Search

Software-Defined Networking (SDN) leverages the implementation of reliable, flexible and efficient network security mechanisms which make use of novel techniques such as artificial intelligence (AI) and machine learning (ML). In particular, these techniques - together with SDN - are the key enablers for the design of anomaly detection methods which are based on efficient traffic flow monitoring. In this paper, we tackle this problem by proposing an efficient anomaly detection framework, denoted as DeepGuard, which improves the detection performance of cyberattacks in SDN based networks by adopting a fine-grained traffic flow monitoring mechanism. Specifically, the proposed framework utilizes a deep reinforcement learning technique, i.e., Double Deep ${Q}$ -Network (DDQN), to learn traffic flow matching strategies maximizing the traffic flow granularity while proactively protecting the SDN data plane from being overloaded. Afterwards, by implementing the learned optimal traffic flow matching control policy, the most beneficial traffic information for anomaly detection is acquired at runtime—thereby improving the cyberattack detection performance. The performance of the proposed framework is validated by extensive experiments, and the results show that DeepGuard yields significant performance improvements compared to existing traffic flow matching mechanisms regarding the level of traffic flow granularity. In the case of distributed denial-of-service (DDoS) attacks, DeepGuard achieves a remarkable attack detection performance while effectively preventing forwarding performance degradation in the SDN data plane.

Due to the increase in video streaming traffic over the Internet, more innovative methods are in demand for improving both Quality of Experience (QoE) of users and Quality of Service (QoS) of providers. In recent years, HTTP Adaptive Streaming (HAS) has received significant attention from both industry and academia based on its impacts on the enhancement of media streaming services. However, HAS-alone cannot guarantee a seamless viewing experience, since this highly relies on the Network Operators’ infrastructure and evolving network conditions. Along with the development of future Internet infrastructure, Software-Defined Networking (SDN) has been researched and newly implemented as a promising solution in improving services of different Internet layers. In this paper, we present a novel architecture incorporating bitrate adaptation and dynamic route allocation. At the client side, adaptation logic of VBR videos streaming is built based on the MPEG-DASH standard. On the network side, an SDN controller is implemented with several routing strategies on top of the OpenFlow protocol. Our experimental results show that the proposed solution enhances at least 38% up to 185% in term of average bitrate in comparison with some existing solutions as well as achieves better viewing experience than the traditional Internet.

Recently, TCP SYN flood has been the most common and serious type of Distributed Denial of Service attack that causes outages of server resource of Internet Service Providers. In another aspect, Software Defined Networking (SDN) has emerged as a new networking paradigm to increase network agility and programmability. SDN is also a promising architecture to deal with the network security issue where we can flexibly change security rules and control incoming flows. In this article, we design an Openflow/SDN network remedy to combat specifically TCP SYN flood. We show security threats for the SDN architecture and exploit SDN capabilities and features to design a SDN-based SYN Proxy (SSP) paradigm to mitigate such TCP SYN threats. Our SSP is proved to be a network-based solution to protect application servers in terms of decreasing number of Half-Open Connections at an application server and increasing probability of successful establishment for a TCP flow connection under TCP SYN Flood attack. Using SSP to support application servers is shown to outperform the case where the servers adopt only the protection scheme of Microsoft Windows server reference model without utilizing SSP. SSP also shows that it can reduce the time a flow entry occupies the switch resource by 94% in comparison with the Avant-Guard solution. In addition, SSP improves the successful connection rate and average connection retrieval time in comparison with the standard Openflow solution.

We propose a novel server design implementing Fiber-to-the-Home (FTTH) Zero-Touch Multi-service Provisioning (ZTMP) technology, which is gaining significant attention from telephone companies (Telcos) specifically the Vietnam Post and Telecommunications Group because it can minimize human errors and labor costs. Vendor FTTH ZTMP solutions are often considered ossified and not suitable for implementation into Telco auto-provisioning workflows, which are complicated, Telco specific, and subject to change over time. The proposed ZTMP server design incorporates an open source platform approach based on a Central Office Re-architected as a Data Center (CORD). We deploy the proposed server in an Asia-Pacific CORD-based FTTH ZTMP test bed system. Evaluation results show that the system-control flow functions well in the test-bed.

