Search

The paper discusses the modeling of various aspects of the security of critical information infrastructures (CII) in the assumption of creating a reference model of CII security in the future. The features of CII in terms of goals and safety criteria based on the analysis of various regulatory and methodically established definitions and descriptions of CII are established. The contradictions arising in the attempts to use the traditional methodology of information security in relation to CII are shown. The problems of using the methods and models of classical risk analysis are discussed, in particular, the impossibility of applying the concept of residual risk to the formation of CII safety objectives. The conclusion is made about the expediency of basing these goals on the exhaustion of possible protective measures (controls and activities), the concept of asymptotic safety management of CII , which guarantees the trend of security growth without its current assessment. Changes in the role and place of the threat model in ensuring the security of CII related to the lack of evidence of the completeness of this model are considered. The attractiveness of using the SDL technique for forming elements of the threat model in the conditions of a specific CII is indicated. The structure of the future reference model of safety of the CII including definition of the purposes and criteria of safety (including functional), multilevel static model of functioning of the CII (including security factors), a dynamic model of the spread of security incidents within the CII, the typology of the result of aggressive manifestations of the CII functioning environment (threat model) and the model (methodology) of the spread of protective activities within the information infrastructure.

O crescimento no volume e na diversidade dos dados causado pelo fenômeno Big Data tem revolucionado os negócios e a ciência, ao mesmo tempo que requer capacidade cada vez maior dos recursos computacionais. As plataformas de computação de alto desempenho (HPC), tradicionalmente empregadas em simulações numéricas massivamente paralelas, oferecem capacidade computacional que pode ser aproveitada na análise de Big Data. No entanto, a confluência de Big Data e HPC, embora pareça ser natural, deve ser examinada sob diversos aspectos, o que envolve a adequação de vários de seus elementos. Em particular, a infraestrutura de rede precisa ser eficiente e flexível para ajustar-se às demandas bem distintas das aplicações típicas desses ambientes de computação paralela e distribuída. O paradigma de rede definida por software (SDN) pode favorecer essa integração, graças à sua visão global e seu maior nível de programabilidade, que simplificam a gerência da rede e a tornam mais adaptável e efetiva. Nesse contexto, este trabalho apresenta uma plataforma SDN capaz de suprir os requisitos de desempenho de rede de aplicações Big Data e HPC. A plataforma busca otimizar a comunicação dos dados, identificando o tráfego de rede por meio de uma API e aplicando dinamicamente mecanismos de roteamento mais adequados a cada perfil de tráfego. Essa abordagem evidencia um modelo de rede ciente da aplicação que permite a diminuição no tempo de execução de aplicações. Avaliações mediante simulações em cenários específicos demonstram a viabilidade e a aplicabilidade da plataforma, ao reduzir o tempo médio de execução de aplicações reais MPI em cerca de 11%, e Hadoop em torno de 6%. The growth in the volume and diversity of data caused by the Big Data phenomenon has revolutionized business and science, at the same time as it demands ever-increasing computational resources. High-performance computing (HPC) platforms tailored to massively parallel numerical simulations offer computational capacity that can be leveraged by Big Data Analytics solutions. Nevertheless, the confluence of Big Data and HPC, although it appears to be natural, should be examined in several aspects, which involves the suitability of several of its elements. In particular, the network infrastructure needs to be efficient and flexible to fit the very distinct demands of typical applications of such parallel and distributed computing environments. The software-defined network paradigm (SDN) may favor this integration, thanks to its global view and its higher level of programmability, which simplify network management and make it more adaptive and effective. In this context, this work presents an SDN platform capable of supplying the network performance requirements of Big Data and HPC applications. The platform seeks to optimize data communication by identifying network traffic through an API and dynamically applying the most appropriate routing mechanisms to each traffic profile. This approach evidences an application-aware network model that allows the decrease in the execution time of applications. Evaluations through simulations in specific scenarios demonstrate the feasibility and applicability of the platform, by reducing the average execution time of MPI applications by about 11%, and of Hadoop applications by around 6%.

Recently, with the increase in network bandwidth, various cloud computing applications have become popular. A large number of network data packets will be generated in such a network. However, most existing network architectures cannot effectively handle big data, thereby necessitating an efficient mechanism to reduce task completion time when large amounts of data are processed in data center networks. Unfortunately, achieving the minimum task completion time in the Hadoop system is an NP-complete problem. Although many studies have proposed schemes for improving network performance, they have shortcomings that degrade their performance. For this reason, in this study, we propose a centralized solution, called the bandwidth-aware rescheduling (BARE) mechanism for software-defined network (SDN)-based data center networks. BARE improves network performance by employing a prefetching mechanism and a centralized network monitor to collect global information, sorting out the locality data process, splitting tasks, and executing a rescheduling mechanism with a scheduler to reduce task completion time. Finally, we used simulations to demonstrate our scheme’s effectiveness. Simulation results show that our scheme outperforms other existing schemes in terms of task completion time and the ratio of data locality.

Software-defined networks have become more common in data centers. The programmability of these networks is a great feature that allows innovation to be deployed fast, following the increasing number of new applications. This growth comes with a cost of more processing power and energy consumption. Many researchers have tackled this issue using existing routing techniques to dynamically adjust the network forwarding plane to save energy. On the control-plane, researchers have found algorithms for positioning the controller in a way to reduce the number of used links, thus reducing energy. These strategies reduce energy consumption at the expense of processing power of the controllers. This paper proposes a novel approach to energy efficiency focused on the network’s control-plane, which is complementary to the many already existing data-plane solutions. It takes advantage of the parallel processing capabilities of modern off-the-shelf multicore processors to split the many tasks of the controller among the cores. By dividing the tasks among homogeneous cores, one can lower the frequency of operations, lowering the overall energy consumption while keeping the same quality of service level. We show that a multicore controller can use an off-the-shelf multicore processor to save energy while keeping the level of service. We performed experiments based on standard network measures, namely latency and throughput, and standard energy efficiency metrics for data centers such as the Communication Network Energy Efficiency (CNEE) metric. Higher energy efficiency is achieved by a parallel implementation of the controller and lowering each core’s frequency of operation. In our experiments, we achieved a drop of 28% on processor energy use for a constant throughput scenario when comparing with the single-core approach.

