This paper presents a distributed and autonomous experimental infrastructure designed to support the execution of cybersecurity experiments and the generation of flow and cloud monitoring datasets. The proposed system enables the execution of diverse and reproducible security experiments across geographically separated institutions with distinct physical and logical infrastructures. The infrastructure integrates real applications and networks to emulate both benign and malicious traffic, supporting the generation of flow-based and cloud-level datasets under varied monitoring configurations. Through collaborative deployment at two universities in Brazil, the proposed testbed shows its adaptability and scalability across multiple environments. The experimental results demonstrate that monitoring intervals ranging from 5 to 10 s achieve an effective balance between the detection performance of machine learning models for malicious activities in cloud services and the operational costs associated with network and cloud monitoring, maintaining high classification accuracy across diverse attack types. The generated datasets provide a consistent basis for evaluating monitoring strategies and developing data-driven detection models in cloud-native environments.

Innovative traffic engineering functions and services require disrupting routing and forwarding mechanisms to be performed with low overhead over complex network topologies. Source routing (SR) is a prominent alternative to table-based routing for providing the needed expressiveness and agility by reducing the number of network states. This work proposes the M-PolKA, a topology-agnostic multipath source routing scheme and orchestration architecture for reliable communications, which explores special properties from the Residue Number System (RNS) polynomial arithmetic. A P4-based proof-of-concept is experimentally demonstrated using emulated and hardware prototypes. Also, use cases for revealing M-PolKA’s functionalities are tested in different scenarios in order to address problems, such as communication reliability improvement, agile path migration and fast failure reaction. Finally, low overhead for extra functionalities is observed when RNS-based SR is compared to traditional routing approaches.

Network slicing is the 5G research field that addresses the services requirements compliance over the same network. In order to robustly and securely manage the different slices in a network, we propose to use blockchain, a distributed structure that stores data without the need of an external entity to ensure data integrity and reliability. In this paper, we present a proposal on deploying a network slicing solution for Non-Public Networks (NPNs) in health environments using blockchain technology. Our solution aims to provide both performance isolation over wireless networks and privacy.

Network Function Virtualization (NFV) ambitiously aims at shifting functionalities from proprietary hardware to commodity servers as well as providing a common platform for the consolidation of network management. In practice, however, network architects have not massively subscribed to NFV so far. One possible reason for the slow adoption of NFV is the trade-off between commoditization and end-to-end performance in core networks. On the other hand, the ever-increasing disparity between bandwidth requirements and computing power is already pushing network architects toward NFV. By using innetworking processors to co-execute parts of tenant's applications in the cloud, it is possible to offload packet processing tasks. We can also save end-host server CPU cores, while achieving lower latency for service requests. However, applications with an in-networking processor bring two main challenges: flexible programmability and manageable offloading constraints. This work proposes PIaFFE: a framework that uses P4 language for decomposing and deploying Virtual Network Functions (VNFs) into small embedded Network Functions (eNFs) on in-network processors. Our key contribution is allowing the correct balance between hardware capabilities from a programmable NIC, and the flexibility of traditional VNFs on vCPUs. It is only made possible by a novel multi-level chaining scheme in PIaFFE. An experimental use case focuses on the chaining of three eNFs and multi-tenant ready hypervisor, where the percentage of packet processing sharing with a VNF is varied for one of them. As a result, the appropriate offload factor can be found for different traffic conditions for either maximum throughput or minimum latency.

Source routing (SR) is a prominent alternative to table-based routing for reducing the number of network states. However, traditional SR approaches, based on Port Switching, still maintain a state in the packet by using a header rewrite operation. The residue number system (RNS) is a promising way of executing fully stateless SR, in which forwarding decisions at core nodes rely on a simple modulo operation over a route label. Nevertheless, such operation over integer arithmetic is not natively supported by commodity network hardware. Thus, we propose a novel RNS-based SR scheme, named PolKA, that explores binary polynomial arithmetic using Galois field (GF) of order 2. We evaluate PolKA in comparison to Port Switching by implementing emulated and hardware prototypes using P4 architecture. Results show that PolKA can achieve equivalent performance, while providing advanced routing features, such as fast failure reaction and agile path migration.

The introduction of Next Generation Networks (NGN) has changed significantly the network service model. Vertical structures that are designed to each type of access have been replaced by horizontal structures. However, the service architecture has to be rebuilt to support the required agility within the horizontal structures. Our proposal, named SANGN, is based on a full integration of Open Services Gateway Initiative (OSGi) with Java Agent DEvelopment (JADE) framework for providing multimedia services of IP Multimedia Subsystem (IMS). We have introduced a Televote service as a use case in order to validate the SANGN architecture ensuring the massive scalability of these services to meet the stringent multimedia requirements. Our implementation is able to adapt with a high dynamic load of the system, making use of a minimal set of computational resources seamlessly for the clients, providing IMS core components in the network infrastructure.

