are utilized to solve the relevant issues based on individual congestion windows. Invasion defense mechanisms are also provided and discussed. Second, specific procedures of collaboration among different network components are presented. The capabilities of CPS, in terms of bandwidth allocation and invasion defense, are guaranteed via novel queueing policies and access control mechanisms. Third, we build a comprehensive prototype including multiple domains and users for validations. Experimental results in two scenarios illustrate that SCB not only supports service reliability of end hosts with different priorities, but also resists malicious attacks which are targeting the corresponding terminals inside domains. Compared to the benchmarks in software defined networks and traditional Internet, our scheme performs better in both available resource management and abnormal flow recognition aspects.

Space-Air-Ground networks, as a successful solution for global communications, have drawn extensive attention. Since satellite as the space communications are influenced by geographical features, traffic congestion may occur in densely populated cities, leading to serious latency and throughput collapses. To solve this problem, we first introduce Software Defined Networks (SDN) into satellites and then propose a load balancing approach to improve communication performances. However, the SDN Space-Air-Ground networks need a cooperate communication process, we consider this problem as an SDNenabled routers placement problem, so that we can decide the exactly traditional routers are upgrading to ensure the robustness of hybrid networks. Based on the hybrid Space-Air-Ground networks, we design a load balancing strategy to distribute traffic among networks optimally, so that the total congested links are minimized in our proposed model. For better performance in Space-Air-Ground networks, we propose a resilient congestion estimate scheme. Detouring traffic around the nearby satellites so as to optimize traffic load, is decided based on the network condition. Simulation results illustrate that our proposed method outperforms traditional satellite network methods in the performance of load balancing.

Based on network function virtualization (NFV) and software defined network (SDN), network slicing is proposed as a new paradigm for building service-customized 5G network. In each network slice, service-required virtual network functions (VNFs) can be flexibly deployed in an on-demand manner, which will support a variety of 5G use cases. However, due to the real-time network variations and diverse performance requirements among different 5G scenarios, online adaptive VNF deployment and migration are needed to dynamically accommodate to service-specific requirements. In this paper, we first propose a time-slot based 5G network slice model, which jointly includes both edge cloud servers and core cloud servers. Since VNF consolidation may cause severe performance degradation, we adopt a demand-supply model to quantify the VNF interference. To achieve our objective—maximizing the total reward of accepted requests (i.e., the total throughput minus the weighted total VNF migration cost), we propose an Online Lazy-migration Adaptive Interference-aware Algorithm (OLAIA) for real-time VNF deployment and cost-efficient VNF migration in a 5G network slice, where an Adaptive Interference-aware Algorithm (AIA) is proposed as OLAIA’s core function for placing a given set of requests’ VNFs with maximized total throughput. Through trace-driven evaluations on two typical 5G network slices, we demonstrate that OLAIA can efficiently handle the real-time network variations and the VNF interference when deploying VNFs for real-time arriving requests. In particular, OLAIA improves the total reward by 22.18% in the autonomous driving scenario and by 51.10% in the 4K/8K HD video scenario, as compared with other state-of-the-art solutions.

Long distance communication links may severely affect the cyber-physical systems (CPSs) in 5G (and future 6G) networks and degrade its reliability and resilience by disrupting the quality index of network latency. Further, centralized network architectures have low fault tolerance and are prone to security threats. Virtualized software defined network (vSDN)-enabled 5G networks closely monitor these facts and redefine the existing network topology to find potential locations for deploying controller and hypervisor instances. In this article, we propose an approach of dynamically deploying controller-hypervisor (C-H) pair(s) to provide a variety of network functions like differentiation between control and data signals, various translation functions, etc., with ultra low latency (ULL). The system model deals with real network topology and four well-defined network latency matrices with a mixed integer linear programming model to optimize latency objectives. A reverse path-flow mechanism (RPFM) has been proposed to provide feasible solutions by keeping the network load, and controller capacity under a tolerance limit. We have further minimized the H-plane load by distributing the network resources based on the arrival time of SERVICE_IN requests from the users. Simulation results show that our proposed technique achieves significant reduction in latency and an evolved-ULL (e-ULL) experience, where all real-time user demands are handled efficiently. The proposed approach can also be used for similar critical localization problems like service chain mapping in 5G-NR, baseband unit deployment in 5G C-RAN and firewall deployment in distributed CPS.