Considering the Internet of Things (IoT) impact in today’s world, uninterrupted service is essential, and recovery has received more attention than ever before. Fault-tolerance (FT) is an essential aspect of network resilience. Fault-tolerance mechanisms are required to ensure high availability and high reliability in systems. The advent of software-defined networking (SDN) in the IoT plays a significant role in providing a reliable communication platform. This paper proposes a data plane fault-tolerant architecture using the concepts of software-defined networks for IoT environments. In this work, a mathematical model called Shared Risk Link Group (SRLG) calculates redundant paths as the primary and backup non-overlapping paths between network equipment. In addition to the fault tolerance, service quality was considered in the proposed schemes. Putting the percentage of link bandwidth usage and the rate of link delay in calculating link costs makes it possible to calculate two completely non-overlapping paths with the best condition. We compare our two proposed dynamic schemes with the hybrid disjoint paths (Hybrid_DP) method and our previous work. IoT developments, wireless and wired equipment are now used in many industrial and commercial applications, so the proposed hybrid dynamic method supports both wired and wireless devices; furthermore multiple link failures will be supported in the two proposed dynamic schemes. Simulation results indicate that, while reducing the error recovery time, the two proposed dynamic designs lead to improved service quality parameters such as packet loss and delay compared to the Hybrid_DP method. The results show that in case of a link failure in the network, the proposed hybrid dynamic scheme’s recovery time is approximately 12 ms. Furthermore, in the proposed hybrid dynamic scheme, on average, the recovery time, the packet loss, and the delay improved by 22.39%, 8.2%, 5.66%, compared to the Hybrid_DP method, respectively.

The Industrial Internet of Things (IIoT) network generates great economic benefits in processes, system installation, maintenance, reliability, scalability, and interoperability. Wireless sensor networks (WSNs) allow the IIoT network to collect, process, and share data of different parameters among Industrial IoT sense Node (IISN). ESP8266 are IISNs connected to the Internet by means of a hub to share their information. In this article, a light-diffusion algorithm in WSN to connect all the IISNs is designed, based on the Peano fractal and swarm intelligence, i.e., without using a hub, simply sharing parameters with two adjacent IINSs, assuming that any IISN knows the parameters of the rest of these devices, even if they are not adjacent. We simulated the performance of our algorithm and compared it with other state-of-the-art protocols, finding that our proposal generates a longer lifetime of the IIoT network when few IISNs were connected. Thus, there is a saving-energy of approximately 5% but with 64 nodes there is a saving of more than 20%, because the IIoT network can grow in a 3 n way and the proposed topology does not impact in a linear way but log 3 , which balances energy consumption throughout the IIoT network.

The emerging 5G applications and the connectivity of billions of devices have driven the investigation of multi-domain heterogeneous converged optical networks. To support emerging applications with their diverse quality of service requirements, network slicing has been proposed as a promising technology. Network virtualization is an enabler for network slicing, where the physical network can be partitioned into different configurable slices in the multi-domain heterogeneous converged optical networks. An efficient resource allocation mechanism for multiple virtual networks in network virtualization is one of the main challenges referred as virtual network embedding (VNE). This paper is a survey on the state-of-the-art works for the VNE problem towards multi-domain heterogeneous converged optical networks, providing the discussion on future research issues and challenges. In this paper, we describe VNE in multi-domain heterogeneous converged optical networks with enabling network orchestration technologies and analyze the literature about VNE algorithms with various network considerations for each network domain. The basic VNE problem with various motivations and performance metrics for general scenarios is discussed. A VNE algorithm taxonomy is presented and discussed by classifying the major VNE algorithms into three categories according to existing literature. We analyze and compare the attributes of algorithms such as node and link embedding methods, objectives, and network architecture, which can give a selection or baseline for future work of VNE. Finally, we explore some broader perspectives in future research issues and challenges on 5G scenario, field trail deployment, and machine learning-based algorithms.

[EN] In order to use the energy more efficiently, network algorithms and protocols must incorporate in their decision mechanisms some functions focused on saving energy. In this paper we have studied different features and parameters of wireless networks to establish their relationship with the power consumption. First, we have analyzed the variation of power consumption of access points (APs) in function of the antenna transmission power. Second, we have collected user information from real public wireless network to determine the real requirements of network resources in real time basis. Based on this information, a new extension for Openflow protocol over Software-Defined Networking (SDN) networks will be proposed to manage the wireless network, with the aim to keep the optimal network performance with minimal power consumption. This extension introduces new Openflow messages and a new function to be incorporated in SDN controllers and Openflow enabled devices. The proposal will be validated by appropriated simulations based on real scenarios: a shopping center and a municipal wireless network., This work has been supported by the Ministerio de Economía y Competitividad , through the Convocatoria 2014. Proyectos I + D - Programa Estatal de Investigación Científica y Técnica de Excelencia in the Subprograma Estatal de Generación de Conocimiento , Project TIN2014-57991-C3-1-P and the Programa para la Formación de Personal Investigador (FPI-2015-S2-884) by the Universitat Politècnica de València .

