Optimising Packet Forwarding in Multi-Tenant Networks using Rule Compilation

in Optimising Packet Forwarding in Multi-Tenant Networks using Rule Compilation (2017, November)

Packet forwarding in Software-Defined Networks (SDN) relies on a centralised network controller which enforces network policies expressed as forwarding rules. Rules are deployed as sets of entries into ... [more ▼]

Packet forwarding in Software-Defined Networks (SDN) relies on a centralised network controller which enforces network policies expressed as forwarding rules. Rules are deployed as sets of entries into network device tables. With heterogeneous devices, deployment is strongly bounded by the respective table constraints (size, lookup time, etc.) and forwarding pipelines. Hence, minimising the overall number of entries is paramount in reducing resource consumption and speeding up the search. Moreover, since multiple control plane applications can deploy own rules, conflicts may occur. To avoid those and ensure overall correctness, a rule validation mechanism is required. Here, we present a compilation mechanism for rules of diverging origins that minimises the number of entries. Since it exploits the semantics of rules and entries, our compiler fits a heterogeneous landscape of network devices. We evaluated compiler implementations on both software and hardware switches using a realistic testbed. Experimental results show a reduction in both produced table entries and forwarding delay. [less ▲]

Confirmation Delay Prediction of Transactions in the Bitcoin Network

in Lecture Notes in Electrical Engineering (2017)

Bitcoin is currently the most popular digital currency. It operates on a decentralised peer-to-peer network using an open source cryptographic protocol. In this work, we create a model of the selection ... [more ▼]

Bitcoin is currently the most popular digital currency. It operates on a decentralised peer-to-peer network using an open source cryptographic protocol. In this work, we create a model of the selection process performed by mining pools on the set of unconfirmed transactions and then attempt to predict if an unconfirmed transaction will be part of the next block by treating it as a supervised classification problem. We identified a vector of features obtained through service monitoring of the Bitcoin transaction network and performed our experiments on a publicly available dataset of Bitcoin transaction. [less ▲]

Fault Detection and Network Security in Software-Defined Networks with OpenFlow

Doctoral thesis (2014)

Due to the rigid architecture of most switches and routers, which provide functionality only for a certain application scenario, the flexibility of deploying new network functions is limited. The advent ... [more ▼]

Due to the rigid architecture of most switches and routers, which provide functionality only for a certain application scenario, the flexibility of deploying new network functions is limited. The advent of programmable networks, which is described as Software-Defined Networking (SDN), allows the extension and control of networks based on a flexible con- trol plane, which is based on software and acts as a network operating system with network applications running on top of it. In this thesis we focussed on SDN based on the concept of the OpenFlow protocol. In or- der to deploy such networks in operational environments and datacentres, the challenges concerning network management are still lacking a sufficient analysis and are further investigated in this thesis, which examines the reliability and maintainability of SDN, as well as new security issues that are introduced with this architecture. The second contribution of this thesis is to provide solutions to some of the addressed challenges, with a focus on fault detection and network security. With regard to fault detection, we discuss the information content and monitoring as- pects of flow entries that are located on the network devices, but are managed from the network controller. This involves applying methods from information theory to deter- mine faults and attacks by observing the logical topology, and correlation facilities to determine errors that relate to the data plane. In network security, current approaches mostly rely on security appliances that are de- ployed at different locations in the network. We analyse the extend to which SDN can be leveraged to provide new ways of thwarting network attacks, and investigate the pos- sibilities for controller-based packet inspection to detect malicious communications in the network. This includes the extraction of hidden communication patterns originating from a stealthy backdoor. The freedom of extending controller software to meet new network service requirements comes at a high cost. Since the reliability of the network must be assured, tools are required to debug and test the software after each alteration step. We propose a solu- tion that instruments network applications with additional code for logging purposes, guaranteeing certain correctness properties. In combination with a database system, our framework can be leveraged to allow network debugging or anomaly detection. [less ▲]

Implications and Detection of DoS Attacks in OpenFlow-based Networks

in 2014 IEEE Global Communications Conference (2014)

In this paper, we address the potential of centralised network monitoring based on Software-Defined Networking with OpenFlow. Due to the vulnerability of the flow table, which can store only a limited ... [more ▼]

In this paper, we address the potential of centralised network monitoring based on Software-Defined Networking with OpenFlow. Due to the vulnerability of the flow table, which can store only a limited number of entries, we discuss and show the implications for a DoS attack on a testbed consisting of OpenFlow enabled network devices. Such an attack can be detected by analysing variations in the logical topology, using techniques from information theory that can run as a network service on the network controller. [less ▲]

Automated Source Code Extension for Debugging of OpenFlow based Networks

in Proc. 9th International Conference on Network and Service Management (CNSM) (2013, October)

Software-Defined Networks using OpenFlow have to provide a reliable way to to detect network faults in operational environments. Since the functionality of such networks is mainly based on the installed ... [more ▼]

Software-Defined Networks using OpenFlow have to provide a reliable way to to detect network faults in operational environments. Since the functionality of such networks is mainly based on the installed software, tools are required in order to determine software bugs. Moreover, network debugging might be necessary in order to detect faults that occurred on the network devices. To determine such activities, existing controller programs must be extended with the relevant functionality. In this paper we propose a framework that can modify controller programs transparently by using graph transformation, making possible online fault management through logging of network parameters in a NoSQL database. Latter acts as a storage system for flow entries and respective parameters, that can be leveraged to detect network anomalies or to perform forensic analysis. [less ▲]

Detecting Stealthy Backdoors with Association Rule Mining

in IFIP Networking 2012 (2012)

In this paper we describe a practical approach for detecting a class of backdoor communication channel that relies on port knocking in order to activate a backdoor on a remote compromised system ... [more ▼]

In this paper we describe a practical approach for detecting a class of backdoor communication channel that relies on port knocking in order to activate a backdoor on a remote compromised system. Detecting such activation sequences is extremely challenging because of varying port sequences and easily modifiable port values. Simple signature-based ap- proaches are not appropriate, whilst more advanced statistics-based test- ing will not work because of missing and incomplete data. We leverage techniques derived from the data mining community designed to detect se- quences of rare events. Simply stated, a sequence of rare events is the joint occurrence of several events, each of which is rare. We show that search- ing for port knocking sequences can be reduced to a problem of finding rare associations. We have implemented a prototype and show some ex- perimental results on its performance and underlying functioning. [less ▲]