Efficient Forwarding Anomaly Detection in Software-Defined Networks
Efficient Forwarding Anomaly Detection in Software-Defined Networks
复制标题
软件定义网络中的高效转发异常检测
DOI：
10.1109/tpds.2021.3068135
复制
发表时间：
2021-11
影响因子：
5.3
通讯作者：
Pang Chunhui
中科院分区：
文献类型：
--
作者：
Li Qi;Liu Yunpeng;Liu Zhuotao;Zhang Peng;Pang Chunhui
数据中心是支撑云计算的关键基础设施，通常采用软件定义网络（SDN）来管理集群、广域网和企业网络。由于SDN中的网络转发是由控制器动态编程的，因此确保控制器的意图被正确地转换为底层转发规则是至关重要的。因此，检测和定位SDN网络中的转发异常是生产网络中的一个基本问题。现有的研究建议大致分为基于探测的、基于包承载的和基于流量统计分析的，它们要么带来了巨大的开销，要么没有为某些转发异常提供足够的覆盖。本文提出了<inline-formula>< text -math notation="LaTeX">${\sf FADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq1- 306813.5 .gif"/></alternatives></inline-formula>，一种同时提供检测效率和准确性的可控制的被动测量方案。<inline-formula>< text -math notation="LaTeX">${\sf FADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq2- 306813.5 .gif"/></alternatives></inline-formula>首先分析整个网络的拓扑结构和流量规则，然后计算出一个可以覆盖所有转发规则的最小流集。对于每个选定的网络流，<inline-formula>< text -math notation="LaTeX">${\sf FADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq3- 306813.5 .gif"/></alternatives></inline-formula>决定其路径上监控位置的最佳数量（远小于总跳转数），并安装专门的规则来收集流量统计信息。<inline-formula>< text -math notation="LaTeX">${\sf FADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq4- 306813.5 .gif"/></alternatives></inline-formula>控制这些规则的安装和过期，以及唯一的流标签，以保证收集的统计数据的准确性。基于其中<inline-formula>< text -math notation="LaTeX">${\sf FADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq5- 306813.5 .gif"/></alternatives></inline-formula>算法决定是否检测到转发异常，如果检测到异常则进一步定位异常。在<inline-formula>< text -math notation="LaTeX">${\sf FADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq6- 306813.5 .gif"/></alternatives></inline-formula>，我们提出<inline-formula>< text -math notation="LaTeX">${\sf iFADE}$</ text -math><alternatives><mml:math><mml: math><inline-graphic xlink:href="liu-ieq7- 306813.5 .gif"/></alternatives></inline-formula> （<inline-formula>< text -math notation="LaTeX">${\sf FADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic）Xlink:href="liu-ieq8-3068135.gif"/></alternatives></inline-formula>)，进一步优化专用度量规则的使用和部署。<inline-formula>< text -math notation="LaTeX">${\sf iFADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">iFADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq9- 306813.5 .gif"/></alternatives></inline-formula>与<inline-formula>< text -math notation="LaTeX">${\sf FADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphicxlink: href = "刘- ieq10 - 3068135. - gif " / > < /替代> < / inline-formula >。我们实现了一个原型<inline-formula>< text -math符号="LaTeX">${\sf FADE}$</ text -math><alternatives><mml:math><mml: math><inline-graphic xlink:href="liu-ieq11-3068135.gif"/></alternatives></inline-formula>和<inline-formula>< text -math符号="LaTeX">${\sf iFADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">iFADE</mml:mi></mml:math><inline-graphicXlink:href="liu-ieq12- 306813.5 .gif"/></alternatives></inline-formula>，约12000行代码，并广泛评估原型。实验结果表明：<inline-formula>< text -math符号="LaTeX">${\sf (i)}$</ text -math><alternatives><mml: mrow><mml:mo>(</mml:mo><mml: mo></mml: mo></mml:mrow></mml:math><inline-graphic xlink:href="liu-ieq13- 306813.5 .gif"/></alternatives></inline-formula> <inline-formula>< text -math符号="LaTeX">${\sf FADE}$</ text -math><alternatives><mml: mi></mml:math><inline-graphicxlink:href="liu-ieq14-3068135.gif"/></alternatives></inline-formula>和<inline-formula>< text -math notation="LaTeX">${\sf iFADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">iFADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq15-3068135.gif"/></alternatives></inline-formula>是准确的，例如在异常检测中达到95%以上的真阳性和99%的真阴性；<inline-formula>< text -math符号="LaTeX">${\sf (ii)}$</ text -math><alternatives><mml: mo><mml: mrow><mml:mo>(</mml:mo><mml: mo></mml: mo></mml:mrow>)</mml:mo>< inline-graphic xlink:href="liu-ieq16- 306813.5 .gif"/></alternatives></inline-formula> <inline-formula>< text -math符号="LaTeX">${\sf FADE}$</ text -math><alternatives><mml: mi></mml:math><inline-graphicxlink:href="liu-ieq17- 306813.5 .gif"/></alternatives></inline-formula>和<inline-formula>< text -math notation="LaTeX">${\sf iFADE}$</ text -math><alternatives><mml:math><mml:mi mathvariant="sans-serif">iFADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq18- 306813.5 .gif"/></alternatives></inline-formula>是轻量级的，例如，与最先进的方法相比，它们分别减少了大约50%和90%的控制消息的消耗。