Tez No: 612090 Yüksek Lisans Farklı uygulamalardaki verilerin günümüzde gittikçe artan önemi ile birlikte, çevreden söz konusu verileri toplayabilmek adına Kablosuz Sensör Ağları (Wireless Sensor Networks/WSN) yaygın bir biçimde kullanılmaktadır. Bu ağların görevlerini yerine getirebilmek için ihtiyaç duymuş oldukları esnekliği sağlamak adına, küçük boyutlarda ve bu sayede yüksek hareketliliğe sahip sensörler kullanılır. Ancak, bahsedilen sensörlerin küçük boyutlu olması, güç ve enerji kaynaklarının işlenmesi gibi, devrelerin donatılabilecek oldukları kaynak sayısını sınırlandırmaktadır. Ayrıca, internet erişiminin kolaylaşması ile birlikte, söz konusu ağlar, Nesnelerin İnternetini (Internet of Things) oluşturan bir merkez birimde toplamış oldukları verileri gönderebilmek için internete bağlanmaktadır. Kablosuz Sensör Ağlarının (WSN) değişmekte olan devre topolojilerine adapte olabilmesi adına, devreler, bir sunucudan diğer sunucuya, kendilerinden gönderilen paketlere ek paket göndermeye yönlendirilirler. Dolayısıyla, kendi görevini yerine getirebilmek ve paketlerini iletebilmek adına ihtiyaç duyduğu kaynaklara ek olarak, devreden ihtiyaç duyulan kaynaklar, iletilmesi gereken paketlerin sayısına bağlıdır. Böylelikle, devrelerdeki kaynak tüketiminin optimizasyonu, paketlerin hedeflerine ulaşabilmek için kullandıkları yolların optimizasyonunu gerektirmektedir. Modern ağların değişmekte olan topolojisine göre, sabit ağ veri yönlendirme kuralları artık kullanılmamaktadır. Söz konusu kısıtlandırmanın aşılması adına, merkezi bir denetçinin paket verilerinin yönlendirilmesinde karar veren role sahip olduğu Yazılım Tanımlı Ağlar (SDN) kullanılır. Söz konusu denetleyici, bir paketin hedefine ulaşmak için takip etmesi gereken yolu belirlemek adına, paketin bilgilerine ek olarak, ağ hakkında da veri toplar. Fakat, WSN'nin topolojisinde gelişen karmaşıklık ve etkili yönlendirmenin önemi ile birlikte, SDN'nin denetçisinde karar verme sürecini kontrol etmek adına ML (Makine Öğrenimi) teknikleri kullanılmaktadır. Bu çalışmada, SDN kullanmakta olan WSN içerisindeki kaynak tüketiminin optimizasyonunu sağlamak adına yeni bir yöntem sunulmaktadır. Sunulan yöntem, WSN'nin ömrü bazında, RL (Takviyeli Öğrenme) kullanımı ile eğitilen bir nöral ağdan yararlanmaktadır. WSN'nin ömrünü uzatabilmek için, nöral ağın en ideal rotaların kullanılması gereken ağlardaki devrelerin güç tüketimini optimize etmesi gerekmektedir. Bu tez çalışmasında üç tür nöral ağ değerlendirilmketedir; İleri Beslemeli Nöral Ağ (Feed-Forward Neural Network – FF-NN), 2 Boyutlu Evrişimsel Nöral Ağ (2D- Convolutional Neural Network – 2D-CNN) ve 3D-CNN. Bu modellerin değerlendirmesi; gelişen en son teknoloji ile var olan 578122.2 Saniye ömür süresini %17 değerinde uzatarak, 678251.6 Saniye ortalama ömür süresi ile 3D-CNN'nin en iyi performansı elde ettiğini ortaya koymaktadır. Bu model dahilinde, bir paketin hedefine ulaşabilmesi için gerekli ortalama sıçrama değeri, ortalama %85.07'lik Paket Aktarım Oranı (Packet Delivery Rate - PDR) ile 9.81 sıçramadır. Ayrıca, 2D CNN modeli, paket başına ortalama 12.37 sıçrama ve %82.47'lik PDR ile 638169.2 Saniye ömür süresi elde etmiş, FF-NN modeli ise paket başına 8.31 sıçrama ve %83.37 PDR ile 578381.6 Saniye ömür süresine ulaşmıştır. Sonuçlar, 3D-CNN modelinin üstünlüğüne ek olarak, en kısa yolların kullanımının, yoğun trafiği kontrol altında tutan bölgelerde konumlandırılmış olan bazı devrelerin kaynaklarında tükenme meydana getirdiğini ve WSN'nin toplam ömrünü kısalttığını da göstermiştir. Yani, ömrün uzatılması, söz konusu tükenmeden kaçınabilmek adına alternatif, yani daha uzun, rotaları tercih etmeyi gerektirmektedir. According to the changing topologies of modern networks, the use of static routing rules has become obsolete. Software-Defined Networks (SDNs) are being used to overcome such limitation, where a central controller handles the decision-making role regarding packets routing. This controller collects information about the network, in addition to the packet information, to decide the route a packet should follow to reach its destination. However, with the growing complexity of WSNs topologies and the importance of efficient routing, Machine Learning (ML) techniques are being used to handle the decision making in the SDN controller. In this study, a new method is proposed to optimize the resources consumption in a WSN that uses SDN. The proposed method employs a neural network that is trained using Reinforcement Learning (RL), based on the lifetime of the WSN. To extend the lifetime of WSN the neural network is required to optimize the power consumption of the nodes in that network, in which the optimal routes must be used. Three types of neural networks are evaluated in this thesis; Feed-Forward Neural Network (FF-NN), 2D-Convolutional Neural Network (2D-CNN) and 3D-CNN. The evaluation of these models show that the using the 3D-CNN has achieved the best performance, with an average lifetime of 678251.6 seconds, with an extension of 17% of the 578122.2 seconds using the existing state-of-the-art method. The average number of hops a packet is required to travel through, to reach its destination, in this model is 9.81 hops with an average Packet Delivery Rate (PDR) of 85.07%. Additionally, the 2D-CNN model has achieved 638169.2 seconds lifetime, with an average of 12.37 hops per packet and 82.47% PDR, whereas the FF-NN has achieved 578381.6 seconds lifetime with 83.37% PDR and 8.31 hops per packet. In addition to the superiority of the 3D-CNN, the results also show that the use of the shortest paths causes an exhaustion to the resources of certain nodes, positioned in locations that handle extensive traffic, which reduces the overall lifetime of the WSN. Thus, the extension of the lifetime requires using alternative, i.e. longer, paths to avoid such exhaustion and extend the lifetime of the network.