Keeping Internet users protected from cyberattacks and other threats is one of the most prominent security challenges for network operators nowadays. Among other critical threats, distributed denial-of-service (DDoS) becomes one of the most widespread attacks in the Internet, which is very challenging to mitigate appropriately as DDoS attacks cause the system to stop working by resource exhaustion. Software-defined networking (SDN) has recently emerged as a new networking technology offering unprecedented programmability that allows network operators to configure and manage their infrastructures dynamically. The flexible processing and centralized management of the SDN controller allow flexibly deploying complex security algorithms and mitigation methods. In this paper, we propose a novel DDoS attack mitigation in SDN-based Internet Service Provider (ISP) networks for TCP-SYN and ICMP flood attacks utilizing machine learning approach, i.e., K-Nearest-Neighbor (KNN) and XGBoost. By deploying a testbed, we implement the proposed algorithms, evaluate their accuracy, and address the trade-off between the accuracy and mitigation efficiency. Through extensive experiments, the results show that the algorithms can efficiently mitigate the attack by over 98.0% while benign traffic is not affected.

Currently, little attention has been carried out to address the feasibility of in-network caching in Information-Centric Networking (ICN) for the design and real-world deployment of future networks. Towards this line, in this paper, we propose a beneficial caching scheme in ICN by storing no more than a specific number of replicas for each content. Particularly, to realize an optimal content distribution for deploying caches in ICN, a content can be cached either partially or as a full-object corresponding to its request arrival rate and data traffic. Also, we employ a utility-based replacement in each content node to keep the most recent and popular content items in the ICN interconnections. The evaluation results show that the proposal improves the cache hit rate and cache diversity considerably, and acts as a beneficial caching approach for network and service providers in ICN. Specifically, the proposed caching mechanism is easy to deploy, robust, and relevant for the content-based providers by enabling them to offer users high Quality of Service (QoS) and gain benefits at the same time.

Software Defined Networking (SDN) enables flexible and scalable network control and management. However, it also introduces new vulnerabilities that can be exploited by attackers. In particular, low-rate and slow or stealthy Denial-of-Service (DoS) attacks are recently attracting attention from researchers because of their detection challenges. In this paper, we propose a novel machine learning based defense framework named Q-MIND, to effectively detect and mitigate stealthy DoS attacks in SDN-based networks. We first analyze the adversary model of stealthy DoS attacks, the related vulnerabilities in SDN-based networks and the key characteristics of stealthy DoS attacks. Next, we describe and analyze an anomaly detection system that uses a Reinforcement Learning-based approach based on Q-Learning in order to maximize its detection performance. Finally, we outline the complete Q-MIND defense framework that incorporates the optimal policy derived from the Q-Learning agent to efficiently defeat stealthy DoS attacks in SDN-based networks. An extensive comparison of the Q-MIND framework and currently existing methods shows that significant improvements in attack detection and mitigation performance are obtained by Q-MIND., Comment: This paper has been accepted for publication in IEEE GLOBECOM conference 2019

Cloud computing has emerged in recent years as a promising paradigm that facilitates such new service models as Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS). As the number of cloud service provider increases, there exists a demand to dynamically provision virtual data centers (VDC) on top of the infrastructure provider’s physical data centers. This research addresses problems related to energy and resource efficiently embedding virtual data centers inside physical data centers under dynamic resource allocation conditions, in which VDCs continuously join and leave the system. Dynamic VDC embedding is challenging as it is an NP-hard problem that should meet multiple objectives. In this article, we propose heuristic joint VDC embedding – server consolidation approaches as one solution for that problem. Evaluation results show that the joint approach outperforms existing ones in terms of resource and energy efficiency and can keep system complexity acceptable.

Keeping Internet users safe from attacks and other threats is one of the biggest security challenges nowadays. Distributed Denial of Service (DDoS) [1] is one of the most common attacks. DDoS makes the system stop working by resource overload. Software Define Networking (SDN) [2] has recently emerged as a new networking technology offering an unprecedented programmability that allows network operators to dynamically configure and manage their infrastructures. The flexible processing and centralized management of SDN controller allow flexibly deploying complex security algorithms and mitigation methods. In this paper, we propose a new TCP-SYN flood attack mitigation in SDN networks using machine learning. By using a testbed, we implement the proposed algorithms, evaluate their accuracy and address the trade-off between the accuracy and capacity of the security device. The results show that the algorithms can mitigate TCP-SYN Flood attack over 96

In wireless sensor networks (WSNs), the process of collecting information from sensor nodes is one of the most important key applications. The data collection process in a WSN should meet several requirements, such as high reliability, low power consumption and so forth. In this paper, we introduce a low-power, high-reliability data collection scheme in WSNs using a state-of-the-art IEEE 802.14.4e MAC protocol, which is Time Slotted Channel Hopping (TSCH) in combination with the utilization of the feather nodes. Feather nodes are the nodes which have no child nodes. Our proposed method firstly detects all the feather nodes in the network, it then runs a lightweight scheduling mechanism on those nodes. By giving extensive practical experiments on the FIT IoT-LAB platform, we successfully develop a low-power-TSCH, high-reliability data collection scheme. Results in different testbed scenarios show that our scheme achieved good performance, compared to existing models using pure TSCH. That is, the end-to-end delivery ratio achieves 99.99% and the energy consumption of radio listening is 6 and 2 times lower than baseline and Orchestra schemes, respectively.

