基于深度学习的软件定义网络应用策略冲突检测方法

doi:10.11959/j.issn.1000-0801.2017305

Abstract

Abstract:

In OpenFlow-based SDN(software defined network),applications can be deployed through dispatching the flow polices to the switches by the application orchestrator or controller.Policy conflict between multiple applications will affect the actual forwarding behavior and the security of the SDN.With the expansion of network scale of SDN and the increasement of application number,the number of flow entries will increase explosively.In this case,traditional algorithms of conflict detection will consume huge system resources in computing.An intelligent conflict detection approach based on deep learning was proposed which proved to be efficient in flow entries’ conflict detection.The experimental results show that the AUC (area under the curve) of the first level deep learning model can reach 97.04%,and the AUC of the second level model can reach 99.97%.Meanwhile,the time of conflict detection and the scale of the flow table have a linear growth relationship.

Key words: policy conflict detection, deep learning, anomaly detection, SDN, OpenFlow

CLC Number:

TP393

Chuanhuang LI,Cheng CHENG,Xiaoyong YUAN,Lijie CEN,Weiming WANG. Policy conflict detection in software defined network by using deep learning[J]. Telecommunications Science, 2017, 33(11): 27-36.

Figures/Tables 11

References 15

[1]	韦乐平 . SDN的战略性思考[J]. 电信科学, 2015,31(1): 7-12.
	WEI L P . Strategic Thinking on SDN[J]. Telecommunications Science, 2015,31(1): 7-12.
[2]	CLOUGHERTY M M , WHITE C A , VISWANATHAN H ,et al. SDN在IP网络演进中的作用[J]. 电信科学, 2014,30(5): 1-13.
	CLOUGHERTY M M , WHITE C A , VISWANATHAN H ,et al. Role of SDN in IP network evolution[J]. Telecommunications Science, 2014,30(5): 1-13.
[3]	SPECIFICATION O F S.Version 1.5.1(wire protocol 0x01)[EB]. 2015.
[4]	VERMA D C . Simplify network administration using policy-based management[J]. Network IEEE, 2002,16(2): 20-26.
[5]	LOPES A B B , LIMA DE C G A , FERNANDEZ M P . Flow-based conflict detection in OpenFlow networks using first-order logic[C]// 2014 IEEE Symposium on Computers and Communication (ISCC),April 27-May 2,2014,Toronto,Japan. New Jersey:IEEE Press, 2014: 1-6.
[6]	BATISTA B L A , DE CAMPOS G A L , FERNANDEZ M P . A proposal of policy based OpenFlow network management[C]// 2013 20th International Conference on Telecommunications (ICT),Aug 14-16,2013,Guilin,China. New Jersey:IEEE Press, 2013: 1-5.
[7]	NATARAJAN S , HUANG X , WOLF T . Efficient conflict detection in flow-based virtualized networks[C]// 2012 International Conference on Computing,Networking and Communications (ICNC),Oct 8-10,2012,Maui,Hawaii. New Jersey:IEEE Press, 2012: 690-696.
[8]	LO C C , WU P Y , KUO Y H . Flow entry conflict detection scheme for software-defined network[C]// 2015 International Telecommunication Networks and Applications Conference(ITNAC),November 18,2015,Sydney,Australia. New Jersey:IEEE Press, 2015: 220-225.
[9]	PORRAS P , SHIN S , YEGNESWARAN V ,et al. A security enforcement kernel for OpenFlow networks[C]// The First Workshop on Hot Topics in Software Defined Networks,August 13,2012,Helsinki,Finland. New York:ACM Press, 2012: 121-126.
[10]	HU H , HAN W , AHN G J ,et al. FLOWGUARD:building robust firewalls for software-defined networks[C]// The Third Workshop on Hot Topics in Software Defined Networking,August 22,2014,Chicago,Illinois,USA. New York:ACM Press, 2014: 97-102.
[11]	KHURSHID A , ZOU X , ZHOU W ,et al. VerIFlow:verifying network-wide invariants in real time[C]// 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI 13),Apr 3-5,2013, Lombard,IL,USA.[S.l.:s.n.] 2013: 15-27.
[12]	BASILE C , CANAVESE D , LIOY A ,et al. Inter‐function anomaly analysis for correct SDN/NFV deployment[J]. International Journal of Network Management, 2016,26(1): 25-43.
[13]	WANG P , HUANG L , XU H ,et al. Rule anomalies detecting and resolving for software defined networks[C]// 2015 IEEE Global Communications Conference (GLOBECOM),Dec 6-10,2015,San Diego,USA. New Jersey:IEEE Press, 2015: 1-6.
[14]	王娟, 王江, 焦虹阳 ,等. 一种基于OpenFlow的SDN访问控制策略实时冲突检测与解决办法[J]. 计算机学报, 2015,38(4): 872-883.
	WANG J , WANG J , JIAO H Y ,et al. A method of OpenFlow-based real-time conflict detection and resolution for SDN access control policies[J]. Chinese Journal of Computers, 2015,38(4): 872-883.
[15]	LIAW A , WIENER M . Classification and regression by randomForest[J]. R News, 2002,2(3): 18-22.

Metrics

Recommended 0

No Suggested Reading articles found!

