ABSTRACT With the rapid development of software‐defined networking (SDN), the single‐controller architecture is unable to meet the performance and reliability requirements of the whole system. Consequently, a distributed multicontroller architecture has been proposed, in which the number and locations of controllers must be determined rigorously, formulating the controller placement problem (CPP). In order to solve the CPP by optimizing the propagation latency, we propose a convolutional node embedding and K‐means algorithm (CNEKA), which integrates information propagation among adjacent nodes and calculation of embedding vectors by graph convolutional networks (GCNs) with the graph segmentation by K‐means algorithm. As far as we know, we are the first paper to apply GCN to solving CPP. The study demonstrates that the CNEKA algorithm significantly enhances performance in optimizing average and worst‐case latency between controllers and switches, as well as the propagation latency of the whole network, in varied experimental conditions. CNEKA achieves up to a 64.18% reduction in propagation latency when compared to other algorithms, and maintains a high stability with a fluctuation less than 7.6% when repeating the same experiments for several times. Moreover, CNEKA can always find the optimal or near‐optimal solution with an error less than 11.15% when compared with the global optimal solution.

With the growing sophistication of cyber threats, IDSs (Intrusion Detection Systems) have become increasingly crucial for network security. However, current ViT (Vision Transformer)-based methods often fail to capture subtle local attack patterns, while existing image-based approaches typically generate static representations that cannot effectively model temporal relationships in network traffic. To address these limitations, we propose SCV-IDS (Serialized Traffic Images, CNN, and ViT-Intrusion Detection System), a novel IDS featuring: (1) a dual-branch CNN-ViT architecture with cross-attention mechanism that simultaneously captures local anomalies and global attack patterns while enabling deep feature fusion; (2) a serialized 24-bit RGB encoding scheme with sliding windows that preserves spatiotemporal relationships in network traffic. Extensive experiments on the UNSW-NB15 dataset demonstrate SCV-IDS’s superior performance, achieving 85.77% accuracy and 84.59% F1 in multiple classification, outperforming state-of-the-art methods by up to 7.37% and 6.59%, respectively. Cross-dataset evaluation on CIC-IDS2017 further validates its generalization capability, with 99.81% accuracy for multi-class classification. The framework’s exceptional spatiotemporal learning capability, combined with its ability to effectively integrate local anomaly detection and global pattern recognition, makes it particularly powerful for identifying sophisticated attacks in modern network environments.

This paper presents MAT4PM, a P4-based proactive monitoring framework designed for Software-Defined Networking (SDN). This is the first monitoring framework that combines Programmable Data Plane (PDP) capabilities for event-driven data collection with control plane intelligence for real-time threshold optimization. The architecture consists of a lightweight P4-based monitoring module deployed at the switch, a Machine Learning (ML) inference engine running at the controller, and a P4Runtime feedback channel for real-time threshold updates. Traffic features are leveraged to predict optimal monitoring thresholds, which are then synchronized with the data plane. A composite cost function is introduced to jointly consider monitoring error and communication overhead, guiding the model toward a balanced trade-off between accuracy and efficiency. Experimental evaluation on BMv2 software switches demonstrates that, compared to static threshold strategies, MAT4PM reduces monitoring error to 7.0% and achieves a 5.6% reduction in overall cost, while maintaining sub-millisecond inference latency and minimal resource consumption. These results demonstrate the practical viability and scalability of MAT4PM in SDN environments.

