Abstract:Internet routers generally see packets from a fast flow more often than a slow flow. This suggests that network fairness may be improved without per-flow information. In this paper, we propose a scheme using Most Recently Used List (MRUL)-a list storing statistics of limited active flows that sorted in most recently seen first mode-to improve the fairness of RED. Based on the list, our proposed scheme jointly considers the identification and punish of the fast and unresponsive fast flows, and the protection of slow flows. Its performance improvements are demonstrated with extensive simulations. Different from the previous proposals, the complexity of our proposed scheme is proportional to the size of the MRUL list but not coupled with the queue buffer size or the number of active flows, so it is scalable and suitable for various routers. In addition, another issue we address in this paper is queue management in RED. Specifically, we replace the linear packet dropping function in RED by a judicially designed nonlinear quadratic function, while original RED remains unchanged. We call this new scheme Nonlinear RED, or NLRED. The underlying idea is that, with the proposed nonlinear packet dropping function, packet dropping becomes gentler than RED at light traffic load but more aggressive at heavy load. As a result, at light traffic load, NLRED encourages the router to operate in a range of average queue sizes rather than a fixed one. When the load is heavy and the average queue size approaches the pre-determined maximum threshold (i.e. the queue size may soon get out of control), NLRED allows more aggressive packet dropping to back off from it. Simulations demonstrate that NLRED achieves a higher and more stable throughput than RED and REM. Since NLRED is fully compatible with RED, we can easily upgrade/replace the existing RED implementations by NLRED.

RED-FT: A Scalable Random Early Detection Scheme with Flow Trust Against DoS Attacks

REDu:A New Active Queue Management Algorithm for Detection and Punishment of Unresponsive Flows

A novel mechanism to defend against low-rate denial-of-service attacks

Flow Anomaly Telemetry Driven by Programmable Data Plane

Flow Table Saturation Attack Against Dynamic Timeout Mechanisms in SDN

RFT: Toward Highly Reliable Flow Data Transmission in Network Measurement

TableGuard: A Novel Security Mechanism Against Flow Table Overflow Attacks in SDN.

Threshold Based Distributed Flow Control Scheme in Wireless Ad Hoc Networks

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Mred: A New Adaptive Active Queue Management Algorithm

rDefender: A Lightweight and Robust Defense Against Flow Table Overflow Attacks in SDN

On the Scalable Fairness and Efficient Active Queue Management of RED

AccFlow: Defending Against the Low-Rate TCP DoS Attack in Wireless Sensor Networks

Loss Rate Aware Preferential Treamtment Scheme at the Congested Router

Research on Detection and Mitigation Methods of Adaptive Flow Table Overflow Attacks in Software-Defined Networks

Router based detection for low-rate agents of DDoS attack

A DoS Resilient Flow-level Intrusion Detection Approach for High-speed Networks

An Efficient Scheme to Defend Data-to-Control-Plane Saturation Attacks in Software-Defined Networking

RED with Optimized Dynamic Threshold Deployment on Shared Buffer

A Robust Scheme To Detect Syn Flooding Attacks

Flooddefender: Protecting Data and Control Plane Resources under Sdn-Aimed Dos Attacks