Graph-Based Policy Change Detection and Implementation in SDN

Abstract

Software Defined Networking (SDN), as a cutting-edge network, splits control and management planes from the data plane for simplifying network manageability as well as programmability. In SDN, network policies change with the passage of time due to changes in the application environment, topology or user/admin requirements. As a result, modifications at the control plane take place. In existing research works, packet violations occur due to already installed flow rules at the data plane (switches) that are not modified in case of a change of the Access Control List (ACL) policies at the SDN controller. There has been no research carried out that identifies packet violations and network inefficiencies in case of policy change. Our novel approach stores generated flow rules at the SDN controller and detects policy change, along with conflicting flow rules, to resolve the identified problem of policy change. Afterwards, the conflicting flow rules are removed from switches and new flow rules are installed along the new path according to new ACL policies. It helps to minimize packet violations, which increases network efficiency. In this research work, we deal with the inefficiencies of policy change detection with respect to access time, cost and space. In this regard, we used abstractions to formalize and detect network policies with the help of multi-attributed graphs. We utilized intent-based policies for the representation and implementation of our proposed approach. In addition, we used extended performance metrics for the analysis of our proposed approach. The simulation results show that our proposed approach performs better as compared to the existing approach, by varying the number of policy change and packet transmission rate. The results clearly indicate that our proposed approach helps to increase network performance and efficiency.

Middlebox selection optimization via an intelligent framework in software‐defined networking

“…Thus, an automatic, correct and fast composition of multiple independently specified network policies is an open problem. There are some methods to detect and resolve policy conflicts 40,41 . However, we are not concern about policy specifications and their conflicts in our current work.…”

Reliability Aware Multiple Path Installation in Software-Defined Networking

“…We have used the multi-dimensional hash-able objects to store the attribute of the link. Although there is a choice of directly using the multidimensional arrays (matrix) for storing and accessing these attributes, it elevates the accessing cost (i.e., time) [49].…”

SDN-Based Detection of Self-Propagating Ransomware: The Case of BadRabbit

“…Another important issue is related to detecting policy changes in an SDN environment. That is, when installing new Flow [34]. Generally speaking, there is a possibility that ransomware may be granted access, even despite being blocked by the controller.…”

“…This is because these two approaches depend entirely on monitoring a certain number of legitimate packets (the number of ARP requests, and the attempt to reach the webserver) to impose restrictions on the infected device. Resolving such conflicts is beyond the scope of this paper and the interested reader may refer relevant works [34]- [36].…”