Data centers, the critical infrastructure underpinning Cloud computing, often employ Software-Defined Networks (SDN) to manage cluster, wide-area and enterprise networks. As the network forwarding in SDN is dynamically programmed by controllers, it is crucial to ensure that the controller intent is correctly translated into underlying forwarding rules. Therefore, detecting and locating forwarding anomalies in SDN is a fundamental problem in production networks. Existing research proposals, roughly categorized into probing-based, packet piggybacking-based, and flow statistics analysis-based, either impose significant overhead or do not provide sufficient coverage for certain forwarding anomalies. In this article, we propose <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq1-3068135.gif"/></alternatives></inline-formula>, a controllable and passive measuring scheme to simultaneously deliver detection efficiency and accuracy. <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq2-3068135.gif"/></alternatives></inline-formula> first analyzes the entire network topology and flow rules, and then computes a minimal set of flows that can cover all forwarding rules. For each selected network flow, <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq3-3068135.gif"/></alternatives></inline-formula> decides the optimal number of monitoring positions on its path (much less than total number of hops), and installs dedicated rules to collect flow statistics. <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq4-3068135.gif"/></alternatives></inline-formula> controls the installation and expiration of these rules, along with unique flow labels, to guarantee the accuracy of collected statistics, based on which <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq5-3068135.gif"/></alternatives></inline-formula> algorithmically decides whether a forwarding anomaly is detected, and if so it further locates the anomaly. On top of <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq6-3068135.gif"/></alternatives></inline-formula>, we propose <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">iFADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq7-3068135.gif"/></alternatives></inline-formula> (a more scalable version of <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq8-3068135.gif"/></alternatives></inline-formula>) to further optimize the usage and deployment of dedicated measurement rules. <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">iFADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq9-3068135.gif"/></alternatives></inline-formula> achieves over 40 percent rule reduction compared with <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq10-3068135.gif"/></alternatives></inline-formula> . We implement a prototype of both <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq11-3068135.gif"/></alternatives></inline-formula> and <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">iFADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq12-3068135.gif"/></alternatives></inline-formula> in about 12000 lines of code and evaluate the prototype extensively. The experiment results demonstrate <inline-formula><tex-math notation="LaTeX">${\sf (i)}$</tex-math><alternatives><mml:math><mml:mrow><mml:mo>(</mml:mo><mml:mi mathvariant="sans-serif">i</mml:mi><mml:mo>)</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="liu-ieq13-3068135.gif"/></alternatives></inline-formula> <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq14-3068135.gif"/></alternatives></inline-formula> and <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">iFADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq15-3068135.gif"/></alternatives></inline-formula> are accurate, e.g., they achieve over 95 percent true positive rate and 99 percent true negative rate in anomaly detection; <inline-formula><tex-math notation="LaTeX">${\sf (ii)}$</tex-math><alternatives><mml:math><mml:mrow><mml:mo>(</mml:mo><mml:mi mathvariant="sans-serif">ii</mml:mi><mml:mo>)</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="liu-ieq16-3068135.gif"/></alternatives></inline-formula> <inline-formula><tex-math notation="LaTeX">${\sf FADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">FADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq17-3068135.gif"/></alternatives></inline-formula> and <inline-formula><tex-math notation="LaTeX">${\sf iFADE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">iFADE</mml:mi></mml:math><inline-graphic xlink:href="liu-ieq18-3068135.gif"/></alternatives></inline-formula> are lightweight, e.g., they reduce the overhead of control messages compared with state-of-the-art by about 50 and 90 percent, respectively.
登录
查看更多内容
DOI：
10.1109/infocom.2017.8056994
发表时间：
2017-05
期刊：
IEEE INFOCOM 2017 - IEEE Conference on Computer Communications
影响因子：
--
作者：
P. Zhang
通讯作者：
P. Zhang
DOI：
10.1109/netsoft.2016.7502486
发表时间：
2016-06
期刊：
2016 IEEE NetSoft Conference and Workshops (NetSoft)
影响因子：
--
作者：
Tzu-Wei Chao;Yu-Ming Ke;Bo-Han Chen;Jhu-Lin Chen;Chen Jung Hsieh;Shao-Chuan Lee;H. Hsiao
通讯作者：
Tzu-Wei Chao;Yu-Ming Ke;Bo-Han Chen;Jhu-Lin Chen;Chen Jung Hsieh;Shao-Chuan Lee;H. Hsiao
DOI：
10.1007/978-3-319-15509-8_26
发表时间：
2015-03
期刊：
--
影响因子：
--
作者：
Maciej Kuźniar;Peter Perešíni;Dejan Kostic
通讯作者：
Maciej Kuźniar;Peter Perešíni;Dejan Kostic
DOI：
10.1109/tnet.2018.2873816
发表时间：
2018-10
期刊：
IEEE/ACM Transactions on Networking
影响因子：
--
作者：
R. Cohen;Evgeny Moroshko
通讯作者：
R. Cohen;Evgeny Moroshko
影响因子：
1.6
作者：
Ashwin Lall;Vyas Sekar;Mitsunori Ogihara;Jun Xu;Hui Zhang
通讯作者：
Ashwin Lall;Vyas Sekar;Mitsunori Ogihara;Jun Xu;Hui Zhang