A Geometric Windowing Algorithm in Network Data-Plane Verification

Author(s):  
Richard Chen ◽  
Toru Mano ◽  
Takeru Inoue ◽  
Kimihiro Mizutani ◽  
Hisashi Nagata ◽  
...  
Keyword(s):  
2018 ◽  
Vol 2018 ◽  
pp. 1-9 ◽  
Author(s):  
Ki-Wook Kim ◽  
Sung-Gi Min ◽  
Youn-Hee Han

Making an SDN data plane flexible enough to satisfy the various requirements of heterogeneous IoT applications is very desirable in terms of software-defined IoT (SD-IoT) networking. Network devices with a programmable data plane provide an ability to dynamically add new packet- and data-processing procedures to IoT applications. The previously proposed solutions for the addition of the programmability feature to the SDN data plane provide extensibility for the packet-forwarding operations of new protocols, but IoT applications need a more flexible programmability for in-network data-processing operations (e.g., the sensing-data aggregation from thousands of sensor nodes). Moreover, some IoT models such as OMG DDS, oneM2M, and Eclipse SCADA use the publish-subscribe model that is difficult to represent using the operations of the existing message-centric data-plane models. We introduce a new in-network data-processing scheme for the SD-IoT data plane that defines an event-driven data-processing model that can express a variety of in-network data-processing cases in the SD-IoT environment. Also, the proposed model comprises a language for the programming of the data-processing procedures, while a flexible data-plane structure that can install and execute the programs at runtime is additionally presented. We demonstrate the flexibility of the proposed scheme by using sample programs in a number of example SD-IoT cases.


Author(s):  
Wei Zhang ◽  
Abhigyan Sharma ◽  
Kaustubh Joshi ◽  
Timothy Wood
Keyword(s):  

2022 ◽  
Vol 6 (POPL) ◽  
pp. 1-28
Author(s):  
Matthias Eichholz ◽  
Eric Hayden Campbell ◽  
Matthias Krebs ◽  
Nate Foster ◽  
Mira Mezini

Programming languages like P4 enable specifying the behavior of network data planes in software. However, with increasingly powerful and complex applications running in the network, the risk of faults also increases. Hence, there is growing recognition of the need for methods and tools to statically verify the correctness of P4 code, especially as the language lacks basic safety guarantees. Type systems are a lightweight and compositional way to establish program properties, but there is a significant gap between the kinds of properties that can be proved using simple type systems (e.g., SafeP4) and those that can be obtained using full-blown verification tools (e.g., p4v). In this paper, we close this gap by developing Π4, a dependently-typed version of P4 based on decidable refinements. We motivate the design of Π4, prove the soundness of its type system, develop an SMT-based implementation, and present case studies that illustrate its applicability to a variety of data plane programs.


Repositor ◽  
2020 ◽  
Vol 2 (11) ◽  
pp. 1491
Author(s):  
Muhammad Qaidin Syahputra ◽  
Denar Regata Akbi ◽  
Diah Risqiwati

Software Defined Network (SDN) merupakan paradigma baru dalam manajemen jaringan yang memberikan fasilitas untuk melakukan konfigurasi, virtualisasi, dan mengolah infrasturktur jaringan secara terpusat. Manajemen jaringan secara terpusat dilakukan pada SDN Controller yang dimana memisahkan network data plane dari control functions. Serangan Distributed Denial of Service (DDoS) adalah salah satu permasalahan besar dalam kemanan jaringan yang menyebabkan services yang ada pada jaringan menjadi tidak dapat diakses dalam jangka waktu tertentu. Penelitian ini bertujuan untuk membuat sistem deteksi menggunakan algortima Decision Tree dan mitigasi serangan DDoS dengan metode drop packet pada Software Defined Network. Model klasifikasi yang telah dibangun berdasarkan dataset CICIDS 2017 diterapkan pada controller dan kemudian menjadi pendeteksi serangan DDoS jenis User Data Protocol (UDP). Setiap packet in yang masuk ke dalam controller akan melalui proses pendeteksian sebelum diteruskan kepada destination source, adapun jika packet in terdeteksi sebagai serangan DDoS maka controller akan melakukan fungsi mitigasi drop packet terhadap host yang terbukti melakukan penyerangan. Dari percobaan yang telah dilakukan UDP Flood terbukti menghabiskan banyak network resources dan meningkatkan penggunaan CPU sehingga menyebabkan controller mengalami gangguan berfungsi selama proses penyerangan berlangsung. Hasil penelitian ini menunjukkan bahwa sistem yang dibuat berhasil melakukan proses deteksi dan mitigasi  serangan UDP Flood dengan akurasi sebesar 99.95% dan diikuti proses mitigasi dari setiap paket yang terbukti melakukan penyerangan.   Kata kunci: SDN, CICIDS 2017, UDP Flood, Decision Tree, Drop Packet.


IEEE Access ◽  
2019 ◽  
Vol 7 ◽  
pp. 97296-97306 ◽  
Author(s):  
Takahiro Shimizu ◽  
Naoya Kitagawa ◽  
Kohta Ohshima ◽  
Nariyoshi Yamai

Sign in / Sign up

Export Citation Format

Share Document