International audience

International audience

In recent years, computer networks and telecommunications in general have been shifting paradigms to adopt software-centric approaches. Software Defined Networking (SDN) is one of such paradigms that centralizes control and intelligent applications can be defined on top of this architecture. In the literature, diverse software-based applications exist, focusing on finding either the shortest paths, balancing the traffic, and others. However, they do not consider the potentially different level of security of links in the network. In this work, we propose an approach for Flow Admission and Routing under Minimal Security Constraints (FARSec) in Software Defined Networks, where network flows must use links which are at least as secure as their required security level. We prove that FARSec can find feasible paths respecting the minimum level of security for each flow. If the latter is not possible FARSec rejects the flow in order not to compromise its security. We show that the computational complexity of the proposed approach is polynomial. Experimental results with semi-random generated graphs confirm the efficiency and correctness of the proposed approach. Finally, we implement the proposed solution using OpenFlow and ONOS – an SDN open-source controller. We validate its functionality using an emulated network with various security levels.

8 pages, as submitted to the 17th International Conference on Evaluation of Novel Approaches to Software Engineering

We present a novel formalism for describing the evolution of dynamic-link network parameters; it is based on the Cellular Automaton (CA) model. Such formalism is of wide-use for modeling natural (e.g., physical, chemical, etc.) processes. We propose a particular model and survey the related work, with respect to the use of CA to simulate various communication networks. We showcase the flexibility of the proposed approach to model different evolution patterns. These patterns can be used to emulate / simulate different network scenarios (states of the network parameters), and test novel implementations under distinct conditions. Additionally, we propose an algorithm for guaranteeing that the described patterns hold properties of interest, within a bounded time.

Software Defined Networking (SDN) is a novel network management technology, which currently attracts a lot of attention due to the provided capabilities. Recently, different works have been devoted to testing / verifying the (correct) configurations of SDN data planes. In general, SDN forwarding devices (e.g., switches) route (steer) traffic according to the configured flow rules; the latter identifies the set of virtual paths implemented in the data plane. In this paper, we propose a novel preventive approach for verifying that no misconfigurations (e.g., infinite loops), can occur given the requested set of paths. We discuss why such verification is essential, namely, how, when synthesizing a set of data paths, other not requested and undesired data paths (including loops) may be unintentionally configured. Furthermore, we show that for some cases the requested set of paths cannot be implemented without adding such undesired behavior, i.e., only a superset of the requested set can be implemented. Correspondingly, we present a verification technique for detecting such issues of potential misconfigurations and estimate the complexity of the proposed method; its polynomial complexity highlights the applicability of the obtained results. Finally, we propose a technique for debugging and repairing a set of paths in such a way that the corrected set does not induce undesired paths into the data plane, if the latter is possible.

This paper proposes a novel framework to predict traffic flows' bandwidth ahead of time. Modern network management systems share a common issue: the network situation evolves between the moment the decision is made and the moment when actions (countermeasures) are applied. This framework converts packets from real-life traffic into flows containing relevant features. Machine learning models, including Decision Tree, Random Forest, XGBoost, and Deep Neural Network, are trained on these data to predict the bandwidth at the next time instance for every flow. Predictions can be fed to the management system instead of current flows bandwidth in order to take decisions on a more accurate network state. Experiments were performed on 981,774 flows and 15 different time windows (from 0.03s to 4s). They show that the Random Forest is the best performing and most reliable model, with a predictive performance consistently better than relying on the current bandwidth (+19.73% in mean absolute error and +18.00% in root mean square error). Experimental results indicate that this framework can help network management systems to take more informed decisions using a predicted network state.

This paper proposes a novel admission and routing scheme which takes into account arbitrarily assigned priorities for network flows. The presented approach leverages the centralized Software Defined Networking (SDN) capabilities in order to do so. Exact and heuristic approaches to the stated Priority Flow Admission and Routing (PFAR) problem are provided. The exact approach which provides an optimal solution is based on Integer Linear Programming (ILP). Given the potentially long running time required to find an exact and optimal solution, a heuristic approach is proposed; this approach is based on Genetic Algorithms (GAs). In order to effectively estimate the performance of the proposed approaches, a simulator that is capable of generating semi-random network topologies and flows has been developed. Experimental results for large problem instances (up 50 network nodes and thousands of network flows), show that: i) an optimal solution can be often found in few seconds (even milliseconds), and ii) the heuristic approach yields close-to-optimal solutions (approximately 95% of the optimal) in a fixed amount of time; these experimental results demonstrate the pertinence of the proposed approaches.

In this paper, a novel model-based approach to verify dynamic networks is proposed. The network topology and dynamic link parameters are described as a many sorted first order logic formula, that is verified by an SMT-solver (z3 in our case) with respect to a set of properties. The formula is also used for run-time network verification when a given static network instance is implemented. Preliminary experiments showcase the expressiveness and current limitations of the proposed approach.

