A Sophisticated Packet Forwarding Scheme with Deep Packet Inspection in an OpenFlow Switch

Cho, Choong-Hee; Lee, JungBok; Kim, Eun-Do; Ryoo, Jeong‐dong

doi:10.1109/icsn.2016.7501921

Cited by 10 publications

(8 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The DPI placed at the data link layer may sound applicable for efficient packet forwarding at line rate, but it should be noted that it partially violates the principle of SDN, in which Open-Flow switches are only capable of dispatching packets without any built-in application-aware intelligent logic. ChoongHee Cho et al [15] pay attention to payload information in the packets rather than only utilizing header information for packet classification. They propose a sophisticated packet forwarding scheme by implementing a DPI module in a virtual OpenFlow switch associated with a monitoring application.…”

Section: Related Workmentioning

confidence: 99%

“…In particular, [11]- [13] extend the SDN architecture to redirect traffic to the specified DPI proxies. Apart from traffic redirection to DPI proxies, some researches [14], [15] turn their eyes on developing DPI modules in OpenFlow switch (OvS) to avoid additional routing hop. Nevertheless, enabling application-aware functionality in the data plane will result in dramatic performance degeneration in network nodes, whose QoS demands can no longer be guaranteed [16].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Machine Learning based Malicious Payload Identification in Software-Defined Networking

Cheng¹,

Wu²,

Zhou³

et al. 2021

Preprint

View full text Add to dashboard Cite

Deep packet inspection (DPI) has been extensively investigated in software-defined networking (SDN) as complicated attacks may intractably inject malicious payloads in the packets. Existing proprietary pattern-based or port-based third-party DPI tools can suffer from limitations in efficiently processing a large volume of data traffic. In this paper, a novel OpenFlow-enabled deep packet inspection (OFDPI) approach is proposed based on the SDN paradigm to provide adaptive and efficient packet inspection. First, OFDPI prescribes an early detection at the flow-level granularity by checking the IP addresses of each new flow via OpenFlow protocols. Then, OFDPI allows for deep packet inspection at the packet-level granularity: (i) for unencrypted packets, OFDPI extracts the features of accessible payloads, including tri-gram frequency based on Term Frequency and Inverted Document Frequency (TF-IDF) and linguistic features. These features are concatenated into a sparse matrix representation and are then applied to train a binary classifier with logistic regression rather than matching with specific pattern combinations. In order to balance the detection accuracy and performance bottleneck of the SDN controller, OFDPI introduces an adaptive packet sampling window based on the linear prediction; and (ii) for encrypted packets, OFDPI extracts notable features of packets and then trains a binary classifier with a decision tree, instead of decrypting the encrypted traffic to weaken user privacy. A prototype of OFDPI is implemented on the Ryu SDN controller and the Mininet platform. The performance and the overhead of the proposed sulotion are assessed using the real-world datasets through experiments. The numerical results indicate that OFDPI can provide a significant improvement in detection accuracy with acceptable overheads.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Machine Learning based Malicious Payload Identification in Software-Defined Networking

Cheng¹,

Wu²,

Zhou³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Switch software enhancements: A further alternative to extend monitoring in the switch is to extend the switch software to include advanced analysis functionality [4,10,15,25,34,37]. However, performance evaluations of these approaches have shown considerable overhead and impact on the performance of the switch's main task -packet forwarding.…”

Section: Application Monitoring Using Sdnmentioning

confidence: 99%

“…Thus, there are concerns on the adoption of these approaches in practice. Specifically, the authors of [4] extend the Open-Flow architecture to be able to inspect the payload of the packets by inserting a set of predefined string patterns into the switch. Mekky et al [25] augment SDN switches with application processing logic defined in a table called application table.…”

Section: Application Monitoring Using Sdnmentioning

confidence: 99%

See 1 more Smart Citation

Enabling efficient application monitoring in cloud data centers using SDN

Elsaadawy¹,

Kemme²,

Younis³

2019

Preprint

View full text Add to dashboard Cite

Software Defined Networking (SDN) not only enables agility through the realization of part of the network functionality in software but also facilitates offering advanced features at the network layer. Hence, SDN can support a wide range of middleware services; network performance monitoring is an example of these services that are already deployed in practice. In this paper, we exploit the use of SDNs to efficiently provide application monitoring functionality. The recent rise of complex cloud applications has made performance monitoring a major issue. We show that many performance indicators can be inferred from messages exchanged among application components. By analyzing these messages, we argue that the overhead of performance monitoring could be effectively moved from the end hosts into the SDN middleware of the cloud infrastructure which enables more flexible placement of logging functionality. This paper explores several approaches for supporting application monitoring through SDN. In particular, we combine selective forwarding in SDN to enable message filtering and reformatting, and propose a customized port sniffing technique. We describe the implementation of the approach within the standard SDN software, namely OVS. We further provide a comprehensive performance evaluation to analyze advantages and disadvantages of our approach, and highlight the trade-offs.

show abstract

An Extended SDN Architecture for Video-on-Demand Caching

Chiang,

2024

Mobile Netw Appl

View full text Add to dashboard Cite

A Sophisticated Packet Forwarding Scheme with Deep Packet Inspection in an OpenFlow Switch

Cited by 10 publications

References 9 publications

Machine Learning based Malicious Payload Identification in Software-Defined Networking

Machine Learning based Malicious Payload Identification in Software-Defined Networking

Enabling efficient application monitoring in cloud data centers using SDN

An Extended SDN Architecture for Video-on-Demand Caching

Contact Info

Product

Resources

About