Management approaches to modern networks are increasingly influenced by software-defined networks (SDNs), and this increased influence is reflected in the growth of commercially available innovative SDN-based switches, controllers and applications. To date, there have been a number of commercial and open-source SDN operating systems (NOS) introduced for various purposes, including distributed controller frameworks targeting large, carrier-grade networks such as the Open Network Operating System (ONOS) and OpenDayLight (ODL). These frameworks are distinguished by their (i) elastic cluster controller architecture, (ii) network virtualization support, and (iii) modular design. Given their flexible design, growing list of supported features, and collaborative community support, these are attractive hosting platforms for a wide range of third-party distributed network management applications. This paper identifies the common security requirements for policy enforcement in such distributed controller environments. We present the design of a network application permission-enforcement model and an integrated security subsystem (SM-ONOS) for managing distributed applications running on an ONOS controller. We discuss the underlying motivations of its security extensions and their implications for improving our understanding of how to securely manage large-scale SDNs. Our performance assessments demonstrate that the security-mode extension imposed reasonable overheads (ranging from 5 to 20% for 1-7 node clusters).

In 2002, DARPA put together a challenging proposition to the research community: demonstrate using an existing information system and available DARPA developed and other COTS technologies that a very high level of survivability against unconstrained attack by a nation state-level red team is achievable. This report describes the monitoring, intrusion detection, and reporting infrastructure of the resulting system, highlighting the design principles and lessons learned that are generally applicable to survivable information systems

The Internet has recently been impacted by a number of large distributed attacks that achieve exponential growth through self-propagation. Some of these attacks have exploited vulnerabilities for which advisories had been issued and for which patches and detection signatures were available. It is increasingly apparent, however, that such prevention and detection mechanisms are inadequate, and that the attacker's time to exploit is shrinking relative to the defender's ability to learn of a new attack and patch systems or update intrusion detection signatures. We introduce visual, scalable techniques to detect phenomena such as distributed denial-of-service attacks and worms. It is hoped that these new approaches will enable detection of such events at an early stage and enable local response actions even before the publication of advisories about a new vulnerability and the availability of patches.

The Synchronous Collaborative Object-Oriented Toolkit (SCOOT) provides reliable real-time multimedia collaboration for geographically separated participants. SCOOT does this by synchronizing application states and ensuring reliable shared tool control. It is designed to provide this functionality while minimizing the modifications to application code, the impact on a developer's design style and level of effort, and on an application's structure. SCOOT extends the end-user's working style by providing a continuum of collaboration styles, ranging from informal to formal.