[EN] Mobility management applied to the traditional architecture of the Internet has become a great challenge because of the exponential growth in the number of devices that can connect to the network. This article proposes a Software-Defined Networking (SDN)-based architecture, called SDN-DMM (SDN-Distributed Mobility Management), that deals with the distributed mode of mobility management in heterogeneous access networks in a simplified and efficient way, ensuring mainly the continuity of IP sessions. Intent-based mobility management with an IP mapping schema for mobile node identification offers optimized routing without tunneling techniques, hence, an efficient use of the network infrastructure. The simplified mobility control API reduces both signaling and handover latency costs and provides a better scalability and performance in comparison with traditional and SDN-based DMM approaches. An analytical evaluation of such costs demonstrated the better performance of SDN-DMM, and a proof of concept of the proposal was implemented in a real environment., CAPES (Coordenacao de Aperfeicoamento de Pessoal de Nivel Superior) - Brasil; Secretaria de Estado de Investigacion, Desarrollo e Innovacion, Grant/Award Number: TIN2017-84802-C2-1-P; "Convocatoria 2017 - Proyectos I+D+I Programa Estatal de Investigacion, Desarrollo e Innovacion, convocatoria excelencia", Grant/Award Number: TIN2017-84802-C2-1-P; FAP-DF ("Fundacao de Apoio a Pesquisa do Distrito Federal")-Brazil

Software-defined networks (SDNs) are improving the controllability and flexibility of networks as an innovative network architecture paradigm. Segment routing (SR) exploits an end-to-end logical path and is composed of a sequence of segments as an effective routing strategy. Each segment is represented by a middle point. The combination of SR and SDN can meet the differentiated business needs of users and can quickly deploy applications. In this paper, we propose two routing algorithms based on SR in SDN. The algorithms aim to save the cost of the path, alleviate the congestion of networks, and formulate the selection strategy by comprehensively evaluating the value of paths. The simulation results show that compared with existing algorithms, the two proposed algorithms can effectively reduce the consumption of paths and better balance the load of the network. Furthermore, the proposed algorithms take into account the preferences of users, actualize differentiated business networks, and achieve a larger comprehensive evaluation value of the path compared with other algorithms.

