Runtime verification is critical for detecting whether programmable networks behave as intended during operation. However, many existing runtime verification mechanisms instantiate executable verification logic around requirements specified before deployment, making it difficult to change checks at runtime. This paper presents Chameleon, a runtime-pluggable verification mechanism for programmable networks. Chameleon separates a stable verification substrate from concrete verification requirements: the verification substrate is embedded into the data plane before deployment, while requirements are represented as runtime-manageable VERIFY objects and translated into P4Runtime table entries, allowing the operator to add, modify, or delete supported verification types without recompiling the data-plane program. Experimental results show that Chameleon can augment P4 programs with small one-time preprocessing and compilation overheads, and supports millisecond-level runtime configuration operations for verification requirements.

Modern decentralized deep learning methods for network intrusion detection in Software-Defined Networking (SDN)-enabled Industrial Internet of Things (IIoT) environments encounter significant challenges, particularly for IIoT data heterogeneity and privacy leakage. To this end, we propose a novel framework for network intrusion detection, dubbed SFLNID, that improves Federated Learning (FL) to ensure both efficient training and privacy preservation in SDN-enabled IIoT. Specifically, we firstly design joint optimization mechanism for unbalanced and non-IID data, which introduces a Focal loss as the loss function, and leverages the Wasserstein distance between global and local models as the regularization term. In addition, we improve adaptive differential privacy with dynamic gradient clipping techniques, adjusting the clip-threshold based on Holt exponential smoothing to achieve privacy protection during the local model training. Moreover, we develop a customized CNN-GRU model tailored for FL-based network intrusion detection to make a tradeoff between model accuracy and overheads. Theoretical analysis confirms the convergence and privacy guarantees of SFLNID. Extensive experiments, conducted on well-known IIoT datasets including ToN-IoT, RT-IoT and Edge-IIoT, demonstrate that SFLNID outperforms the state-of-the-art methods in terms of detection accuracy, communication overhead, and cooperative privacy preservation.

In 5G networks with SDN architecture, the traffic explosion and the rising of diverse service requirements lead to many challenges for 5G core networks on flexibility and scalability. In order to achieve high-speed forwarding of traffic and diversified transmission requirements in the 5G era, combined with SDN and Segment Routing, we propose a scalable flow forwarding scheme called Segment Routing based on Path Aggregation and Rule sharing (PARS-SR) to solve SDN switch flow table resource shortage problem. Traditional OpenFlow-based or MPLS-based flow forwarding scheme may lead to performance degradation due to flow-table overflowed or heavy MPLS label load incurred. PARS-SR exploits SDN, Segment Routing and intelligent path encoding algorithm to achieve a trade-off between flow table resource and MPLS label load. The proposed PARS-SR can learn the flow path information online to implement path aggregation and rule sharing by aggregating a large number of flows into a small number of flow entries based on the coincidence degree of the flow path. To find the optimal flow path aggregation scheme, we present an intelligent encoding algorithm to maximize the overall cost saving. The simulation results show that PARS-SR can effectively reduce both the number of flow entries and the MPLS label load of the packet.

Despite the critical role that middleboxes play in introducing new network functionality, management and innovation of them are still severe challenges for network operators, since traditional middleboxes based on hardware lack service flexibility and scalability. Recently, though new networking technologies, such as network function virtualization (NFV) and software-defined networking (SDN), are considered as very promising drivers to design cost-efficient middlebox service architectures, how to guarantee transmission efficiency has drawn little attention under the condition of adding virtual service process for traffic. Therefore, we focus on the service deployment problem to reduce the transport delay in the network with a combination of NFV and SDN. First, a framework is designed for service placement decision, and an integer linear programming model is proposed to resolve the service placement and minimize the network transport delay. Then a heuristic solution is designed based on the improved quantum genetic algorithm. Experimental results show that our proposed method can calculate automatically the optimal placement schemes. Our scheme can achieve lower overall transport delay for a network compared with other schemes and reduce 30% of the average traffic transport delay compared with the random placement scheme.