The paper presents a work in progress on the Quality of Experience (QoE) assessment in the context of Software Defined Networking (SDN). Preliminary experimental results clearly demonstrate the necessity of considering QoE parameters, which are not taken into account in traditional networks. Dynamic network (re-) configuration requires monitoring and measuring attributes not only at the network level but also at the control and application planes. We discuss a list of such parameters and propose a monitoring algorithm to consider distributed and asynchronous points of observation for the QoE assessment of SDN network services. Further, for the cases when a low QoE level is detected (or predicted using machine learning), we propose an algorithm for effective diagnosis of the QoE degradation, based on an iterative deduction of a QoE attribute contributing the most to a low QoE value.

In Software Defined Networking (SDN), different applications may configure different coexisting forwarding rules, the resulting (running) data-paths a specific network flow traverses may not be the intended ones. Furthermore, the SDN components may be defective or compromised. In order to provide reliable communication within the SDN driven data-planes, assuring that the running data-paths are the requested (and expected) ones is necessary. In this paper, we propose an approach that relies on distributed traffic generation and monitoring to identify the running data-paths in a given SDN driven data-plane. We show that differently from the existing approaches, under certain assumptions, there exist necessary and sufficient conditions for formally guaranteeing that all running datapaths are discovered using our approach. A data-path discovery toolkit has been implemented using the proposed approach. We describe the corresponding set of tools, and showcase the obtained experimental results that reveal inconsistencies in well-known SDN applications. Additionally, we show the scalability of our approach.

International audience

International audience

International audience

International audience

International audience

This paper is devoted to study the use of 'gedanken' experiments with Finite State Machines (FSMs) for protocol passive testing optimization. We discuss how the knowledge obtained from the state identification of an implementation under test (IUT) can be utilized for effective IUT monitoring. Differently from active testing techniques, such identification is performed by only observing the IUT behavior. If the state identification is possible (at least partially), then this fact allows to reduce the number of properties (test purposes) to be checked at certain execution point(s). Correspondingly, this allows to simplify and/or accelerate, i.e. improve the monitoring process by verifying the system behavior only at critical states against the appropriate set of properties associated with a given state. The paper discusses which 'gedanken' experiments can be considered for this purpose and how they can be derived for various specifications of communication protocols. The results presented in the paper are followed by an illustrative protocol example that demonstrates the efficiency of the proposed approach.

Collaborative systems are growing in use and in popularity. The need to boost the methods concerning the interoperability is growing as well, therefore, trustworthy interactions of the different systems are a priority. We have proposed a formal distributed network monitoring approach to analyze the packets exchanged by the entities, in order to prove a system is acting in a trustworthy manner. Using this approach, some limitations regarding the testers resources have been found. In this paper, we identify the constraints and propose and new language suited for testing at runtime in different environments.

International audience

As the Digital Ecosystems are growing in use and in popularity, the need to boost the methods concerned by their interoperability is growing as well; making thus trustworthy interactions of the different agents (e.g., network systems) a priority. In our work, we focus on "soft trust", that is trust management systems that can be based on experience and reputation. Each trust system defines how they evaluate the trustee experience. The observations of the trustee behaviors are added to the trustee experience. Furthermore, most of the works dedicated to trust estimations in different kinds of ecosystems are based on local observations through monitored entities. No formal approaches have been defined for distributed monitored elements by considering several points of observations. This is what we intend in this work. We propose to use distributed network monitoring techniques to analyze the packets that the truster and trustee exchange in order to prove the trustee is acting in a trustworthy manner. A formal approach is defined to express trust properties and to evaluate them on real execution traces. Our approach is applied on DNS traces for assessing the trust among the entities.

There is an increasing demand for computing systems composed by heterogeneous computers, connected by different types of networks, and that allow for accessing a wide range of services in a seamless way. Some of those computers are mobile or embedded and have limited resources, and can be overloaded when trying to handle their users demands. Then it is not possible to ensure a proper behaviour of the running applications. This can be an important problem when dealing with critical events in healthcare, home surveillance, or forest monitoring. Resource reservation is a valid basis for handling this issue. It allows for guaranteeing a certain resource share for applications that are important for the proper behavior of a given system. This paper describes an implementation of a resource management component and its integration in the Linux kernel. This piece of software has allowed to assign CPU budgets to standard Java threads, which is an important facility, given the widespread of this programming language. This implementation has been validated on service oriented middleware, where relevant services are executed by thread with guaranteed budget, to improve its predictability.

In this paper, a framework for testing microprocessor prototypes is presented. A RISC microprocessor is designed by students using VHDL language and adapted to be implemented on a FPGA device. The correct behaviour of the designed microprocessor is checked executing test programs written and compiled by the students for this microprocessor. Using a Web client, users send test programs and a file with the design to a remote laboratory where it is loaded on a real FPGA device. A set of tools for debugging the remote execution of the tests has been developed, using a graphical interface similar to other debugging tools. Groups of selected students of a computer architecture course have participated in this experience. The good opinions received from the students, suggest the incorporation of this remote laboratory experience in the next regular course.