Актуальність теми. З розвитком комп’ютерних технологій зростають потреби користувача у масштабованості та гнучкості його комп’ютерної мережі. Технологія віртуалізації мережевих функцій допомагає зробити мережу більш еластичною, простою в керуванні за рахунок перенесення інтерфейсу керування пристроїв на один спільний, централізований інтерфейс, менш затратною, оскільки додавання нового програмного модуля в мережу виконується набагато легше і швидше ніж додавання апаратної складової. В зв’язку з таким розвитком віртуалізації мережевих функцій актуальною темою постає захист віртуалізованої мережі, всіх її елементів та даних. Об’єкт дослідження – системи захисту мережі з технологіями SDN (Програмно-конфігуровані мережі) та NFV (Віртуалізація мережевих функцій). Предмет дослідження – дослідження ефективності захисту елементів мережі, периметра мережі загалом, а також даних, що транспортуються в цій мережі. проведення аналізу сигнатур розповсюджених атак, моделювання тестової мережі, створення імітаційних атак на мережу та порівняльний аналіз захищеності системи. Мета роботи: є детальний огляд програмно-конфігуровних мереж з використанням в них NFV технології, аналіз вразливих місць таких мереж, аналіз ефективності різних елементів захисту, а також розглянуто актуальність використання автоматичного набору імітаційних атак для кожної віртуальної функції задля забезпечення швидкого виявлення та усунення помилок програмного забезпечення. Для досягнення мети визначено наступні задачі, які вирішуються в роботі: 1. Провести систематизацію та аналіз видів вразливостей віртуалізованої мережі. 2. Розглянути основні методи захисту мережі від розповсюджених атак. 3. На основі проведеного аналізу розробити комплексну систему захисту ресурсів мережі, в якій використовується технології SDN та NFV. 4. Змоделювати роботу тестової мережі та провести імітації атак на її елементи, після чого на основі отриманих результатів сформулювати рекомендації, які допоможуть уникнути типових помилок при створенні нової комплексної системи захисту . Об’єкт дослідження – системи захисту мережі з технологіями SDN (Програмно-конфігуровані мережі) та NFV (Віртуалізація мережевих функцій). Предмет дослідження – дослідження ефективності захисту елементів мережі, периметра мережі загалом, а також даних, що транспортуються в цій мережі. проведення аналізу сигнатур розповсюджених атак, моделювання тестової мережі, створення імітаційних атак на мережу та порівняльний аналіз захищеності системи. Методи досліджень – використовувався метод експериментального моделювання, для моделювання роботи тестової мережі. Проведено аналіз методів захисту від розповсюджених атак в мережах з різними моделями реалізації віртуалізованних функцій, розробка набору автоматичних тестів, які будуть імітувати атаку на змодельовану мережу і аналізувати реакцію системи захисту. Наукова новизна одержаних результатів в магістерській дисертації полягає в наступному: 1. Проаналізувавши технології програмно-конфігуровних мереж та віртуалізованих мережевих функцій виявлено, що на сьогоднішній день залишаються не вирішені питання надійної та коректної роботи мереж з даними технологіями, оскільки разом з впровадженням цих технологій з’являються нові вразливості мережі. 2. Розроблено комплексний спосіб та систему захисту ресурсів комп’ютерної мережі, яка відрізняється від наявних тим, що в мережі встановлено централізований контролер, який проводить моніторинг мережі, а також елементом захисту розробленої системи є набір імітаційних атак в поєднані з загальним інтерфейсом контролювання мережевих функцій, за допомогою тестових атак, система та мережевий адміністратор навчаться розрізняти сигнатури схожих атак. 3. Змодельовано роботу тестової мережі з використанням віртуальних функцій, проведено на неї імітації атак та показано як система реагує на дані атаки і як проводиться логування під час атаки. В подальшому дасть змогу швидко і гнучко реагувати на вразливості кожної функції, а також підвищить загальний рівень захисту системи. Практична цінність одержаних результатів можуть бути використані для вибору найкращого набору методів захисту комп’ютерної мережі. Апробація роботи. Основні положення і результати роботи представлені та обговорені на: V Міжнародна науково-технічна Internet-конференція «Сучасні методи, інформаційне, програмне та технічне забезпечення систем керування організаційно-технічними та технологічними комплексами» НУХТ (Київ 22-23 листопада). ХІ науковій конференції магістрантів та аспірантів «Прикладна математика та комп’ютинг – ПМК’2018» (Київ, 14 – 16 листопада 2018 року). Публікації. За результатами магістерської дисертації опубліковано 2 наукові праці, з них 2 тези доповідей. Структура та обсяг роботи. Магістерська дисертація складається з вступу, трьох розділів, висновків та 4 додатків. У вступі подано загальну характеристику роботи, зроблено оцінку сучасного стану проблеми, обґрунтовано актуальність напрямку досліджень, сформульовано мету і задачі досліджень, показано наукову новизну отриманих результатів і практичну цінність роботи. У першому розділі наведено аналітичний огляд літературних джерел технології віртуалізованих обчислень, їх загальні характеристики, особливості, структуру та архітектуру. У другому розділі проаналізовані три моделі реалізації віртального хмарного обчислення за допомогою технології NFV, розглянуті їх основні принципи роботи і вразливості при роботі з ними. Розглянуто основні способи захисту мережі при використані цих моделей. У третьому розділі розроблено власну комплексну систему захисту ресурсів комп’ютерної мережі встановлено централізований контролер, який проводить моніторинг мережі, також елементом захисту розробленої системи є набір імітаційних атак в поєднані з загальним інтерфейсом контролювання мережевих функцій, за допомогою тестових атак, система та мережевий адміністратор навчаться розрізняти сигнатури схожих атак. У висновках представлені результати проведеної роботи. Робота представлена на 78 аркушах, містить посилання на список використаних літературних джерел. Actuality of theme. With the development of computer technology, the user's needs are increasing in the scalability and flexibility of their computer network. Network virtualization technology features helps us to make the network more flexible, easier to manage it via transferring control interface of devices on a common, centralized interface, less costly in adding a new software module implemented in the network much easier and faster than adding hardware component. Whereas with this development of network function virtualization, the actual theme is the protection of the virtualized network, all its elements and data. Purpose : there is a detailed overview of software-defined networks using NFV technology in them, analysis of vulnerable places such networks, analysis of the effectiveness of various security features, and discussed the relevance of using automatic set of simulation attacks for each virtual function to ensure quick detection and correction of software errors. To achieve the goal, have been created the following tasks , which are solved in the work: 1. Conduct systematization and analysis of the types of vulnerabilities of the virtualized network. 2. Consider the basic methods of protecting the network against widespread attacks . 3. Develop a comprehensive system for protecting network resources using SDN and NFV technologies based on the analysis . 4. Create a test network model and make attacks on its imitation elements, then based on the results, formulate recommendations that will help avoid common mistakes when creating a new comprehensive security system . Object of research – network protection systems with software-defined nework technologie and NFV (Virtualization of Network Functions) . The subject of the study is effectiveness of the protection elements in the network, defense of network perimeter, layer of transporting data on this network . Conducting analysis of signatures of common attacks, simulation of the test network , creating simulation attacks on the network and comparative analysis of the security of the system. Research methods - the method of experimental simulation used for simulate work of test network. Made analysis of protection methods against common attacks on networks with different models of implementing virtualization's function and, developed a set of automated tests that will simulate an attack on simulated network and analyze the reaction of the system of protection. Scientific novelty the results obtained in master s dissertation is as follows: 1. After analyzing the technologies of software-defined networks and virtualized network functions, it has been found that today we have unresolved question of the reliable and correct operation of networks with these technologies, via introduction of these technologies there are new vulnerabilities of the network. 2. The complex method and system of protection of computer network resources have created, which differs from the simple ones that created system exists in the network centralized controller that monitors the network, also set of simulation attacks is element of protection developed system. With the help of this simulated atacks, the system and the network administrator will learn to distinguish signatures of similar attacks. 3. Work of the test network with the use of virtual functions has been simulated, immitations of attacks have been carried out on it, and it shows how the system responds to attack data and how logging is done during an attack. In the future, it will allow you to quickly and flexibly respond to the vulnerabilities of each function, as well as increase the overall level of protection of the system. The practical value of the results obtained can be used to select the best set of methods for protecting the computer network. Approbation. The main provisions and results of work are presented and discussed at: V International scientific and technical Internet-conference " Modern methods, information, software and technical support of control systems organizational and technical and technological complexes "NUFT (Kyiv 22 -23 November). XI and scientific conferences undergraduates and graduate students "Applied mathematics and computing - PMK'201 8" (Kyiv, 14 - 16 November 2018 ). Publications According to the results of the master's dissertation, 2 scientific papers, 2 of them abstracts, are published. Structure and scope of work. The master's dissertation consists of an introduction, three sections, conclusions and 4 appendices . The introduction gives a general description of the work, assesses the current state of the problem, substantiates the relevance of the research direction, formulates the purpose and objectives of the research, shows the scientific novelty of the results obtained and the practical value of the work. The first section provides an analytical review of literary sources of technology of virtualized computing, their general characteristics, features, structure and architecture. The second section analyzes three models of real-time virtual cloud computing using NFV technology, examines their basic principles of work and vulnerability when works with them. The main ways of protecting thr network when using these models are considered. The third section developed own combined system of protection of computer network resources with centralized controller that monitors the network. Also system has set of simulated attacks which is also as part of defense in conjunction with the general interface for controlling network functions, with the help of simulated attacks, the system and the network administrator will learn to distinguish between signatures of similar attacks. The conclusions are the results of the work. The work is presented on 78 pages, contains a link to the list of used literary sources.

