5 G networks, essential for applications like smart cities and factories, must ensure high reliability, availability, and security. However, the safety of 5 G remains a matter of concern. Despite its enhanced security mechanisms compared to previous generations, our study identifies two novel denial-of-service (DoS) signaling attack types that can disrupt the 5 G control plane (CP), exposing weaknesses in its current security design. Traditional switches cannot prevent such attacks because they are unable to extract attacking user equipment (UE) information from encapsulated nonaccess stratum (NAS) data. While ensuring the availability of the 5 G CP is essential to protect 5 G services, this issue has emerged as a pressing challenge. To address this challenge, we propose a novel P4-based user equipment fingerprinting (P4USE) method to mitigate 5 G CP DoS signaling attacks. Leveraging P4's programmable packet processing capability, P4USE can parse encapsulated NAS information at line rate, identify UE fingerprints, and drop anomalous NAS messages originating from attackers. Experimental evaluations in Open5GS confirm both the existence of the identified vulnerabilities and the effectiveness of P4USE in mitigating them. Overall, our work reveals two novel vulnerabilities and presents a defense solution to enhance the availability and security of the 5 G CP.

With the dynamic demands and stringent requirements of various applications, networks need to be high-performance, scalable, and adaptive to changes. Researchers and industries view network softwarization as the best enabler for the evolution of networking to tackle current and prospective challenges. Network softwarization must provide programmability and flexibility to network infrastructures and allow agile management, along with higher control for operators. While satisfying the demands and requirements of network services, energy cannot be overlooked, considering the effects on the sustainability of the environment and business. This paper discusses energy efficiency in modern and future networks with three network softwarization technologies: SDN, NFV, and NS, introduced in an energy-oriented context. With that framework in mind, we review the literature based on network scenarios, control/MANO layers, and energy-efficiency strategies. Following that, we compare the references regarding approach, evaluation method, criterion, and metric attributes to demonstrate the state-of-the-art. Last, we analyze the classified literature, summarize lessons learned, and present ten essential concerns to open discussions about future research opportunities on energy-efficient softwarized networks.

The emergence of 5G networks has enabled the deployment of a two-tier edge and vehicular-fog network. It comprises Multi-access Edge Computing (MEC) and Vehicular-Fogs (VFs), strategically positioned closer to Internet of Things (IoT) devices, reducing propagation latency compared to cloud-based solutions and ensuring satisfactory quality of service (QoS). However, during high-traffic events like concerts or athletic contests, MEC sites may face congestion and become overloaded. Utilizing offloading techniques, we can transfer computationally intensive tasks from resource-constrained devices to those with sufficient capacity, for accelerating tasks and extending device battery life. In this research, we consider offloading within a two-tier MEC and VF architecture, involving offloading from MEC to MEC and from MEC to VF. The primary objective is to minimize the average system cost, considering both latency and energy consumption. To achieve this goal, we formulate a multi-objective optimization problem aimed at minimizing latency and energy while considering given resource constraints. To facilitate decision-making for nearly optimal computational offloading, we design an equivalent reinforcement learning environment that accurately represents the network architecture and the formulated problem. To accomplish this, we propose a Distributed-TD3 (DTD3) approach, which builds on the TD3 algorithm. Extensive simulations, demonstrate that our strategy achieves faster convergence and higher efficiency compared to other benchmark solutions.

Using Software-Defined Networking (SDN) in edge computing environments allows for more flexible flow monitoring than traditional networking methods. In SDN, the controller collects statistics from all switches and can communicate with switches to dynamically manage the entire network. However, monitoring per-flow or per-switch mechanisms to obtain the flow statistics from all of the switches may significantly increase bandwidth costs between switches and the control plane. In this paper, we propose a Bandwidth Cost First (BCF) algorithm to reduce the number of monitored switches and therefore lower the monitoring cost. The experiment results show that our algorithm outperforms the existing technique by reducing the number of monitored switches by 56%, leading to a reduction in bandwidth overhead of 41% and switch processing delay by 25%.