This nowadays, HTTP adaptive streaming (HAS) has been becoming the de-factor standard for video streaming over the multimedia network. However, HAS-alone cannot guarantee a seamless viewing experience, the adaptation of HAS in the management network faces a big challenge because of purely client-driven approaches which lead to unfair competition of available bandwidth resource when multiple bitrate-adaptive players share a same bottleneck network link. At that time, each HAS client tries independently to maximize its own bandwidth sharing, which leads to the competition of network resources among clients causing greatly reduced QoE (Quality of Experience) of end users. This competition will affect negatively several main metrics for each video player: fairness, efficiency, and stability. In this paper, we propose a scheme of bitrate adaptation for the HAS system combined with a Software Defined Networking (SDN)-based dynamic resource allocation, which aims to improve the quality of experience among competing clients. Our experiment results show that the proposed method significantly outperforms the conventional method on all the key QoE parameters under several scenarios.

Routing and load balancing are two important factors that guarantee Quality of Service (QoS) in the Internet. Meanwhile Software Defined Networking (SDN) has introduced a new networking paradigm that make routing and load balancing policies implemented more quickly and flexibly in the system. In the SDN architecture, the “intelligence” of the network is centralized in the application layer and control layer instead of distributing in the network device in traditional network. Current studies using SDN-based routing and load balancing still stop at the scope of finding appropriate network resource for one single data flow but not considering network resource for all flows coming from different sources as the whole. In this paper, we propose a global load-balanced routing scheme, which can take advantages of global view of the SDN controller to make a global policy for routing and load balancing. The solution has been shown to outperform traditional algorithms and recent SDN-based artificial intelligence algorithms in terms of delay and network utilization.

Summary The next generation broadband wireless networks deploy orthogonal frequency division multiple access (OFDMA) as the enabling technologies for broadband data transmission with QoS capabilities. In such broadband wireless systems, one major issue is how to utilize radio resource efficiently while maintaining fairness between sessions as well as providing adequate QoS. In this work, we propose an approach for OFDMA/time division duplex (TDD) downlink suitable for IEEE802.16e WiMAX systems that combines scheduling and burst mapping algorithms for a trade-off between session fairness, QoS, and spectral efficiency. While optimizing radio resources under QoS and fairness constraints is an NP-hard problem, we follow a heuristic approach that simplifies the complexity of the algorithm. Performance results show that while the new scheme outperforms the Proportional Fair algorithm in terms of fairness, it also improves the overall system spectral efficiency. Copyright © 2016 John Wiley & Sons, Ltd.

Several routing mechanisms for the Internet of Things (IoT) applications has been proposed by research community. RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks), an IP-based distributed routing paradigm is considered as one standard developed by IETF. More recently, SDN-WISE protocol with centralized routing solution based on Software Defined Networking (SDN), is introduced. SDN-WISE is a stateful Wireless Sensor Networks (WSNs) paradigm that minimize the complexity of WSNs by reducing the number of messages exchanged. In SDN-WISE, routing polices are defined by a controller which is a software that can be anywhere in the network. In this paper, we develop a new mechanism for SDN-WISE, called Trickle timer, in order to optimize the network performance. Trickle timer allows sensor nodes in a wireless network to exchange few packets per hour when network’s state remains stable. Results show that SDN-WISE protocol with Trickle timer consumes very few energy, compared to the original SDN-WISE protocol, and has better performance in term of radio duty cycle, compared to RPL.

Distributed Denial of Service (DDoS) attack is one of the most long-lasting problems in network security. Recently, although the DDoS attack mechanisms are widely understood, the problems are becoming more frequent due to the similarity between DDoS attack and normal traffic. In this work, we propose two approaches of DDoS attack detection which are based on the Self-Organizing Map (SOM). The proposed algorithms with their detection architecture are implemented in the Software-Defined Networking (SDN) technology which has the flexibility and programmable abilities. The SDN controller allows us to quickly perform complex classification and detection algorithm. By deploying a testbed environment, we successfully evaluate our proposed algorithms in terms of both accuracy and computational overhead. The experimental results show that these algorithms can reduce the processing time while maintain the suitable accuracy rate.