In-band Network Telemetry (INT) has emerged as a promising solution for fine-grained, real-time monitoring in programmable data planes. However, existing INT approaches often incur excessive overhead due to per-hop metadata accumulation or lack fine-grained control over telemetry frequency. This paper presents TT-INT, a lightweight INT framework designed for P4-enabled networks, which introduces a time-threshold-based mechanism to regulate telemetry insertion dynamically. Each switch enforces local constraints based on per-flow time intervals and metadata capacity, enabling reduced overhead while preserving path visibility. Additionally, TT-INT supports a two-window byte-level anomaly detector and a controller-driven adjustment mechanism for further extensibility. Experiments on a real-worldderived backbone topology demonstrate that TT-INT reduces the average per-packet telemetry overhead to as low as 3.4 bytes under the 100 ms/5v configuration at 300 pps, achieving a 97.1% reduction compared to P4-INT under the same traffic rate. Compared to DLINT-5v and PLINT-5v (fixed at 20 and 26 bytes per packet, respectively), TT-INT-5v-100ms achieves up to 83.0% and 86.9% lower overhead. It also reaches a maximum path update detection rate of 97.9% (under the 50 ms configuration) and a minimum detection delay of 0.2 seconds, confirming TT-INT's effectiveness in balancing overhead, responsiveness, and monitoring fidelity under high-throughput conditions.

To address the challenge of cyberattacks, intrusion detection systems (IDSs) are introduced to recognize intrusions and protect computer networks. Among all these IDSs, conventional machine learning methods rely on shallow learning and have unsatisfactory performance. Unlike machine learning methods, deep learning methods are the mainstream methods because of their capability to handle mass data without prior knowledge of specific domain expertise. Concerning deep learning, long short-term memory (LSTM) and temporal convolutional networks (TCNs) can be used to extract temporal features from different angles, while convolutional neural networks (CNNs) are valuable for learning spatial properties. Based on the above, this paper proposes a novel interlaced and spatiotemporal deep learning model called CRGT-SA, which combines CNN with gated TCN and recurrent neural network (RNN) modules to learn spatiotemporal properties, and imports the self-attention mechanism to select significant features. More specifically, our proposed model splits the feature extraction into multiple steps with a gradually increasing granularity, and executes each step with a combined CNN, LSTM, and gated TCN module. Our proposed CRGT-SA model is validated using the UNSW-NB15 dataset and is compared with other compelling techniques, including traditional machine learning and deep learning models as well as state-of-the-art deep learning models. According to the simulation results, our proposed model exhibits the highest accuracy and F1-score among all the compared methods. More specifically, our proposed model achieves 91.5% and 90.5% accuracy for binary and multi-class classifications respectively, and demonstrates its ability to protect the Internet from complicated cyberattacks. Moreover, we conduct another series of simulations on the NSL-KDD dataset; the simulation results of comparison with other models further prove the generalization ability of our proposed model.

Based on the architecture of the Software Defined Network (SDN), we argue that SDN together with Internet of Things (IoT) applications can enhance the control and management of IoT in terms of flexibility and intelligence. However, with the rapid development of SDN, link fault tolerance has become a crucial challenge in ensuring network reliability and stability. In this field, the current solutions mainly consist of proactive and reactive schemes, but there are still limitations and challenges. The proactive solutions often waste significant TCAM resources, while the reactive solutions face longer fault recovery time. In order to solve the shortcoming of both solutions, and to address the issues of traffic interruption caused by insufficient link bandwidth after link failures, this paper proposes a method called Adapt To Link (ATL) which combines the greedy algorithm with Pro-VLAN technology (a proactive method which calculates a backup path and assigns a VLAN ID for each link before link failures), aiming to achieve efficient fault-tolerant recovery for link failures in the SDN data plane. In this algorithm, we utilize the Pro-VLAN method and pre-compute multiple backup paths for each link before a failure occurs. When a link failure occurs, we can swiftly switch the affected traffic to the backup paths automatically without the controller, ensuring continuous flow of network traffic. Additionally, we introduce a greedy algorithm to satisfy the requirement of elephant flows, thereby improving network resource utilization and performance. By combining these techniques and methods, our algorithm exhibits the characteristics of low interruption rate, minimal resource consumption, and high efficiency. The experimental results demonstrate that under high load conditions, the ATL scheme reduces the interruption rate by 72.4% compared to the proactive approach and by 54.9% compared to the reactive approach, respectively. The number of additional flow rules in ATL is only 21.95% of the proactive scheme, and the recovery time after a failure is only 21.72% of the reactive scheme. As a result, the ATL algorithm enables rapid and reliable network recovery in the event of link failures, and optimizes the utilization of network resources simultaneously, validating its feasibility and effectiveness.