Abstract:Data centers, the critical infrastructure underpinning Cloud computing, often employ Software-Defined Networks (SDN) to manage cluster, wide-area and enterprise networks. As the network forwarding in SDN is dynamically programmed by controllers, it is crucial to ensure that the controller intent is correctly translated into underlying forwarding rules. Therefore, detecting and locating forwarding anomalies in SDN is a fundamental problem in production networks. Existing research proposals, roughly categorized into probing-based, packet piggybacking-based, and flow statistics analysis-based, either impose significant overhead or do not provide sufficient coverage for certain forwarding anomalies. In this article, we propose ${sf FADE}$FADE, a controllable and passive measuring scheme to simultaneously deliver detection efficiency and accuracy. ${sf FADE}$FADE first analyzes the entire network topology and flow rules, and then computes a minimal set of flows that can cover all forwarding rules. For each selected network flow, ${sf FADE}$FADE decides the optimal number of monitoring positions on its path (much less than total number of hops), and installs dedicated rules to collect flow statistics. ${sf FADE}$FADE controls the installation and expiration of these rules, along with unique flow labels, to guarantee the accuracy of collected statistics, based on which ${sf FADE}$FADE algorithmically decides whether a forwarding anomaly is detected, and if so it further locates the anomaly. On top of ${sf FADE}$FADE, we propose ${sf iFADE}$iFADE (a more scalable version of ${sf FADE}$FADE) to further optimize the usage and deployment of dedicated measurement rules. ${sf iFADE}$iFADE achieves over 40 percent rule reduction compared with ${sf FADE}$FADE . We implement a prototype of both

Software-Defined-Networking-Enabled Traffic Anomaly Detection and Mitigation

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

An empirical study for the traffic flow rate prediction-based anomaly detection in software-defined networking: a challenging overview

Deep Learning Based Anomaly Detection Scheme in Software-Defined Networking

Privacy-Preserving Anomaly Detection Across Multi-domain for Software Defined Networks.

A survey and classification of the security anomaly detection mechanisms in software defined networks

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

A Deep Learning Approach to Detect Anomaly in Software-Defined Network

A Human-in-the-Loop Anomaly Detection Architecture for Big Traffic Data of Cellular Network

Detection Network Anomalies Based on Packet and Flow Analysis

Abnormal traffic detection system in SDN based on deep learning hybrid models

Anomaly Secure Detection Methods by Analyzing Dynamic Characteristics of the Network Traffic in Cloud Communications

Generative Adversarial Network Models for Anomaly Detection in Software-Defined Networks

Traffic Anomaly Detection Using Multi-Flows and Multi-Parameters in Backbone Network

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

Network Traffic Decomposition for Anomaly Detection

Research on DDoS Abnormal Traffic Detection Under SDN Network

Efficient Forwarding Anomaly Detection in Software-Defined Networks

A Time-Frequency Detecting Method for Network Traffic Anomalies

Overview of DDoS Attack Detection in Software-Defined Networks

Network-Wide Forwarding Anomaly Detection and Localization in Software Defined Networks