Service function chaining (SFC) establishes a service path where a sequence of functions is executed according to service requirements. However, SFC lacks a mechanism to ensure proper traversal of relay nodes in the data plane. Misconfigurations and the presence of attackers can lead to forwarding anomalies and path deviation, potentially allowing packets to bypass security network functions in the service path. To mitigate potential security breaches, ordered proof of transit (OPoT) has been proposed as a mechanism to verify whether traffic adheres to the designated path. In this paper, we realize lightweight OPoT-based path verification based on extended Berkeley Packet Filter (eBPF) for trustworthy SFC. Furthermore, by integrating it with the existing SFC proxy, we extend the proposed approach to accommodate both SFC-aware and SFC-unaware virtual network functions (VNFs) in the segment routing over IPv6 data plane (SRv6) domain. Through experiments, we demonstrate the capability of the proposed approach to detect path deviations. Additionally, we reveal the performance limitations of the proposed approach.

Integrating machine learning (ML) into kernel packet processing, such as extended Berkeley Packet Filter (eBPF) and eXpress Data Path (XDP), represents a promising strategy for achieving fast and intelligent networking on generic hardware. This includes tasks like automating network operations and discerning traffic classification, exemplified by intrusion detection systems (IDS) combining Decision Tree (DT) and eBPF. However, the potential of ML-empowered packet processing remains to be fully explored. To ensure the integrity and security of kernel operations, eBPF/XDP programs must adhere to stringent constraints such as the maximum number of jump instructions, maximum stack space, and exclusion of floating-point arithmetic. These constraints pose challenges for implementing more intricate ML techniques (e.g., neural networks (NNs)) within eBPF/XDP programs. In such scenarios, AF_XDP provides an alternative solution by allowing XDP programs to redirect packets to user-space applications, bypassing the network stack. This paper initiates an exploration into fast packet classification through two distinct approaches: (1) an in-kernel approach employing eBPF/XDP and (2) a user-space approach assisted by AF_XDP. Specifically, to tackle the eBPF constraints, the in-kernel NN classifier adopts (1) quantization of trained model in the user space, (2) executing the integer-arithmetic-only NN within the kernel space, and (3) sequential layer operations through tail calls. These approaches are evaluated based on factors including packet processing speed, resource efficiency, and detection performance. Notably, our experimental findings demonstrate that (1) Classifiers relying solely on integer arithmetic, such as NN and DT, significantly reduce inference time while maintaining binary classification performance; (2) The lightweight NN classifier can improve the detection performance for most of attacks in case of the multi-class classification compared to the lightweight DT classifier; (3) In single-core scenarios, the DT-empowered in-kernel method can almost achieve the maximum packets per second (pps), i.e., about 800,000 pps, whereas the NN-empowered one exhibits lower pps (i.e., about 450,000 pps); (4) In multi-core scenarios, the NN-empowered packet processing can almost achieve the maximum pps with two or more cores in the AF_XDP approach and four or more cores in the in-kernel approaches.

To achieve sustainable networking, network service providers have expressed significant interest in employing automated network operations that integrate network functions virtualization (NFV), software-defined networking (SDN), and machine learning (ML). In the context of NFV/SDN, a certain network service is regarded as a sequence of virtual network functions (VNFs) forming a service chain. The service chaining (SC) problem aims at establishing an appropriate service path from an origin node to a destination node where the VNFs are executed at intermediate nodes in the required order under resource constraints on nodes and links. SDN enables programmable configurations on forwarding devices (i.e., switches and routers) for traffic forwarding between VNFs. In our previous work, we formulated the SC problem as an integer linear program (ILP) based on the capacitated shortest path tour problem (CSPTP), which is an extended version of SPTP with additional node and link capacity constraints. Furthermore, we developed Lagrangian heuristics to solve the problem by considering the balance between optimality and computational complexity. In this paper, we propose a deep reinforcement learning (DRL) framework coupled with the graph neural network (GNN) to realize CSPTP-based SC that adapts to changes of service demand and/or network topology. Numerical results show that the proposed framework achieves nearly optimal SC with higher learning speed compared to the conventional deep Q-Network based approach. Moreover, it performs well when confronted with variations in service demand and exhibits competitive performance compared to the ILP solutions across the majority of 243 real-world topologies.