Large software defined networks use a cluster of distributed controllers to process flow requests from a massive number of switches. To cope with traffic dynamics, this paper studies a new problem of how to improve the residual capacity available at the controllers to handle request bursts experienced at the switches. While the total residual capacity is a constant under a given total capacity of all controllers and a given total workload from all switches, this paper considers the residual capacity available to each individual switch, which depends on how the switches are mapped to the controllers for management. We focus on how to maximize the minimum residual capacity available to any switch . The prior work either provides poor residual capacity or incurs heavy synchronization overhead by simulation results. This paper proposes a new method called indirect multi-mapping that achieves both high residual capacity and low synchronization cost. We formally define a non-linear integer optimization problem for max-min residual capacity under indirect multi-mapping. We then approximate the problem as two sub-problems: switch-controller mapping selection and weight assignment for each switch-controller mapping. We solve these sub-problems and formally analyze their approximate factor. We implement the proposed solution on an SDN testbed for experimental studies and use simulations for large-scale investigation. Our evaluation shows that indirect multi-mapping improves the minimum residual capacity by 49.8% on average and reduces the synchronization cost by 41.9-60.3% on average when compared with the alternatives.

Quality of Transmission (QoT) metrics are used to predict and evaluate optical transmission performance, and have received much attention due to recent interest in real-time software defined networking (SDN) control and the challenges posed by open, disaggregated optical systems. In this letter, we address the QoT-estimation (QoT-E) issue, by focusing on real-time operations, where a dynamic control plane improves path performance estimation accuracy by interrogating optical performance monitoring (OPM) devices in the network. We also recognize the difficulty in testing such control plane procedures over large scale systems, which is a necessary step to validate control plane scalability before it is implemented in real systems. Accordingly, we have developed an optical network simulation system that incorporates physical transmission modeling into the Mininet packet-network emulator to enable the development and evaluation of optical control plane processes that depend on optical transmission performance. In this letter, we use this new tool, Mininet-Optical, to evaluate a SDN QoT-E procedure based on the deployment of emulated OPM nodes at periodic locations in an optical transmission system, which are interrogated by a SDN controller in real-time. Through this new capability, we observe behavior that manifests across a large scale system of 70 in line amplifiers and 15 ROADM nodes and are able show improvements in QoT accuracy up to 3 dB.

Software-defined networking (SDN) is the key technology to enable network softwarization by offering a programable and flexible network control capabilities. In order to dynamically manage and reconfigure the underlying network through SDN, network-based monitoring functionality needs to be in place. However, existing network monitoring schemes are normally heavyweight which can cause substantial monitoring overhead when dealing with entire network infrastructure and complex policies. Such a limitation can be critical in a software-based network system that enables the construction of multiple networks with various network policies designed by a network operator. In this article, we propose a new lightweight monitoring mechanism referred to as Active-port Aware Monitoring (APAM) in order to support the monitoring of complex networks with substantially reduced overhead. APAM typically monitors active ports which are the switch ports utilized by current flow rules. These active ports are dynamically monitored with reconfigurable monitoring intervals according to their port utilization. The measurement results show that APAM adapts varying traffic route due to a change of flow rules and also adjusts its monitoring performance according to network traffic dynamicity, which reduces the monitoring overhead and also improves monitoring accuracy.

Upgrading a legacy network to a Software Defined Network in stages, and minimizing the energy consumption of a network are now of great interest to operators. To this end, this paper addresses a novel problem: minimize the energy consumption of a network by upgrading switches over multiple stages subject to the available monetary budget at each stage. Our problem considers (i) bundled links that can be powered-off individually, (ii) decreasing upgrade cost and increasing traffic demands over multiple stages, and (iii) rerouting demands to an alternative path with a delay that is within a predefined limit. Additionally, the link load on the path is no larger than a given maximum utilization. We formulate the problem as an Integer Linear Program and propose a greedy heuristic called Green Multi-Stage Switch Upgrade (GMSU). Experiment results on five actual network topologies show that: 1) our approaches reduce the energy consumption by up to 73.98%; 2) rerouting traffic demand via longer paths improves the energy saving by up to 9.6%; 3) GMSU produces results that are at most 4.83% from the optimal result; and 4) increasing the budget and the number of stages affect the total energy saved and the number of upgraded switches.

Software Defined Networking (SDN) has emerged as a promising paradigm with the key idea of separating control and data planes. However, this separation causes various scalability issues (e.g., increased response time, overhead on the controller and core SDN switches) in Wide Area Networks (WANs). While addressing such scalability issues, it is important to maintain the performance gains of the Reactive SDN and also to handle link failures. To jointly address scalability, performance, and link failure issues, we propose a new Source-Path Routing Model (SPRM) by combining the best of proactive and reactive approaches along with a simple packet programming mechanism. Specifically, SPRM pre-calculates and pre-installs multiple paths (proactive part) but then selects/assigns one of these paths for an incoming flow based on the available dynamic network state information (NSI) (reactive part). We also utilize SPRM to effectively cope with the link failures by using multiple paths as backup to each other. Our simulation results show that SPRM performs much better than the pure Reactive SDN in terms of path establishment delay and flow table size while (a) maintaining its performance gains in terms of link utilization and load balancing, and (b) quickly recovering from a link failure without causing extra memory overhead on the data plane.

