Efficient Forwarding Anomaly Detection in Software-Defined Networks

doi:10.1109/TPDS.2021.3068135

2021-11-01

DOI：10.1109/TPDS.2021.3068135

原文链接

查看原文

摘要

En 中文

Data centers, the critical infrastructure underpinning Cloud computing, often employ Software-Defined Networks (SDN) to manage cluster, wide-area and enterprise networks. As the network forwarding in SDN is dynamically programmed by controllers, it is crucial to ensure that the controller intent is correctly translated into underlying forwarding rules. Therefore, detecting and locating forwarding anomalies in SDN is a fundamental problem in production networks. Existing research proposals, roughly categorized into probing-based, packet piggybacking-based, and flow statistics analysis-based, either impose significant overhead or do not provide sufficient coverage for certain forwarding anomalies. In this article, we propose FADE, a controllable and passive measuring scheme to simultaneously deliver detection efficiency and accuracy. FADE first analyzes the entire network topology and flow rules, and then computes a minimal set of flows that can cover all forwarding rules. For each selected network flow, FADE decides the optimal number of monitoring positions on its path (much less than total number of hops), and installs dedicated rules to collect flow statistics. FADE controls the installation and expiration of these rules, along with unique flow labels, to guarantee the accuracy of collected statistics, based on which FADE algorithmically decides whether a forwarding anomaly is detected, and if so it further locates the anomaly. On top of FADE, we propose iFADE (a more scalable version of FADE) to further optimize the usage and deployment of dedicated measurement rules. iFADE achieves over 40 percent rule reduction compared with FADE. We implement a prototype of both FADE and iFADE in about 12 000 lines of code and evaluate the prototype extensively. The experiment results demonstrate (i) FADE and iFADE are accurate, e.g., they achieve over 95 percent true positive rate and 99 percent true negative rate in anomaly detection; (ii)THORN FADE and iFADE are lightweight, e.g., they reduce the overhead of control messages compared with state-of-the-art by about 50 and 90 percent, respectively.

Keyword:

Software defined networking

cross-plane consistency check

forwarding anomaly

AI总结

对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。

期刊

IEEE Transactions on Parallel and Distributed Systems

IF:

论文数:

5.2K

被引数:

1.1W

机构

tsinghua university

学者数:

11.9W

论文数: 10.0W

被引数: 137

University of Illinois Urbana-Champaign

学者数:

2.4W

论文数: 2.0W

被引数: 35

引用论文

Dynamic Packet Forwarding Verification in SDN

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

IF7.5

2019-11-01

PREAI

Li, Qi; Zou, Xiaoyue; Huang, Qun; Zheng, Jing; Lee, Patrick P. C.

The Hydroalumination of Ethylene. A Self-consistent Field Molecular Orbital Study.乙烯的加氢铝化。自洽场分子轨道研究。

Acta Chemica Scandinavica

IF0

1982-01-01

OAAI

Odd Gropen; Arne Haaland; P. Convert; Lothar Beyer; Otto Bastiansen; Geir Braathen; Liv Fernholt; Grete Gundersen; Claus J. Nielsen; Bjørg N. Cyvin; Sven J. Cyvin

Selective Syntheses of 1,3‐Diphosphacyclobutadiene, Dewar‐1,3,5‐triphosphabenzene, 1,3,5‐Triphosphabenzene, and 1,3,5,7‐Tetraphosphabarrelene by Cyclooligomerization of Phosphaalkynes

Angewandte Chemie International Edition in English

IF0

2003-12-22

PREAI

Paul Binger; Jörg Stannek; Barbara Gabor; Richard Mynott; Joachim Bruckmann; Carl Krüger; Stefan Leininger

Simple spin correction of unrestricted density-functional calculation 不受限制的密度泛函计算的简单自旋校正

Physical Review A

IF0

1996-06-01

PREAI

Alexander A. Ovchinnikov; Jan K. Labanowski