Network queries become increasingly challenging for online service providers with massive network devices and massive network queries due to the tradeoff between system scale and query granularity. We re-architect the traditional three-tier architecture, i.e., data collection, data storage, and data query, for aggregate queries, and build a system named NQ/ATP. NQ/ATP offloads the aggregation operation in network queries onto network switches, which accelerates the query execution and frees up network resources. NQ/ATP further devises a route learning mechanism, query hierarchy load balancing policy, and hierarchy clustering mechanism to save forwarding table entries on switches, which better supports massive queries. The evaluation shows that NQ/ATP can support network aggregate queries with higher capacity, less traffic volume, finer granularity, and better scalability than traditional three-tier polling architectures. The three optimizations can effectively reduce the forwarding table usage by up to 97.55%.

The next-generation 5G cellular networks are designed to support the internet of things (IoT) networks; network components and services are virtualized and run either in virtual machines (VMs) or containers. Moreover, edge clouds (which are closer to end users) are leveraged to reduce end-to-end latency especially for some IoT applications, which require short response time. However, the computational resources are limited in edge clouds. To minimize overall service latency, it is crucial to determine carefully which services should be provided in edge clouds and serve more mobile or IoT devices locally. In this article, we propose a novel service cache framework called S-Cache , which automatically caches popular services in edge clouds. In addition, we design a new cache replacement policy to maximize the cache hit rates. Our evaluations use real log files from Google to form two datasets to evaluate the performance. The proposed cache replacement policy is compared with other policies such as greedy-dual-size-frequency (GDSF) and least-frequently-used (LFU). The experimental results show that the cache hit rates are improved by 39% on average, and the average latency of our cache replacement policy decreases 41% and 38% on average in these two datasets. This indicates that our approach is superior to other existing cache policies and is more suitable in multi-access edge computing environments. In the implementation, S-Cache relies on OpenStack to clone services to edge clouds and direct the network traffic. We also evaluate the cost of cloning the service to an edge cloud. The cloning cost of various real applications is studied by experiments under the presented framework and different environments.

Network Function Virtualization (NFV) pushes the hardware-based network functions to generic servers as software and brings a highly flexible for deployment. The availability of Virtual Machines (VMs) enables the dynamic placement of Virtual Network Functions (VNFs) on demand, and it can reduce a large number of manual configuration processes that increase deployment efficiency. However, some services require more than one VNF to process. Therefore, the network flows need to traverse a set of sequential network functions called Service Function Chain (SFC). How to efficiently route traffic along service function chain and place VNFs in a network under operational constraints is a crucial issue. In this paper, we must overcome two challenges: (1) determining a flow path that traverses suitable network functions in the required order to meet the requirement of services, and (2) considering network loading and other dynamic characteristics when traffic is routed through existing VNFs. Thus, we present methods to solve the routing and placement problems for the service function chain. Our solutions transform the network representation to a virtual layered graph that considers NFV processing latency and allows conventional shortest path algorithms to solve the problem. We are not only pursuing high success rates to serve more flows but also taking into account the execution time of the algorithms.

Previous research on Segment Routing (SR) mostly focused on unicast, whereas online SDN multicast with segment trees supporting IETF dynamic group membership has not been explored. Compared with unicast SR, online SDN multicast with segment trees is more challenging since finding an appropriate size, shape, and location for each segment tree is crucial to deploy it in more multicast trees. In this paper, we explore Multi-tree Multicast Segment Routing (MMSR) to jointly minimize the bandwidth consumption and forwarding rule updates over time by leveraging segment trees. We prove MMSR is NP-hard and design an online competitive algorithm, named Segment Tree Routing and Update Scheduling (STRUS) to achieve the tightest bound. STRUS includes Segment Tree Merging and Segment Tree Pruning to merge smaller overlapping subtrees into segment trees, and then tailor them to serve more multicast trees. We design Stability Indicator and Reusage Indicator to carefully construct segment trees at the backbone of multicast trees and reroute multicast trees to span more segment trees. Simulation and implementation on real SDNs with YouTube traffic manifest that STRUS outperforms state-of-the-art algorithms regarding the total cost and TCAM usage. Moreover, STRUS is practical for SDN since its running time is about 1 second, even for massive networks with thousands of nodes.