Recent advances separately in edge intelligence, service-centric networking, and software-defined networking have profoundly impacted future networks and intelligent applications. Nevertheless, they have not been jointly considered. Jointly considering these three remarkable techniques will open up a nascent research direction. In this article, we propose a software-defined service-centric networking (SDSCN) framework to push the frontier of edge intelligence toward general in-network intelligence. We devise a three-plane architecture, including a data plane, a management plane, and a control plane. Specifically, in-network context-aware computing and caching capabilities are incorporated into the service-centric data plane. Network programmability and global orchestration provide the potential to design plenty of useful network applications to customize network behaviors flexibly. How in-network federated learning works in SDSCN can be observed from case studies and is validated by emulation. More simulation results show the outperformance of SDSCN. Several challenges in developing the proposed framework are presented and discussed.

This special section features the latest research contributions regarding the design and management of reliable networks. Reliability of communication infrastructure is a top priority for network operators. To ensure reliable network operation, new design and management techniques for reliable communications must be constantly devised to respond to the rapid network and service evolution. As a recent and relevant example, deployments of 5G communication networks will soon enter their second phase, during which the network infrastructure will require upgrades to support new Ultra-Reliable Low-Latency Communication (URLLC) services with availabilities of up to 6 nines to be guaranteed jointly with extremely low latencies. Even in the still preliminary vision of 6G communication networks, reliability is posed as one of the most critical requirements, as 6G networks will represent the communication platform of our future hyper-connected society, supporting essential services as smart mobility, e-health, and immersive environments with application in remote education and working, just to name a few. Similarly, disaster resiliency in communication networks is now attracting the attention of media, government and industry as never before (consider, e.g., the worldwide network traffic deluge to support remote working during the current Coronavirus pandemic). Luckily, several new technical directions can be leveraged to provide new solutions for network reliability as: increased network reconfigurability enabled by Software Defined Networking (SDN); integration/convergence of multiple technologies (optical, wireless satellite, datacenter networks); enhanced forms of data/service replication, supported by, e.g., edge computing; network slicing, used to carve highly-reliable logical partitions of network, computing and storage resources. These, and many others, technological transformations can be leveraged to enable next-generation high-reliability networks.

© 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works Accurate delay estimation is one of the enablers of future network connectivity services, as it facilitates the application layer to anticipate network performance. If such connectivity services require isolation (slicing), such delay estimation should not be limited to a maximum value defined in the Service Level Agreement, but to a finer-grained description of the expected delay in the form of, e.g., a continuous function of the load. Obtaining accurate end-to-end (e2e) delay modeling is even more challenging in a multi-operator (Multi-AS) scenario, where the provisioning of e2e connectivity services is provided across heterogeneous multi-operator (Multi-AS or just domains) networks. In this work, we propose a collaborative environment, where each domain Software Defined Networking (SDN) controller models intra-domain delay components of inter-domain paths and share those models with a broker system providing the e2e connectivity services. The broker, in turn, models the delay of inter-domain links based on e2e monitoring and the received intra-domain models. Exhaustive simulation results show that composing e2e models as the summation of intra-domain network and inter-domain link delay models provides many benefits and increasing performance over the models obtained from e2e measurements. The research leading to these results has received funding from the AEI/FEDER TWINS project (TEC2017-90097-R), from the Catalan Institution for Research and Advanced Studies (ICREA), and from US-EU research collaboration initiative funded by the NSF award #ICE-T:RC 1836921.

The proliferation of smart devices has led to a huge amount of data streaming in the Internet of Things (IoT). However, the resource-limited devices cannot satisfy the demands of computing-in-tensive but delay-sensitive applications. The data delivery among devices may be tampered with by malicious users. These pose new challenges to provide secure and intelligent services in IoT. Blockchain and reinforcement learning (RL) are promising techniques for establishing a secure environment and intelligent resource management. In this article, we introduce a novel software defined networking (SDN)-enabled architecture for edge-cloud orchestrated computing to support secure and intelligent services in IoT. We first introduce the SDN-enabled architecture by integrating cloud computing, edge computing, and IoT networks. Then we provide several applications of SDN-enabled architecture in edge-cloud orchestrated computing. Next, we propose the blockchain and RL envisioned solutions to implement secure and intelligent services in IoT. Moreover, a case study of blockchain- and RL-enabled secure and intelligent computing offloading is presented to validate its effectiveness. We finally provide our conclusion and discuss several promising research directions.