Static Differential Program Analysis for Software-Defined Networks

Nelson, Tim; Ferguson, Andrew D.; Krishnamurthi, Shriram

doi:10.1007/978-3-319-19249-9_25

Cited by 11 publications

(10 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, the analysis and verification of the high-level programming language may be more interesting than the analysis of generated low-level OpenFlow entries. The Flowlog language was especially designed with built-in verification and analysis in mind [ 55 , 58 ] and NetKAT was explicitly designed as a Kleene Algebra with Tests (KAT) which is suitable for formal analysis and it also features an automated decision procedure [ 30 ].…”

Section: Outlook: Verifying Openflow Rulesmentioning

confidence: 99%

Verified iptables Firewall Analysis and Verification

et al. 2018

View full text Add to dashboard Cite

This article summarizes our efforts around the formally verified static analysis of iptables rulesets using Isabelle/HOL. We build our work around a formal semantics of the behavior of iptables firewalls. This semantics is tailored to the specifics of the filter table and supports arbitrary match expressions, even new ones that may be added in the future. Around that, we organize a set of simplification procedures and their correctness proofs: we include procedures that can unfold calls to user-defined chains, simplify match expressions, and construct approximations removing unknown or unwanted match expressions. For analysis purposes, we describe a simplified model of firewalls that only supports a single list of rules with limited expressiveness. We provide and verify procedures that translate from the complex iptables language into this simple model. Based on that, we implement the verified generation of IP space partitions and minimal service matrices. An evaluation of our work on a large set of real-world firewall rulesets shows that our framework provides interesting results in many situations, and can both help and out-compete other static analysis frameworks found in related work.

show abstract

Section: Outlook: Verifying Openflow Rulesmentioning

confidence: 99%

Verified iptables Firewall Analysis and Verification

et al. 2018

View full text Add to dashboard Cite

show abstract

“…Network operators need tools to determine the impact of changes that they make, because bad updates can bring down the entire network. Nelson et al [11] developed Chimp a tool for static differential analysis of SDN controller programs without the need of formal methods. Chimp can be used to present the semantic or the behavioral difference between any two versions of a program.…”

Section: Related Workmentioning

confidence: 99%

“…A multitude of network analysis frameworks [8,6,4,1,11] have been devised for analyzing traditional networks, and some of those solutions could possibly be imported into SDN. Network checking tools could be devised on top of such frameworks (e.g., NetPlumber [7]), these tools can read the configurations of network devices then check these configurations for possible networking issues.…”

Section: Introductionmentioning

confidence: 99%

SDN-VSA: Modeling and Analysis of SDN Control Applications Using Vector Spaces

Aslan

Matrawy

2018

2018 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

Unlike traditional networks which are statically configured, SDN control applications are dynamic and are becoming more heterogeneous and complex. There is a great need for a framework to reason about the behavior of the various SDN applications. To the best of our knowledge, current network modeling frameworks were not designed to incorporate the application logic into their models, and thus can not be used to accurately model the application. In this paper, we suggest the possibility of leveraging the impact which control applications assert on the network information base to reason about the behavior of such applications. Based on that, we propose SDN-VSA, a framework that models SDN control applications as a set of affine transformations in some vector space. Finally, we present an analytical formulation for such framework, and discuss a use-case. For simplicity, we only consider the case of OpenFlow version 1.0.

show abstract

“…A multitude of network analysis frameworks [3], [37], [50], [52], [78] have been devised for analyzing traditional networks, and some of these solutions could possibly be imported into SDN. Network checking tools could be devised on top of such frameworks (e.g., NetPlumber [51]).…”

Section: Introductionmentioning

confidence: 99%

“…because bad updates can bring down the entire network. Nelson et al[78] developed Chimp a tool for static differential analysis of SDN controller programs without the need of formal methods. Chimp can be used to present the semantic or the behavioral difference between any two versions of a program.…”

mentioning

confidence: 99%

Network Application Design Challenges and Solutions in SDN

Abdelsalam¹

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is a promising network architecture that proposes the decoupling of data and control planes. It uses a logically centralized controller powered by a global view to orchestrate the network, enabling innovation by shifting the task of network administration to network programming. Many SDN applications are designed to work autonomously without intervention, and thus they need to monitor the state of the network in order to take appropriate actions, and improve their future decisions. Furthermore, in the case of physically distributed SDN controllers, applications also need to exchange their views in order to build a global network view. This great shift in how networks are perceived gave birth to many new network applications design challenges.In this dissertation, we identify some of these challenges and study how they could affect the performance and security of SDN applications. In particular, we focus on the problem of inconsistent network view at the controllers and its impact on the network applications. We identify two key factors that can contribute to the inconsistent network view at the controllers: (1) network state collection; and (2) controllers' state distribution. We investigate different manifestations of the impact of network state collection and distribution on network applications performance and security. Moreover, we show that different network applications have different consistency requirements, and hence we introduce adaptive distributed SDN controllers as a solution to the controllers' state distribution. Adaptive controllers can tune their i First and foremost, I wish to thank my supervisor Dr. Ashraf Matrawy for his guidance, advice, and more importantly for his patience throughout this dissertation. I would like to thank my PhD committee members Dr. Chadi Assi, Dr. Chris Smelser, Dr. Dimitrios Makrakis, and Dr. Jason Jaskolla for reviewing my dissertation and providing me with their insightful feedback and comments. I would also like to thank my research group colleagues for their fabulous support, and for the fruitful dicussions and the meetings that we had. Last but not least, I would like to express my deepest gratitude and appreciation to my family and friends. Special thanks should be given to my father Abdelsalam, my mother Shoukran, my brothers Khaled and Mahmoud, and my sister Ghada for giving me the encouragement and motivation that I really needed. iv Contents Abstract i Acknowledgments iv List of Figures x List of Tables xiii List of Abbreviations xv CHAPTER 3. IMPLEMENTATION OF SDN EMULATION ENVIRONMENTS kernel (i.e., Linux namespaces is a resource isolation subsystem; or an operating system level virtualization technology). With Linux Namespaces, users can isolate and virtualize filesystems, processes, as well as network stacks.In order to emulate network hosts, Mininet uses the Linux Namespaces to create isolated process spaces for the hosts. In Mininet, hosts are processes with isolated network namespaces (and a shared filesystem).Switches...

show abstract

Static Differential Program Analysis for Software-Defined Networks

Cited by 11 publications

References 25 publications

Verified iptables Firewall Analysis and Verification

Verified iptables Firewall Analysis and Verification

SDN-VSA: Modeling and Analysis of SDN Control Applications Using Vector Spaces

Network Application Design Challenges and Solutions in SDN

Contact Info

Product

Resources

About