Traffic engineering (TE) and efficient network updating have been considered as separate problems in previous SDN research. Traffic engineering mostly focuses on static traffic and does not consider the rerouting overheads to support dynamic traffic. Efficient network updating assumes the new routing is provided by TE and focuses on minimizing only the rerouting overheads, and therefore, the improved new routing with bandwidth consumption similar to the new routing from TE but much lower rerouting overheads has not been explored. In this paper, we explore Multi-tree Low-overhead Multicast Rerouting (MLMR) to jointly solve both problems for SDN multicast. We prove that MLMR is NP-hard and design a new approximation algorithm, named Multicast Rerouting and Update Scheduling Algorithm (MRUSA). Equipped with the notions of deterioration indicator, motivator, and inhibitor, MRUSA provides incremental tree updating and multi-tree update scheduling to address the trade-off between the bandwidth consumption and rerouting overheads. Frequent rerouting due to tiny changes of multicast users can be effectively avoided, because rerouting time for each group can be correctly identified. Simulations and implementation on real SDNs with YouTube traffic manifest that the total cost can be reduced by at least 35% compared with SPT and ST, and the computation time is small for massive SDN.

With the rapid development of network technology and growing services running, there is more network traffic on the Internet. To ensure the reliability and security of network, we need to do more effective network monitoring tasks that can help us gain more information for network troubleshooting and malicious traffic detection. Software-Defined Networks (or SDN, for short) provides a flexible platform for the network monitoring and relies on a central controller and switches interact with each other to gain a global view of traffic. However, the computation resources for network monitoring in switches are limited in SDN. Thus, too many monitoring tasks will affect data plane traffic performance. To address this issue, we propose FlowSpy, which is a load balancing network monitoring framework using P4 (Programming Protocol-Independent Packet Processors) programming language in SDN. P4 program can specify how a switch processes packets, that can reduce the overhead of the interaction between data plane and control plane in SDN, and provides more flexibility for monitoring than OpenFlow-based SDN. As compared to existing network monitoring methods, FlowSpy can take more monitoring capacity at each switch to complete more monitoring tasks without any overloaded nodes.

Cloud storage provides the great convenience for people to access their data at anytime from any place. Since cloud storage is usually run by the third-party service provider, keyword search over cloud data with privacy protection is of great importance. Many studies in the literature have proposed keyword search scheme for document search, but, in most schemes, the query keywords must exactly match those in the document indexes. However, it is impractical to restrict query keywords provided by the user when performing the search. This paper proposes the scheme for semantic multi-keyword search over encrypted cloud data. Users are able to select query keywords on their own choice. In addition, the query privacy of the user and the security of the documents are protected simultaneously through encrypted document search to prevent snooping from the cloud service provider. Experiments are conducted using a dataset of massive real world papers. The results show that the proposed scheme can effectively perform the semantic multi-keyword search over encrypted cloud data with great efficiency.

Network virtualization is a promising technology for the emerging 5G and cloud computing networks where the virtual network is a logical topology consisting of virtual nodes and virtual links. In network virtualization, how to efficiently assign resources of the physical network to the virtual networks is of great significance and is known as the Virtual Network Embedding (VNE) problem. This paper presents an efficient algorithm tackling with the coordinated VNE problem. Specifically, a Mod-MaxMatch approach is presented which takes the global link resources into considerations when mapping the virtual nodes. Furthermore, a path splitting scheme based on the genetic algorithm is proposed while mapping the virtual links. The proposed algorithm minimizes the redundant reutilization of physical links and mitigates the demand for network bandwidths. A well-known link cost function is used to evaluate the network performance. The experimental results show that the link cost for the proposed approach is reduced by 77% compared to the traditional methodology and by 21% compared to the state-of-art design.

In this paper, we propose a user centric bandwidth allocation scheme for low latency data transmission in ultra dense vehicular networks. Various mobile devices such as mobile phones, sensors of vehicles or autonomous driving systems,require low latency and bandwidth intensive packet delivery between the devices and the Internet aiming to support real-time applications. In the ultra dense vehicular network, small base stations (SBSs) are densely deployed in a fixed geographic area to provides higher date rate. In further, each SBS cooperates with others to form clusters to better support seamless wireless data transmissions, and each mobile device dynamically plans its wireless connectivity for data transmission when it moves in the network. Specifically, each mobile device pre-allocates the amount of bandwidth from a cluster, formed by several SBSs, based on its expected movement, the delay and band-width requirement of the packet transmission and the resource availability of each cluster. Moreover, to effectively utilize the available network resource, each cluster also redistributes its residual bandwidth to the mobile devices pre-allocate bandwidth from it. Consequently, the latency of the data transmission can be better sustained in the ultra dense vehicular network.