Magistrsko delo zajema kratek opis konceptov in arhitekture programsko določenih omrežij. Sledita opis porazdeljene izvedbe krmilne ravnine in predstavitev glavnih pristopov zagotavljanja skladnosti v omrežjih s tako ravnino. Magistrsko delo se osredotoča na zagotavljanje skladnosti v omrežjih s krmilniki ONOS. Namen je predstavitev delovanja teh krmilnikov v grozdu in način zagotavljanja skladnosti njihovih informacij o topologiji omrežja. Delovanje grozda smo preizkusili v različnih scenarijih v navideznih omrežjih, tvorjenih z emulatorjem Mininet. This master's thesis first gives a brief description of the concepts and architecture of software defined networks. A description of the distributed control plane and a presentation of the main approaches to ensuring consistency in networks with such a plane follow. The master's thesis focuses on ensuring consistency in distributed software-defined networks with ONOS controllers. The operation of these controllers in the cluster and the way of ensuring consistency of their information on the network topology are presented. The cluster performance was tested in various scenarios in virtual networks created with Mininet emulator.

© 2018 Elsevier Ltd Data transfer is now an essential function for science discoveries, particularly within big data environments. To support data transfer for big data science, there is a need for high performance, scalable, end-to-end, and programmable networks that enable science applications to use the network most efficiently. The existing network paradigm that support big data science consists of three major components: terabit networks that provide high network bandwidths, Data Transfer Nodes (DTNs) and Science DMZ architecture that bypasses the performance hotspots in typical campus networks, and on-demand secure circuits/paths reservation systems, such as ESNet OSCARS and Internet2 AL2S, which provides automated, guaranteed bandwidth service in WAN. This network paradigm has proven to be very successful. However, to reach its full potentials, we claim that existing network paradigm for big data science must address three major problems: the last mile problem, the scalability problem, and the programmability problem. To address these problems, we proposed a solution called AmoebaNet. AmoebaNet applies Software Defined Networking (SDN) technology to provide “QoS-guaranteed” network services in campus or local area networks. AmoebaNet complements existing network paradigm for big data science: it allows application to program networks at run-time for optimum performance; and, in conjunction with WAN circuits/paths reservation system such as ESNet OSCARS and Internet2 AL2S; it solves the last mile problem and the scalability problem.

Современный уровень развития беспроводных устройств позволяет использовать дешевый беспроводной интерфейс практически в любых областях электроники, где раньше использовались преимущественно проводные решения. Многие объекты дополнительно используют множество беспроводных устройств контроля и управления объектами, беспроводные реле, замки, видеонаблюдение. Перекрытие частотных устройств в открытых диапазонах имеет повсеместное распространение, эти устройства перестают работать на дальние расстояния или вообще не принимают запросы. Работа посвящена исследованию Mesh сетей с традиционным способом маршрутизации AODV и с разработанным ранее способом на основе PainlessMesh и программно-конфигурируемых сетей. В качестве объекта исследования выбраны IoT устройства, используемые на больших по площади объектах. Будет проведено исследование потери пакетов и задержки при передачи пакетов по обоим исследуемым протоколам., The current level of development of wireless devices makes it possible to use a cheap wireless interface in virtually all areas of electronics, where previously mainly wired solutions were used. Many objects additionally use a lot of wireless control and management devices, wireless relays, locks, video surveillance. Overlapping of frequency devices in open bands is widespread, these devices stop working for long distances or do not accept requests at all. The work is devoted to the study of Mesh networks with the traditional method of routing AODV and with the previously developed method based on PainlessMesh and software-configurable networks. As an object of research, IoT devices are used, used in large-scale objects. A study will be made of the loss of packets and the delay in the transmission of packets for both protocols under investigation., №3 (2019)

Cloud computing has become a business reality that impacts technology users around the world. It has become a cornerstone for emerging technologies and an enabler of future Internet services as it provides on-demand IT services delivery via geographically distributed data centers. At the core of cloud computing, virtualization technology has played a crucial role by allowing resource sharing, which in turn allows cloud service providers to offer computing services without discrepancies in platform compatibility. At the same time, a trend has emerged in which enterprises are adopting a software-based network infrastructure with paradigms, such as software-defined networking, gaining further attention for large-scale networks. This trend is due to the flexibility and agility offered to networks by such paradigms. Software-defined networks allow for network resource sharing by facilitating network virtualization. Hence, combining cloud computing with a software-defined network architecture promises to enhance the quality of services that are delivered to clients and reduces the operational costs to service providers. However, this combined architecture introduces several challenges to cloud service providers, including resource management, energy efficiency, virtual network provisioning, and controller placement. This thesis tackles these challenges by proposing innovative resource provisioning techniques and developing novel frameworks to improve resource utilization, power efficiency, and quality of service performance. These metrics have a direct impact on the capital and operational expenditure of service providers. In this thesis, the problem of virtual computing and network provisioning in geographically distributed software-defined network-enabled cloud data centers is modeled and formulated. It proposes and evaluates optimal and sub-optimal heuristic solutions to validate their efficiency. To address the energy efficiency of cloud environments that are enabled for software-defined networks, this thesis presents an innovative architecture and develops a comprehensive power consumption model that accurately describes the power consumption behavior of such environments. To address the challenge of the number of software-defined network controllers and locations, a sub-optimal solution is proposed that combines unsupervised hierarchical clustering. Finally, betweenness centrality is proposed as an efficient solution to the controller placement problem.

RESUMEN: Las redes definidas por software o Software-Defined Network (SDN) abarcan varios tipos de tecnologías de red para conseguir que la misma sea ágil y flexible. El objetivo de las redes SDN es que los ingenieros y administradores de red respondan rápidamente a los cambiantes requisitos comerciales. En una red definida por software, el administrador puede dar forma al tráfico desde una consola de control centralizada sin tener que tocar individualmente cada switch y puede proporcionar servicios donde se necesiten en la red, sin importar a que dispositivos está conectado un servidor o un componente hardware. Esto se consigue a través de técnicas de Ingeniería de Tráfico, y es de lo que trata este trabajo. De la posibilidad de aplicar dichas técnicas en redes SDN para comprobar que efectivamente las redes definidas por software son eficaces y que tienen aplicaciones ventajosas hoy en día. Se desarrollan dos casos de uso reales que incorporan técnicas de Ingeniería de Tráfico en redes SDN y una vez implementados, se realiza un test para comprobar su funcionamiento y determinar su validez en función de los resultados. Estos casos de uso son en realidad aplicaciones que funcionan en una capa superior a OpenFlow. ABSTRACT: Software-Defined Networks, SDN, cover several kinds of network technology aimed at making the network agile and flexible. The goal of SDN is to allow network engineers and administrators to respond quickly for changing business requirements. In a Software-Defined Network, a network administrator can shape traffic from a centralized control console without having to touch individual switches, and can deliver services to wherever they are needed in the network, without regard to what specific devices a server or other hardware components are connected to. This can be achieved through Traffic Engineering techniques, what this work is all about. The possibility of applying these techniques in SDN networks to verify that Software-Defined Networks are effective and that they have advantageous applications nowadays. Two real use cases that incorporate Traffic Engineering techniques in SDN networks are developed in the project. Once they are implemented, a test is carried out to check its operation and determine its validity based on the given results. These use cases are actually applications sitting in top of the OpenFlow layer. Grado en Ingeniería de Tecnologías de Telecomunicación

