In the data center network, traffic has a distinct heavy-tailed distribution characteristic, with the minority of throughput-sensitive elephant flows occupy most of the bandwidth and the majority of latency-sensitive mice flows require low latency. Therefore, it is very important to predict the network flow size and make a reasonable balanced scheduling. Currently, the traditional elephant flow detection schemes based on thresholds have poor accuracy and low granularity, while the intelligent detection schemes based on SDN has a certain flow scheduling response delay. For this reason, a two-stage online elephant flow prediction method for load balancing (OPLB) is proposed. Based on the programmable data plane, OPLB first pre-identifies the elephant flow by extracting the stateless features of the first packet of the network flow arriving at the switch. Secondly, the size of the elephant flow is predicted by extracting the features of the first${n}$packets of the flow. Finally, the detected elephant and mice flows are balanced to high throughput and low latency paths. Combined with the computing and storage capabilities of the programmable switch, the models and parameters in OPLB can be updated online by mapping the trained classification and prediction decision tree models to the matching-action pipelines of the programmable switch, thus achieving dynamic load balancing. We prototype OPLB in P4 software simulation environment and evaluate it with packet traces from the university data centers (UNI). The experiment shows that the accuracy of classification and prediction reached 89.3% when the proportion of elephant flow was 20%. At the same time, compared to the scheme that only uses single stage elephant flow prediction, OPLB reduces the amount of information collected by the switch by about 40% when the elephant flow proportion is 20%.

In order to achieve requirements such as fast search of flow entries and mask matching, OpenFlow hardware switches usually use TCAM to store flow entries. Limited by the capacity of TCAM, the current commercial OpenFlow switches can only support hundreds of thousands of flow entries, which makes SDN network using OpenFlow hardware switches vulnerable to the threat of flow table overflow attack. Among them, low-rate DoS (LDoS) attack against table overflow poses a serious threat to SDN networks due to its high attack efficiency and concealed flow, and it is also difficult to detect. In this regard, this paper analyzed two types of LDoS attack flow against table overflow and proposed an attack detection and defense mechanism named SAIA (Small-flow Analysis and Inport-flow Analysis) through the design of table overflow prediction and flow entries deletion strategy. Experiments conducted through the SDN network environment showed that SAIA can effectively detect and suppress LDoS attack flows in the flow table in large-scale network conditions and verified that the deployment of SAIA is lightweight. At the same time, SAIA implemented the flow entry deletion strategy based on LRU when the flow table overflows in a nonattack situation, which further enhances the stability of the network.

Minimizing the flow completion times (FCTs) is a challenging work in information-agnostic datacenter networks, and a general approach is to configure multiple demotion thresholds so as to decrease the priorities of long flows, which can alleviate the impact on short flows, but how to appropriately set up these thresholds has not been addressed. In this paper, we firstly employ a queuing model to analyze the relationship between demotion threshold settings and FCT, and then we propose three principles to guide the demotion threshold configuration. Based on these principles, we present demotion threshold determination algorithm (DTDA). Finally, we evaluate the performance of DTDA via simulation, and the experimental results show that DTDA performs better than other two compared algorithms.

Minimizing the flow completion times (FCTs), especially for the short flows, is widely deemed an important optimization goal in designing data center networks, while flow scheduling strategies play great role in achieving this target. Existing optimal scheduling algorithms severely depend on the prior knowledge of flow size, which is hard to implement in practice. Therefore, it is necessary to estimate the effect of flow scheduling strategies in information-agnostic datacenter networks. In this paper, we simplify the problem of FCTs and propose priority queue based mathematical model to evaluate the performance of different strategies, and derive the expression of FCT. We also present several scheduling strategies for reducing the value of FCT via analysis on the expression. We evaluate and compare these scheduling strategies by numerical and simulation experiments. The results show that the performance can be significantly improved if flow scheduling combines the characteristics of flow size distribution and the principle of providing shortest flow the highest priority.

Although dense interconnection datacenter networks (DCNs) (e.g., FatTree) provide multiple paths and high bisection bandwidth for each server pair, the widely used single-path Transmission Control Protocol (TCP) and equal-cost multipath (ECMP) transport protocols cannot achieve high resource utilization due to poor resource excavation and allocation. In this paper, we present LESSOR, a performance-oriented multipath forwarding scheme to improve DCNs’ resource utilization. By adopting an OpenFlow-based centralized control mechanism, LESSOR computes near-optimal transmission path and bandwidth provision for each flow according to the global network view while maintaining nearly real-time network view with the performance-oriented flow observing mechanism. Deployments and comprehensive simulations show that LESSOR can efficiently improve the network throughput, which is higher than ECMP by 4.9%–38.3% under different loads. LESSOR also provides 2%–27.7% improvement of throughput compared with Hedera. Besides, LESSOR decreases the average flow completion time significantly.

Most existing techniques detecting shared congestion paths are based on pair-wise comparison of paths with a common source or destination point. It is difficult to extend them to cluster paths with different sources and destinations. In this paper, we propose a scalable approach to cluster shared congestion paths based on PCA. This algorithm maps the delay measurement data of each path into a point in a new, low-dimensional space based on the factor loading matrix in PCA, which reflect correlation between paths. In this new space, points are close to each other if the corresponding paths share congestion. Then, the clustering analysis is applied to these points so as to identify shared congestion paths accurately. This algorithm is evaluated by NS2 simulations. The results show us that this algorithm has high accuracy.

Internet path available bandwidth is an important metric for distributed application performance optimization. However, current network coordinate system causes large errors when being used to predict such performance metric. In this paper, based on theoretical and Internet measurement data analysis result, we show that though not strictly satisfy the constraint, Internet path available bandwidth does have some degree of ultra metric space feature. Then we propose an available bandwidth prediction mechanism PathGuru based on this feature. In PathGuru, each node obtains an outgoing and an incoming bandwidth vector using measurement data to and from landmarks, and the available bandwidth between any two nodes is predicted according to the two vectors as well as ultra metric space constraint. Experimental results on Internet measurement dataset show that PathGuru has reasonable prediction accuracy and can also deal with the available bandwidth symmetry violation problem.

Network distance prediction mechanism based on network coordinate system provides an efficient way to obtain latency between node pairs with limited times of measurements. However, most of today's prediction mechanisms use single metric space embedding, which cannot describe the complex hierarchical structure of Internet precisely and produce large prediction errors. In this paper a virtual node based network distance prediction mechanism named VNetPharos is proposed, which divides edge networks into independent prediction regions, and each prediction region maintains a virtual node to represent the joint between the region and core network. Distance of any two nodes is represented as the sum of distances between nodes and their virtual nodes and distance between the two virtual nodes. Analysis results show that VNetPharos can improve the distance prediction accuracy effectively.