Earthquake early warning system uses high-speed computer network to transmit earthquake information to population center ahead of the arrival of destructive earthquake waves. This short (10 s of seconds) lead time will allow emergency responses such as turning off gas pipeline valves to be activated to mitigate potential disaster and casualties. However, the excessive false alarm rate of such a system imposes heavy cost in terms of loss of services, undue panics, and diminishing credibility of such a warning system. At the current, the decision algorithm to issue an early warning of the onset of an earthquake is often based on empirically chosen features and heuristically set thresholds and suffers from excessive false alarm rate. In this paper, we experimented with three advanced machine learning algorithms, namely, K-nearest neighbor (KNN), classification tree, and support vector machine (SVM) and compared their performance against a traditional criterion-based method. Using the seismic data collected by an experimental strong motion detection network in Taiwan for these experiments, we observed that the machine learning algorithms exhibit higher detection accuracy with much reduced false alarm rate.

Video conferencing consumes a substantial portion of network bandwidth and have strong latency requirements. In traffic engineering, software-defined networking (SDN) optimizes video conferencing performance through flexible controls. SDN switches process packets by leveraging ternary content-addressable memory (TCAM), which is a high-speed hardware-based packet forwarding element. However, TCAM is not cost-effective and limited in space, especially in SDN, as it requires more TCAM space to match more packet fields. Previous studies rely on SDN to handle SVC video streaming; however, none considers TCAM space in SDN switches. In this paper, we propose a novel SVC multicast streaming scheme named adaptive SDN-based SVC multicast (ASCast). Each video layer forms a multicast tree, and we formulate a linear programming problem for the tree construction. To address the problem, we design static and dynamic heuristic algorithms to build multicast trees and maximize overall video quality with limited TCAM space. Moreover, to reduce TCAM space consumption, we carefully consider multicast integer programming address assignment for video layers and forwarding rule installation. Based on our evaluation, ASCast provides a 35% higher video data rate and installs 66% fewer forwarding rules into switches than other SVC video multicast schemes.

Previous research on SDN traffic engineering mostly focuses on static traffic, whereas dynamic traffic, though more practical, has drawn much less attention. Especially, online SDN multicast that supports IETF dynamic group membership (i.e., any user can join or leave at any time) has not been explored. Different from traditional shortest-path trees (SPT) and graph theoretical Steiner trees (ST), which concentrate on routing one tree at any instant, online SDN multicast traffic engineering is more challenging because it needs to support dynamic group membership and optimize a sequence of correlated trees without the knowledge of future join and leave, whereas the scalability of SDN due to limited TCAM is also crucial. In this paper, therefore, we formulate a new optimization problem, named Online Branch-aware Steiner Tree (OBST), to jointly consider the bandwidth consumption, SDN multicast scalability, and rerouting overhead. We prove that OBST is NP-hard and does not have a |Dmax|1-ε-competitive algorithm for any , where |Dmax| is the largest group size at any time. We design a |Dmax|-competitive algorithm equipped with the notion of the budget, the deposit, and Reference Tree to achieve the tightest bound. The simulations and implementation on real SDNs with YouTube traffic manifest that the total cost can be reduced by at least 25% compared with SPT and ST, and the computation time is small for massive SDN.