26th IEEE Signal Processing and Communications Applications Conference (SIU) -- MAY 02-05, 2018 -- Izmir, TURKEY WOS: 000511448500544 The software defined network (SDN) approach suggests a new network architecture as a solution to network resource management problems. Cognitive radio network (CRN) technology is a new dynamic access technique that enables the limited spectrum to be used effectively and efficiently. CR technology allows unlicensed secondary users benefit from the spectrum in an opportunistic manner, without interfering with licensed primary users. In this paper, a new network architecture based on SDN approach is proposed for CRN technology. This architecture uses a dynamic spectrum access (DSA) mechanism to meet QoS requirements. In addition, management responsibilities of network resources are logically managed by a controller that manages the entire network from a central point. In this way, the workload on network users and base stations is greatly reduced. This architecture, which reduces dependency on base stations, provides dynamic, infrastructure-independent and efficient resource allocation for BR users. IEEE, Huawei, Aselsan, NETAS, IEEE Turkey Sect, IEEE Signal Proc Soc, IEEE Commun Soc, ViSRATEK, Adresgezgini, Rohde & Schwarz, Integrated Syst & Syst Design, Atilim Univ, Havelsan, Izmir Katip Celebi Univ

This paper represents the results of the research, which have allowed us to develop a hybrid approach to the processing, classification, and control of traffic routes. The approach enables to identify traffic flows in the virtual data center in real-time systems. Our solution is based on the methods of data mining and machine learning, which enable to classify traffic more accurately according to more criteria and parameters. As a practical result, the paper represents the algorithmic solution of the classification of the traffic flows of cloud applications and services embodied in a module for the controller of the software-defined network. This solution enables to increase the efficiency of handling user requests to cloud applications and reduce the response time, which has a positive effect on the quality of service in the network of the virtual data center.

Traditional network architecture is inflexible and complicated. This observation has led to a paradigm shift towards software-defined networking (SDN), where network management level is separated from data forwarding level. This change was made possible by control plane transfer from the switching equipment to software modules that run on a dedicated server, called the controller (or network operating system), or network applications, that work with this controller. Methods of representation, storage and communication interfaces with network topology elements are the most important aspects of network operating systems available to SDN user because performance of some key controller modules is heavily dependent on internal representation of the network topology. Notably, firewall and routing modules are examples of such modules. This article describes the methods used for presentation and storage of network topologies, as well as interface to the corresponding Floodlight modules. An alternative algorithm has been suggested and developed for message exchange conveying network topology alterations between the controller and network applications. Proposed algorithm makes implementation of module alerting based on subscription to the relevant events. API for interaction between controller and network applications has been developed. This algorithm and API formed the base for Topology Tracker module capable to inform network applications about the changes that had occurred in the network topology and also stores compact representation of the network to speed up the interaction process.

In order to solve the problem of Software-Defined Network scalability, the idea of using multiple controllers to manage the underlying network domain became an effective solution. But how to deploy the controller rationally to reduce the communication overhead of control plane lacks the corresponding research. Therefore this paper proposes a controller dynamic deployment strategy. The strategy uses the Quantum Genetic Algorithm to calculate the optimal controller deployment scheme, and can adjust scheme of deployment dynamically according to the change of network topology. Experiments show that this deployment scheme can effectively reduce the whole communication overhead of the control plane, and achieve dynamic adjustment of deployment scheme at the smaller expense.

The emergence of software-defined network (SDN) has brought unprecedented innovation to current networks. SDN's two most notable features are decoupling and programmability. Decoupling makes network management centralized in a control plane. Meanwhile, having benefitted from the programmable characteristic of SDN, new functions of networking can be easily realized. However, these features also introduce new security issues to SDN. Through the programming interface provided by SDN, software engineers can easily develop network applications to generate networking policies for SDN's control planes for the purpose of guiding network routing. However, it is hard to guarantee the security and quality of these new applications. Malicious or low-quality applications could damage a whole network. To solve this problem, we propose a novel trust management framework for SDN applications in this paper. It can evaluate applications' trust values based on their impact on the network performance (such as time delay, packet loss rate, throughput, etc). These trust values further play a decisive role for managing and selecting applications in SDN. We evaluate this framework's performance through a prototype system implemented based on a floodlight controller. The experimental results show the accuracy and effectiveness of our design.

The paper gives an overview and analysis of software-defined technologies in the context of the actual problems of conventional computer networks. The virtualization process lies at the basis of software-defined network architecture. The basic concepts of software-defined networks are elaborated, as well as their implementation and configuration in cloud environment using OpenStack open-source software with Microsoft Hyper-V hypervisor. The practical part of this research showed that the implementation of a software-defined network into an existing standard network is relatively simple to realize, remaining all the time in open-source framework. All existing network functionalities were held, and it is also possible to provide additional network operations such as traffic monitoring in a completely open-source environment.