Network functions virtualization (NFV) realizes diverse and flexible network services by executing network functions on generic hardware as virtual network functions (VNFs). A certain network service is regarded as a sequence of VNFs, called service chain. The service chaining (SC) problem aims at finding an appropriate service path from an origin node to a destination node while executing the VNFs at the intermediate nodes in the required order under resource constraints on nodes and links. The SC problem belongs to the complexity class NP-hard. In our previous work, we modeled the SC problem as an integer linear program (ILP) based on the capacitated shortest path tour problem (CSPTP) where the CSPTP is an extended version of the SPTP with the node and link capacity constraints. We also developed the Lagrangian heuristics to achieve the balance between optimality and computational complexity. In this paper, we further propose a deep reinforcement learning (DRL) framework with the graph neural network (GNN) to realize the CSPTP-based SC adaptive to changes in service demand and/or network topology. Numerical results show that (1) the proposed framework achieves almost the same optimality as the ILP for the CSPTP-based SC and (2) it also works well without retraining even when the service demand changes or the network is partly damaged.

Network functions virtualization (NFV) can flexibly deploy diverse network services by liberating network functions from traditional network appliances and executing them as virtual network functions (VNFs) on generic hardware. A certain network service can be represented by a service chain, which consists of VNFs in required order. The service chaining problem is finding a suitable service path from the origin to the destination such that the VNFs are executed at the intermediate nodes in the required order under the resource constraints, which belongs to the complexity class NP-hard. In our previous work, considering the similarity between the service chaining problem and the shortest path tour problem (SPTP), we formulated the service chaining as the capacitated SPTP (CSPTP) based ILP, where CSPTP is an extended version of the SPTP with the node and link capacity constraints. In this paper, to address both computational complexity and optimality of resource allocation, we propose Lagrangian heuristics to solve the CSPTP-based ILP especially for the online service chaining. Through simulation results, we show that the proposed algorithm almost achieves the optimal resource allocation with much smaller execution time compared with the existing solver, CPLEX.

Network functions virtualization (NFV) is a new paradigm to achieve flexible and agile network services by decoupling network functions from proprietary hardware and running them on generic hardware as virtual network functions (VNFs). In the NFV network, a network service can be modeled as a sequence of VNFs, called a service chain. Given a connection request (e.g., origin, destination, and a sequence of required functions), we have to solve both the service chaining and function placement problems to find an appropriate service path that optimizes the objective (e.g., minimization of the total path delay) while satisfying the service chain requirements. In this article, focusing on the similarity between the service chaining problem and the shortest path tour problem (SPTP) and developing the novel network model called augmented network, we formulate capacitated SPTP-based integer linear programs (ILPs) for the service chaining and function placement. Through numerical results obtained by the existing solver, we show the proposed ILP for the service chaining can support 1.22-1.90 times as large-scale systems as the existing ILP. Furthermore, we also demonstrate that the proposed ILP for both the service chaining and function placement can shorten the total delay by 15.8% compared with that only for the service chaining. For further scalability, we propose a shortest-path-based heuristic algorithm to solve the ILPs and show the heuristic for service chaining and function placement can calculate the optimal solution with high accuracy in strongly polynomial time.

Network functions virtualization (NFV) is a new paradigm to achieve flexible and agile network services by decoupling network functions from proprietary hardware and running them on generic hardware as virtual network functions (VNFs). In the NFV network, a certain network service can be modeled as a sequence of VNFs, called a service chain. Given a connection request (origin node, destination node, and service chain requirement, which is a sequence of functions), the service chaining problem aims to find an appropriate service path, which starts from the origin and ends with the destination while executing the VNFs at the intermediate nodes in the required order. Some existing work noticed that the service chaining problem was similar to the shortest path tour problem (SPTP). To the best of our knowledge, this is the first work that exactly formulates the service chaining problem as an SPTP-based integer linear program (ILP). Through numerical results, we show the SPTP-based ILP can support 1.30-1.77 times larger scale systems than the existing ILP.