Network Function Virtualization (NFV) on Software-Defined Networks (SDN) can effectively optimize the allocation of Virtual Network Functions (VNFs) and the routing of network flows simultaneously. Nevertheless, most previous studies on NFV focus on unicast service chains and thereby are not scalable to support a large number of destinations in multicast. On the other hand, the allocation of VNFs has not been supported in the current SDN multicast routing algorithms. In this paper, therefore, we make the first attempt to tackle a new challenging problem for finding a service forest with multiple service trees, where each tree contains multiple VNFs required by each destination. Specifically, we formulate a new optimization, named Service Overlay Forest (SOF), to minimize the total cost of all allocated VNFs and all multicast trees in the forest. We design a new 3ρST-approximation algorithm to solve the problem, where ρSTdenotes the best approximation ratio of the Steiner Tree problem, and the distributed implementation of the algorithm is also presented. Simulation results on real networks for data centers manifest that the proposed algorithm outperforms the existing ones by over 25%. Moreover, the implementation of an experimental SDN with HP OpenFlow switches indicates that SOF can significantly improve the QoE of the Youtube service.

With software-defined network (SDN) and network function virtualization (NFV) techniques, we can embed the service chain consisting of a sequence of virtualized network functions (VNFs), i.e., we can determine the flow path and deploy the VNFs contained in the service chain at any place on the path. In the literature, the methods of service chain embedding bound the number of VNFs at a node, whereas the link capacities are disregarded and the amount of flows is not considered, which could cause serious congestion. In addition, according to our experiment, the process overhead on a computation node is linear to the total amount of flows processed. In this paper, we propose a method of service chain embedding to maximize the total amount of flows while bounding the process overhead of the flows on a node by its computation capability and the total amount of flows on an link by its bandwidth capacity. To our knowledge, our method is the first approximation algorithm of service chain embedding with considering flow in the literature. Simulations show our algorithm has good performance in terms of the total amount of flows.

Deep packet filtering (DPF) has been demonstrated as an essential technique for effective fine-grained access controls, but it is commonly recognized that the technique may invade the individual privacy of the users. Secure computation can address the tradeoff between privacy and DPF functionality, but the current solutions limit the scalability of the network due to the intensive computation overheads and large connection setup delay, especially for the latest network paradigm, network function virtualisation (NFV) and software-defined network (SDN). In this paper, therefore, we propose a privacy-preserving deep packet filtering protocol, named DPF-ET, that can efficiently perform filtering function over encrypted traffic while diminishing the communication overhead and setup delay for the controller in SDN. DPF-ET guarantees the data privacy for users and remains rule privacy for the network owner. The implementation results on an experimental HP SDN/NFV platform demonstrate that the proposed DPF-ET outperforms the current approaches by reducing 250 times in the communications overhead and 32 times in the setup delay.

Although Software-Defined Networking (SDN) enables flexible network resource allocations for traffic engineering, current literature mostly focuses on unicast communications. Compared to traffic engineering for multiple unicast flows, multicast traffic engineering for multiple trees is very challenging not only because minimizing the bandwidth consumption of a single multicast tree by solving the Steiner tree problem is already NP-Hard, but the Steiner tree problem does not consider the link capacity constraint for multicast flows and node capacity constraint to store the forwarding entries in Group Table of OpenFlow. In this paper, therefore, we first study the hardness results of scalable multicast traffic engineering in SDN. We prove that scalable multicast traffic engineering with only the node capacity constraint is NP-Hard and not approximable within δ, which is the number of destinations in the largest multicast group. We then prove that scalable multicast traffic engineering with both the node and link capacity constraints is NP-Hard and not approximable within any ratio. To solve the problem, we design a δ-approximation algorithm, named Multi-Tree Routing and State Assignment Algorithm (MTRSA), for the first case and extend it to the general multicast traffic engineering problem. The simulation and implementation results demonstrate that the solutions obtained by the proposed algorithm outperform the shortest-path trees and Steiner trees. Most importantly, MTRSA is computation-efficient and can be deployed in SDN since it can generate the solution with numerous trees in a short time.

Current traffic engineering in SDN mostly focuses on unicast. By contrast, compared with individual unicast, multicast can effectively reduce network resources consumption to serve multiple clients jointly. Since many important applications require reliable transmissions, it is envisaged that reliable multicast plays a crucial role when an SDN operator plans to provide multicast services. However, the shortest-path tree (SPT) adopted in current Internet is not bandwidth-efficient, while the Steiner tree (ST) in Graph Theory is not designed to support reliable transmissions since the selection of recovery nodes is not examined. In this paper, therefore, we propose a new reliable multicast tree for SDN, named Recover-aware Steiner Tree (RST). The goal of RST is to minimize both tree and recovery costs, while finding an RST is very challenging. We prove that the RST problem is NP-Hard and inapproximable within k, which is the number of destination nodes. Thus, we design an approximate algorithm, called Recover Aware Edge Reduction Algorithm (RAERA), to solve the problem. The simulation results on real networks and large synthetic networks, together with the experiment on our SDN testbed with real YouTube traffic, all manifest that RST outperforms both SPT and ST. Also, the implementation of RAERA in SDN controllers shows that an RST can be returned within a few seconds and thereby is practical for SDN networks.