Recently, hybrid satellite-terrestrial networks (H-STNs) are expected to support extremely high data rates and exponentially increasing demands of data, which require new spectrum sharing and interference control technology paradigms. By achieving an efficient spectrum sharing among H-STN, traffic offloading is a promising solution for boosting the capacity of traditional cellular networks. In this paper, a software-defined network-based spectrum sharing, and traffic offloading mechanism is proposed to realize the cooperation and competition between the ground base stations (BSs) of the cellular network and beam groups of the satellite-terrestrial communication (STCom) system. Assume that all BSs are operated by the same mobile network operator (MNO). Under the cooperation mode, all the BSs stop occupying a corresponding channel, and a selected beam group of the satellite helps offload the traffic from the BSs by exclusively using this channel. To facilitate the offloading negotiation between the MNO and satellite, we design a second-price auction mechanism which presents positive allocative externalities, i.e., other uncooperative beam groups of the satellite can benefit from the cooperation between BSs and the beam group performing offloading. Meanwhile, the unique optimal biding strategies for different beam groups of the satellite to achieve the symmetric Bayesian equilibrium as well as the expected utility of the MNO are derived and obtained in this paper. The performance of the proposed traffic offloading mechanism is validated in the simulations, which also reveal that there exists the unique optimal offloading threshold for the MNO to achieve the maximum expected utility. This work was supported in part by the National Natural Science Foundation China under Projects 61571300, 61428101, 61822104, 61471025, and 61771044, in part by the Young Elite Scientist Sponsorship Programs by CAST, in part by the new strategic industries development projects of Shenzhen City under Grant JCYJ20170816151922176, and in part by the Research Foundation of the Ministry of Education of China and China Mobile under Grant MCM20170108. Scopus

Aiming at realizing ubiquitous spectrum access and improving the spectrum efficiency in a software-defined network, in this paper, we adopt the concept of cognitive radio and propose a joint subcarrier and power allocation (JSPA) scheme for reciprocally benefited spectrum access with secondary users (SUs) cooperating with primary users (PUs). In our proposed JSPA scheme, SUs adopt the decode-and-forward relaying protocol to help PUs in a two-stage way. Meanwhile, a fraction of unallocated licensed spectrum is allocated for the secondary transmission in every stage. However, if the two-stage cooperation still cannot satisfy the PUs’ outage quality-of-service (QoS) requirement, SUs then switch to the access mode and entirely capture the licensed spectrum. Our proposed scheme is to maximize the average transmission rate of SUs through joint optimal subcarriers and power allocation under the constraint of PUs’ outage QoS requirement. The closed-form expressions about the outage probability and average transmission of both PUs and SUs are derived, and we prove the optimality of our scheme. Simulation results show that, compared with the conventional cognitive cooperation scheme, the average transmission rate of SUs is improved.

The article of record as published may be found at http://dx.doi.org/10.1109/ICSPCS.2017.8270453 Published in: 2017 11th International Conference on Signal Processing and Communication Systems (ICSPCS) The aim of this paper was to determine the feasibility of identifying a device connected to the Internet through multiple interfaces (i.e., multi-homed) using the information provided by passively observing network traffic. Since multi-homed hosts allow an alternate means for outside entities to circumvent the security of a firewall and gain access to a network, it is important for a network's security to be able to detect and remove such devices. In this work, the idea of using clock skew - the difference in perceived time between two system clocks - as a unique signature is utilized to identify hosts on a network that are potentially multi-homed. Testing was done on a software-defined network that contained a multi-homed host. After traffic between hosts was collected and processed, analysis of the confidence intervals of the device's clock skew was conducted to determine if IP addresses originating from the same host could be successfully detected solely from network traffic. Results confirmed that the proposed scheme provided a valid means of detecting a multi-homed device on a network

Networks protected by firewalls and physical separation schemes are threatened by multi-homed devices. The purpose of this study is to detect multi-homed devices on a computer network. More specifically, the goal is to evaluate passive detection of multi-homed devices running various operating systems while communicating on a network. TCP timestamp data was used to estimate clock skews using linear regression and linear optimization methods. Analysis revealed that detection depends on the consistency of the estimated clock skew. Through vertical testing, it was also shown that clock skew consistency depends on the installed operating system. The linear programming and linear regression methods agree with one another when clock skews are consistent, indicating that linear regression is sufficient to identify multi-homed hosts in networks with low network delay. Further analysis showed inconsistencies of clock skew estimation on newer versions of OS X and freeBSD 12.0; the clock skews from these operating systems prevented multi-homed fingerprinting using the proposed detection scheme. http://archive.org/details/investigatingdet1094556171 Lieutenant Commander, United States Navy Approved for public release; distribution is unlimited.

Application of the "Endless train" method for the SDN controller OpenDayLight. Using the cloud for software defined networks opens new possibilities for the organization of computing processes of network controllers. Methods of virtual entities maintenance in a cloud environment allow counting on relatively infinite computing resources of the cloud service called Platform as a Service. Today it is possible to evaluate the degree of utilization of computing resources for the software controller operation only theoretically. The article considers the possibility of using an "endless train" method for virtualization of individual functional opportunities of SDN OpenDayLight controller. This method allows to organize controller computer processes caused by the need to serve the dynamically changing stream of user applications, such as initialization of the flow or the organization of virtual networks. In the section "Architecture and basic features SDN controller" the main components and functionality of the controller OpenDayLight were described. The method of "endless train" for the distribution of tasks between virtual machines and possibility of its use for various functions of the OpenDayLight controller were considered in the section "The method of "endless train" for the organization of the computational process SDN”. In the next section "Description of the experiment" the results of simulation modeling of proposed method to study its effectiveness are presented., В статье рассмотрена возможность применения метода "бесконечный поезд" для виртуализации отдельных функциональных возможностей SDN контроллера OpenDayLight. Данный метод позволяет организовать вычислительные процессы контроллера, вызванные необходимостью обслуживать динамически изменяющийся поток абонентских заявок, таких как инициализация потока или организация виртуальных сетей., У статті розглянута можливість застосування методу "нескінченний потяг" для віртуалізації окремих функціональних можливостей SDN контролера OpenDayLight. Даний метод дозволяє організувати обчислювальні процеси контролера, викликані необхідністю обслуговувати потік абонентських заявок, що змінюється динамічно, таких як ініціалізація потоку або організація віртуальних мереж.