规则	源MAC地址	目的MAC地址	源IP地址	目的IP地址	动作
1	*	*	10.20.0.1/8	10.20.5.100	drop
2	*	*	*	10.20.1.1/8	limit 8 Mbit/s
3	*	*	10.20.100.1/8	*	limit 1 Mbit/s
4	*	*	10.20.0.100	*	output port 10
5	14:10:9f:ea:7a:fd	*	*	*	*
6	*	14:10:9f:ea:50:3e	*	*	*

参数名	C3F4_1	C3F4_2	C3F4_3	C3F3	C3F2	C4F4	C5F2
filter_length1	3	3	3	2	5	5	2
filter_length2	2	2	2	2	3	3	2
filter_length3	2	2	2	2	3	3	2
filter_length4	/	/	/	/	/	2	2
filter_length5	/	/	/	/	/	/	2
训练精度	90.06%	90.03%	91.23%	90.82%	90.68%	88.90%	89.38%
测试精度	90.14%	91.20%	91.46%	90.84%	90.24%	89.60%	89.24%
AUC	96.45%	96.91%	97.04%	97.00%	96.61%	96.10%	96.39%

参数名	F3	F4	C1F4	C1F3
filter_length	/	/	1	1
训练精度	98.53%	98.21%	98.50%	97.77%
测试精度	99.35%	98.35%	98.59%	98.60%
AUC	99.97%	99.96%	99.80%	99.93%

样本个数/个	深度学习(C3F4)	随机森林
400 000	89.56%	62.7%
1 200 000	91.46%	内存溢出

流表项个数/个	1 000	10 000	25 000	50 000	100 000	200 000
检测时间/s	0.341	0.607	0.957	1.677	2.906	5.631

Policy conflict detection in software defined network by using deep learning

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 11

References 15

Related Articles 15

Metrics

Recommended 0

[1]	Min LU, Juan HU, Xianchao ZHANG, Weijian DING, Guangxue YUE. Personalized recommendation model based on users multi-features fusion [J]. Telecommunications Science, 2023, 39(5): 101-115.
[2]	Yanxia TAN, Guangquan WANG, Zelin WANG, Yanlei ZHENG, He ZHANG, Chenfang ZHANG, Sai HAN, Shikui SHEN. Research on technical scheme of SDN intelligent management and control orchestration system [J]. Telecommunications Science, 2023, 39(3): 143-152.
[3]	Bin ZHUGE, Zhenghu YIN, Wenxue SI, Lei YAN, Ligang DONG, Xian JIANG. Student knowledge tracking based multi-indicator exercise recommendation algorithm [J]. Telecommunications Science, 2022, 38(9): 129-143.
[4]	Jie ZHOU, Bernardo Esono Esono Mikue, Xueying WANG, Huiting ZHOU, Hong LUO. PAPR optimization based on SLM and PTS algorithms in NC-OFDM systems [J]. Telecommunications Science, 2022, 38(7): 63-74.
[5]	Panpan LI, Zhengxia XIE, Guangxue YUE, Xin LIU. Research progress and trends of deep learning based wireless communication receiving method [J]. Telecommunications Science, 2022, 38(2): 1-17.
[6]	Qing SHEN, Wenbin GUO, Jungang LOU, Qiangguo YU. Personalized recommendation model with multi-level latent features [J]. Telecommunications Science, 2022, 38(2): 71-83.
[7]	Huahua CHEN, Zhe CHEN. Research on anomaly detection algorithm based on sparse variational autoencoder using spike and slab prior [J]. Telecommunications Science, 2022, 38(12): 65-77.
[8]	Tai LIU, Chao ZHU, Yi CHENG, Yiming WANG. Research on SDN based tactical communication network architecture [J]. Telecommunications Science, 2022, 38(10): 120-130.
[9]	Zhihong CHEN, Mingxiao WANG. Application of computer vision in intelligent security [J]. Telecommunications Science, 2021, 37(8): 142-147.
[10]	Su WANG, Hua LU, Shuo WANG, Lei CAI, Tao HUANG. Research progress of KPI anomaly detection in intelligent operation and maintenance [J]. Telecommunications Science, 2021, 37(5): 42-51.
[11]	Boheng TANG, Xingang CHAI. Cloud-edge collaboration based computer vision inference mechanism [J]. Telecommunications Science, 2021, 37(5): 72-81.
[12]	Shujun SUN, Shengliang PENG, Yudong YAO, Xi YANG. A survey of deep learning based modulation recognition [J]. Telecommunications Science, 2021, 37(5): 82-90.
[13]	Huahua CHEN, Zhe CHEN, Chunsheng GUO, Na YING, Xueyi YE, Jianwu ZHANG. Anomaly detection algorithm based on Gaussian mixture variational auto encoder network [J]. Telecommunications Science, 2021, 37(4): 54-61.
[14]	Shuang PENG, Xiaodong WANG, Zongju PENG, Fen CHEN. Fast QTMT partition decision based on deep learning [J]. Telecommunications Science, 2021, 37(4): 73-81.
[15]	Daoyun HU, Jin QI, Qianchun LU, Feng LI, Hongqiang FANG. Research and application of traffic engineering algorithm based on deep learning [J]. Telecommunications Science, 2021, 37(2): 107-114.