This paper investigates the issue of interference mitigation in wireless body area networks (BANs). Although several approaches have been proposed in BAN standard IEEE 802.15.6, they increase transmission latency or energy cost, and do not mitigate interference effectively. In order to avoid both intra- and inter-BAN interference, we present a MAC protocol with two-layer interference mitigation (2L-MAC) for BANs. Considering the QoS requirements of BANs, the proposed protocol not only avoids packet collisions but also reduces transmission delay and energy consumption in sensors. Moreover, channel switching is triggered whenever a BAN needs to acquire more bandwidth. Simulation results show that our protocol outperforms other protocols in terms of delivery rate, latency and energy saving.

Recent years have seen a tremendous growth in the volume of video traffic in mobile settings. In this paper, we present the design of a mobile video-centric proxy cache, named iProxy, that offers improved performance in terms of both hit rates and streaming quality. Our thesis in designing iProxy is that we need to elevate the traditional view of caching from "data" to "information" in order to optimally meet the stringent requirements of video streaming in mobile settings. iProxy relies on recent advances on information-bound references (IBRs) to collapse multiple related cache entries into a single one, improving hitrate while lowering storage costs. iProxy incorporates a novel dynamic linear rate adaptation scheme to ensure high stream quality in face of channel diversity and device heterogeneity. Our evaluation of iProxy using realistic traffic traces shows that it can improve hitrate, but we need to use novel information-aware replacement policies for optimal performance. We show that our linear encoder can adapt well to changes in bandwidth, and yield better bit rates, lower buffering and lower start up delays than state-of-the-art schemes.

Network resources are often limited, so how to use them efficiently is an issue that arises in many important scenarios. Many recent proposals rely on a central controller to carefully orchestrate resources across multiple network locations. The central controller gathers network information and relative levels of usage of different resources and calculates optimized task allocation arrangements to maximize some global benefit. Examples of architectures that use this framework include coordinated sampling (cSamp [1]) and redundancy elimination (SmartRE [2]). However, a centralized solution creates practical problems as it is susceptible to overload, and the controller is a single point of failure. In this paper, we present a distributed solution called decor that achieves global optimization based on local information that closes to centralized approaches in terms of performance. In decor, the responsibility of resource monitoring and information gathering is spread among multiple nodes; thus, no single point is overloaded. Allocation of tasks is also done in a similar distributed fashion. decor can easily scale up to large networks, and the partial network failures do not affect DECOR's functioning in other parts of the network. decor can be applied to most of path-based applications. We describe in detail how to apply it to distributed SmartRE and implement it in the Click software router.

Many systems have leveraged the broadcast nature of wireless radios to improve wireless capacity and performance. While conventional approaches have focused on overhearing entire packets, recent designs have argued that focusing on overheard content may be more effective. Unfortunately, key design choices in these approaches limit them from fully leveraging the benefits of overhearing content. We propose a cleaner refactoring of functionality where-in overhearing is realized at the sub-packet payload level through the use of IP-layer redundancy elimination. We show that this dramatically improves the effectiveness of prior overhearing based approaches and enables new designs, e.g., enhanced network coding, where content overhearing can be more effectively integrated to improve performance. Realizing the benefits of IP-layer content overhearing requires us to overcome challenges arising from the probabilistic nature of wireless reception (which could lead to inconsistent state) and the limited resources on wireless devices. We overcome these challenges through careful data structure and wireless redundancy elimination designs. We evaluate the effectiveness of our system using experimentation on real traces. We find that our design is highly effective: e.g., it can improve goodput by nearly 25% and air time utilization by nearly 20%.