Nowadays, Distributed Denial of Service (DDoS) attacks get the most attention since volumetric attacks saturate company's networks and associated server infrastructure. In fact, DDoS can occur weekly or daily in a network but many organizations have no systems in place to monitor DDoS traffic so as to be aware if their networks are being attacked. Within that context, we propose to develop an architecture that enables a network a capacity of monitoring traffic on the fly and flexibly applying various detection and mitigation methods in order to reduce DDoS impact on the system shortly after it has happened. We also propose a SDN One-packet DDoS Mitigation (SODM) scheme with an Openflow switch functioning as a gateway to protect the inner server infrastructure. We also analyze Internet traffic to understand its common nature during attack and normal time. Knowledge of the traffic characteristics and the way to derive attack indicators are a critical input for the detection mechanism to work. The defense solution performance is evaluated to be able to cope with DDoS in small real time-scale with an acceptable false positive rate of ~ 6%.

Cloud computing has emerged in the recent years as a promising paradigm that facilitates such new service models as Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS). As the number of cloud service provider increases, there exists a demand to dynamically provision virtual data centers (VDC) on top of the infrastructure provider's physical data centers. This research addresses problems related to embedding virtual data centers inside physical data centers. VDC embedding is challenging as it is an NP-hard problem that should meet multiple objectives. In the paper, we propose a new heuristic VDC embedding algorithm that takes into account energy consumption as well as physical resources of data centers. We also realize this virtualization paradigm based on a Software-Defined Network architecture.

In this paper, we propose an optimized protection mechanism (OpenFlowSIA) for Software-Defined Networks from flooding attacks (Distributed Denial-of-Service) based on Support Vector Machine and our proposed algorithm called the Idle-timeout Adjustment (IA). Our methodology not only utilizes SVM advantages in classification such as high accuracy and little processing time, but also applies effectively the IA algorithm and coherent policies to protect network from resource exhaustion caused by flooding attacks, particularly for the SDN controller and OpenFlow switches. Through comprehensive experiments, the OpenFlowSIA scheme illustrates that it can be an innovative solution to secure and save the network resources under flooding attacks in the Software-Defined Networks.

One considerable challenge in future heterogeneous wireless networks (HetNet) is vertical handover. Current vertical handover approaches almost focus on resolving two questions: (1) when a Mobile Station (MS) needs to carry out a vertical handover (VHO) procedure; and (2) how a proper handover decision can be made in a HetNet environment. Actually, some approaches do not guarantee that MS can avoid handover flapping due to continuous changes in AP/BTS association. In addition, after MS joins in a new environment, many solutions do not care if VHO candidates meet requirements on QoS, such as fairness and throughput due to channel dynamicity. In this paper, we propose two algorithms: the VHO decision-making algorithm and proportional fair over HetNets (PFoHN) algorithm. VHO decision-making algorithm determines the network selection based on the availability of the target network. After VHO process is finished, resource allocation is performed by the PFoHN algorithm. In our study, the proposed approaches are developed with the support of Software-Defined Wireless Network technologies. Performance results show that PFoHN outperforms the Proportional Fair (PF) in terms of bandwidth and resource fairness, it also remarkably improves the overall system spectral efficiency.

RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks) is a standard routing protocol for low-power low-cost and resource constrained networks. To deal with the diversity in link qualities in these networks, the Minimum Rank with Hysteresis Objective Function (MRHOF, RFC 6719) is standardized as the de facto Objective Function (OF) for RPL. MRHOF helps a mote to select a path to forward traffic with the minimum cost among available paths. The Expected Transmission Count (ETX) defined in RFC 6551 is the most widely used MRHOF routing metric. ETX helps to achieve good Packet Delivery Ratio (PDR) and low latency since motes choose to relay their information along the path with the least number of retransmissions. However, since ETX does not consider the energy level of the motes, it does not balance the energy consumption between motes. In this paper, we develop other routing metrics by taking into consideration the energy consumption of motes as routing metric. We develop a Radio Duty Cycle (RDC) based method to estimate mote energy consumption. We also look into diverse combinations of ETX and energy consumption as routing metrics. The proposed methods achieve better energy balance while keeping good energy efficiency and packet delivery ratios.