Software Defined Infrastructure (SDI) has become a relevant topic for computing and communication industry. Despite this huge technological movement, Network and Systems Management has been disregarded as one of the main themes in this ecosystem, and Software Defined Infrastructure has been managed by semi-software-defined management solutions. In order to reduce this gap, this paper presents SDMan, a Software Defined Management framework. The SDMan's proof of concept uses the OpenStack cloud platform and aims to demonstrate the feasibility of the proposed solution.

Service Providers (SP) have deployed virtualized network functions (VNFs) as key elements for handling traffic in the SP domain. Packets are steered to follow a certain order through a set of VNFs before reaching their destination. The provision of such chaining is called Service Function Chaining (SFC). However, current SFC implementations require complex management and are tailored to specific platforms or devices. In this paper, we propose PhantomSFC, a fully virtualized SFC architecture that aims to clearly decouple the service plane from the underlying network. The approach enables SFC to be network agnostic, allowing it to be deployed in multiple scenarios. Besides, SPs can scale resources allocated to SFC execution according to service demands. A proof-of-concept (PoC) prototype of the PhantomSFC architecture is built as a DPDK application to demonstrate the feasibility of our approach. Results show it can handle SFC operation with reasonable performance, considering latency, jitter, and throughput.

With the evolution of the processing capacity of the network devices and the appearing of novel programmable network hardware, new methods and techniques for traffic monitoring have been proposed. Among these new techniques, the use of sketches has been increased. Sketches are probabilistic data structures capable of summarizing information about the network with two main advantages over flow-based counters: low memory usage and adjustable accuracy. Considering this scenario, this paper proposes the use of probabilistic data structures implemented in P4 (Programming Protocol-Independent Packet Processors) to monitor multi-tenant networks. While it is common to see similar solutions for monitoring non-shared networks, as far as we know this is the first work that deals multitenant scenarios. We implemented sketches for each tenant so that an isolated network monitoring can be done. The solution, named BitMatrix, was created taking into account two probabilistic structures: bitmaps and counter-arrays.

Datacenter (DC) design has been moved toward the edge computing paradigm motivated by the need of bringing cloud resources closer to end users. However, the software defined networking (SDN) architecture offers no clue to the design of micro DCs (MDCs) for meeting complex and stringent requirements from next generation 5G networks. This is because canonical SDN lacks a clear distinction between functional network parts, such as core and edge elements. Besides, there is no decoupling between the routing and the network policy. In this paper, we introduce residue defined networking architecture (RDNA) as a new approach for enabling key features like ultra-reliable and low-latency communication in MDC networks. RDNA explores the programmability of residues number system as a fundamental concept to define a minimalist forwarding model for core nodes. Instead of forwarding packets based on classical table lookup operations, core nodes are tableless switches that forward packets using merely remainder of the division (modulo) operations. By solving a residue congruence system representing a network topology, we found out the algorithms and their mathematical properties to design RDNA's routing system that: 1) supports unicast and multicast communication; 2) provides resilient routes with protection for the entire route; and 3) is scalable for 2-tier Clos topologies. Experimental implementations on Mininet and NetFPGA SUME show that RDNA achieves 600 ns switching latency per hop with virtually no jitter at core nodes and sub-millisecond failure recovery time.

Edge Data Centres (EDC) are often managed by a single administrative entity with logically centralized control. The architectural split of control and data planes and the new control plane abstractions have been touted as Software-Defined Networking (SDN), where the OpenFlow protocol is one common choice for the standardized programmatic interface to data plane devices. However, in the design of an SDN architecture, there is no clear distinction between functional network parts such as core and edge elements. It means that all switches require to support lookups over hundreds of bits with complex actions that have to be specified by multiple tables. In this paper, we propose a new programmable architecture for EDC networks, named Residues Defined Networks (RDN). In RDN, a controller defines a network policy (e.g. connectivity protection) setting flow entries at the edges. Based on these entries, the edge switches assign routeIDs to flows. A route is defined as the remainder of the division (Residue) between a route-ID and a set of switch-IDs within RDN core. In case of failures, emergency routes are compactly encoded as programmable residues forwarding paths written into the packets. RDN scalability is evaluated considering 2-tier Clos topologies which cover mostly EDC deployments supporting up to 2304 servers. A RDN proof-of-concept prototype is implemented in Mininet for network emulation. Also, to increase the accuracy on latency measures, we implement RDN in NetFPGA that is validated in a testbed with 10Gbps Ethernet boards. RDN offers ultra-fast failure recovery (sub-milliseconds carrier grade), achieves low latency with RDN switching time per hop (≈0.6μs) and no jitter within the RDN core.

Emerging paradigms, such as edge computing, require the geographical distribution of small-scale data centers that will use network functions virtualization (NFV) to provide new services with stringent demands related to throughput, latency, cost, innovation, and efficient orchestration. To tackle these demands, this paper proposes VirtPhy, a fully programmable architecture for NFV orchestration in edge data centers, based on server-centric topologies, software-defined networking, software switches, distributed service chaining, and source routing. A proof-of-concept is implemented in a data center testbed using OpenStack cloud platform in a hypercube topology. The results show its orchestration mechanisms can efficiently provision NFV service requests by steering traffic through a sequence of virtualized network functions in a server-centric topology.

