Malware detection is an important issue for network security, especially for the Internet of Things (IoT) network. Traditional network intrusion detection system (NIDS), running on external host servers, are not scalable for ever-increasing IoT traffic and waste time on transmitting data back and forth. Here, we propose a novel architecture called on-switch malware detector that utilizes the programmable switch and the machine-learning technique to achieve better performance on detecting malicious flows in the network. The on-switch malware detector mainly consists of four components: (1) packet forwarder, (2) feature extractor, (3) flow director, and (4) neural-network detector. According to the experimental results, the on-switch malware detection has a 99.57% shorter response time than a conventional signature-based NIDS; meanwhile its processing capacity increases by 800 times. As a result, the on-switch malware detector efficiently overcomes the shortcomings of conventional NIDSs, making it a better fit for the IoT network.

This paper presents a high-performance stateful firewall called P4SF that runs on a commodity P4-programmable switch and uses an extended finite state machine to provide match-state-action in the forwarding plane for stateful processing while significantly reducing the controller’s workload. P4SF is composed of three key blocks (i.e. Match Block, State Block, Action Block) that are responsible for reading/writing flow states, maintaining state transitions, and forwarding packets. Preemptive data caching is also realized into a buffer called State Pre-Fetch in P4SF for hiding transmission delay during state updates of flows. As a result, P4SF is successfully exercised on a commodity P4-programmable switch, and can be scaled to support 384,000 entries (120,000 under the three-way handshake in TCP connections) for TCP flows, achieving the 100Gb/s linerate speed for packet forwarding.

With the increasing demand of network services, many researches employ a Software Defined Networking architecture to manage large-scale inter-datacenter networks. Some of existing services such as backup, data migration and update need to replicate data to multiple datacenters by multicast before deadline. Recent works set up minimum-weight Steiner tree as routing paths for multicasting transfers to reduce bandwidth waste; meanwhile, using deadline-aware scheduling guarantees deadlines of requests. However, there is an issue of bandwidth competition among those works. SAFCast as a new algorithm is proposed for multicasting transfers and deadline-aware scheduling. In SAFCast, we develop a tree pruning process and make datacenters employ the store-and-forwarding mechanism to improve the issue of bandwidth competition. Meanwhile, more requests can be accepted by SAFCast. Our experimental result shows that SAFCast outperforms DDCCast in the acceptance rate by 16.5%. In addition, given a volume-to-price function for revenue, SAFCast can achieve 10% more profit than DDCCast. As a result, SAFCast is a better choice for cloud providers with the effective deadline guarantee and more efficient multicasting transfers.

Software-Defined Networking and Network Function Virtualization technologies are utilized to construct service chains cheaply and elastically. In Mobile Edge Computing platform, cloud servers can be deployed near to base stations. Migrating service functions of service chains to edge can reduce network latency or save unnecessary bandwidth consumption between edge and cloud datacenter. However, the control plane latency of SDN/NFV Mobile Edge Computing Platform is subject to the scalability of flow table in SDN switches due to flow table overflow problem. In this paper, we proposed Hash-based Group Management scheme to reduce the number of maintained flow entries by assigning users into groups and design a hash-based structure to efficiently maintain the group information. In our simulation results, the proposed scheme can reduce the number of maintain flow entries and table overflow ratio to improve the control plane latency.

Commercial OpenFlow-enabled legacy switches implement flow tables with Ternary Content Addressable Memory (TCAM) to perform high-speed flow matching process. However, the size of TCAM-based flow table is restricted to few thousands of entries due to manufacturing cost and high power consumption. In our previous research, we proposed Flow Entry Agent to integrate Off-Chip tables to increase the storage capacity without modifying Application Specific Integrated Circuit (ASIC). In this paper, we propose an efficient matching mechanism for Off-Chip tables. Simulation results show that our mechanism significantly increase the efficiency of flow matching process.

Compared with current distributed networks, Software defined networking is an innovative technology to manage networks by a centralized controller with global visibility. OpenFlow is one kind of SDN protocols. It provides flow-level controllability of network traffic to simplify the management of the administrators of data center. Flow control rules used by OpenFlow in switch flow table are called flow entries. Modern commodity switches use TCAM to implement flow table because of its high matching speed. However, the general TCAM size of switch only accommodates up to thousands of flow entries due to its high cost-to-density ratio and high power consumption. It indicates that the maximal number of flow that can be controlled is restricted to the TCAM size of switch. That leads to several scalability issues, especially in a data center. In this paper, we propose a topology based flow entry management (TFEM) technique, which is a scalable and memory-efficient solution by exploiting the hierarchical topology characteristic to aggregate the uses of flow entries for most of the small flows in a data center. With the proposed downlink and uplink separated flow tables structure, our results show that TFEM can reduce the average number of flow entries by 50%~78% for fat-tree topology against the traditional SDN without any switch hardware modification.

One of the killer applications for radio frequency identification (RFID) system is the automatic identification of physical objects. To do that, each object must be labeled with a RFID tag containing identifying data. However, collisions occur when several tags send their data simultaneously. This paper proposes a secure scheme for zero-collision RFID tags identification based on code division multiple access (CDMA) and hash-chain mechanics. The scheme not only allows several tags send their identifying data simultaneously without collision, but also provides the following secure properties for RFID reader and tags: mutual authentication, tag anonymity, robustness and forward secrecy.