Content Centric Networking (CCN) represents an important change in the current operation of the Internet, prioritizing content over the communication between end nodes. Routers play an essential role in CCN, since they receive the requests for a given content and provide content caching for the most popular ones. They have their own forwarding strategies and caching policies for the most popular contents. Despite the number of works on this field, experimental evaluation of different forwarding algorithms and caching policies yet demands a huge effort in routers programming. In this paper we propose SDCCN, a SDN approach to CCN that provides programmable forwarding strategy and caching policies. SDCCN allows fast prototyping and experimentation in CCN. Proofs of concept were performed to demonstrate the programmability of the cache replacement algorithms and the Strategy Layer. Experimental results, obtained through implementation in the Mininet environment, are presented and evaluated.

This paper introduces and evaluates a Traffic Sign Management Architecture (TSMA), which represents a paradigm shift for the deployment of traffic sign infrastructure in the context of Intelligent Transport Systems, Vehicular Networks and Smart Cities. The proposal addresses limitations of the current traffic control model by enabling remote updates of traffic signs and displaying them on the vehicular navigation system display to improve their legibility. TSMA is an architecture developed to provide V2I interaction using a commodity technology, Wi-Fi, through the beacon-stuffing technique. The initial design of TSMA's security mechanisms is also presented in this paper. Evaluations were performed on a developed prototype and simulation environments.

Software Defined Networking (SDN) is a promising architectural approach based on a programmatic separation of the control and data planes. For high availability purposes, logically centralized SDN controllers follow a distributed implementation. While controller role features in the OpenFlow protocol allow switches to communicate with multiple controllers, these mechanisms alone are not sufficient to guarantee a resilient control plane, leaving the actual implementation as open challenge for SDN designers. This paper explores OpenFlow roles for the design of resilient SDN control plane and proposes AR2C2 as an actively replicated multi-controller strategy. As proof of concept, AR2C2 is implemented based on the Ryu controller and relying on OpenReplica to ensure consistent state among the distributed controllers. Our prototype is experimentally evaluated using real commodity switches and Mininet emulated environment. Results of the measured times to recover from failures for different workloads shed some light on the practical trade-offs on replication overhead and latency as a step forward towards SDN resiliency.

The information society is facing a sharp increase in the amount of information driven by the plethora of new applications that sprouts all the time. The amount of data now circulating on the Internet is over zettabytes (ZB), resulting in a scenario defined in the literature as Big Data. In order to handle such challenging scenario, the deployed solutions rely not only on massive storage, memory and processing capacity installed in Data Centers (DC) maintained by big players all over the globe, but also on shrewd computational techniques, such as Big Table, MapReduce and Dynamo. In this context, this work presents a DC structure designed to support the similarity search. The proposed solution aims at concentrating similar data on servers physically close within a DC, accelerating the recovery of all data related to searches performed using a primitive get(k, sim), in which k represents the query identifier, i.e., the data used as reference, and sim a similarity level.

The semantic meaning of a content is frequently represented by content vectors in which each dimension represents an attribute of this content, such as, keywords in a text, colors in a picture or profile information in a social network. However, one important challenge in this semantic context is the storage and retrieval of similar contents, such as the search for similar images assisting a medical procedure. Based on it, this paper presents a new Distributed Hash Table (DHT), called Hamming DHT, in which Locality Sensitive Hashing (LSH) functions, specially the Random Hyperplane Hashing (RHH), are used to generate content identifiers, propitiating a scenario in which similar contents are stored in peers nearly located in the indexing space of the proposed DHT. The evaluations of this work simulate profiles in a social network to verify if the proposed DHT is capable of reducing the number of hops required in order to improve the recall in the context of a similarity search.

In literature, there are several methods to measure similarity between concepts in structures like simple ontologies, concept hierarchies, taxonomies, etc. These measures are used to search for similar concepts. In the Semantic Web, such structures are commonly used to classify data which opens the possibility of reasoning upon them and helps in conceptual searches. Besides that, the Locality Sensitive Hash (LSH) functions are used to store similar data close to each other in an index space. Each family of LSH functions is tied to a specific similarity function. In this paper we propose a method for combining the idea of conceptual similarity with LSH functions. This method permits the data classified as similar concepts be indexed close to each other respecting some metric. The main idea is to facilitate the conceptual searching for data semantically classified. This paper evaluates several methods of measuring the similarity between concepts in a simple ontology and discusses how they can be applied to an LSH function.

The current internetworking architecture presents some limitations to naturally support mobility, security and multi- homing. Among the limitations, the IP semantic overload seems to be a primary issue to be considered. In this paper we present a next generation internetworking architecture to overcome the IP semantic overload by introducing an identity layer located between the network and transport layers. This new layer provides a stable cryptographic identifier for end-hosts and seamlessly allows the deployment of new services, such as mobility, multi-homing and security. A prototype was implemented and evaluated considering some mobility scenarios, including intra-domain, inter-domain and simultaneous node mobility.