As modern communication networks are growing more complicated and dynamic, designing a good Traffic Engineering (TE) policy becomes difficult due to the complexity of solving the optimal traffic scheduling problem. Deep Reinforcement Learning (DRL) provides us with a chance to design a model-free TE scheme through machine learning. However, existing DRL-based TE solutions cannot be applied to large networks. In this article, we propose to combine the control theory and DRL to design a TE scheme. Our proposed scheme ScaleDRL employs the idea from the pinning control theory to select a subset of links in the network and name them critical links. Based on the traffic distribution information, we use a DRL algorithm to dynamically adjust the link weights for the critical links. Through a weighted shortest path algorithm, the forwarding paths of the flows can be dynamically adjusted. The packet-level simulation shows that ScaleDRL reduces the average end-to-end transmission delay by up to 39% compared to the state-of-the-art in different network topologies.

The current infrastructure and technology system of the Internet are facing major challenges in terms of intelligence, diversification, personalization, robustness, and efficiency. It is urgent to change the network infrastructure and build a polymorphic definable and intelligent network. This paper studies and judges the development trend of network technologies in China and abroad, proposes the development goal of polymorphic definable and intelligent network, and extracts a list of key cutting-edge technologies for foresight. Based on these, the development roadmap of polymorphic definable and intelligent network in China for 2035 is constructed. China should prospect the research and development of key technologies including network architecture, addressing and routing, full-dimensional definability, network intelligence, and network robust control, and guide the development of relevant industries through the key contents including core chips, products, and systems. Demonstration projects can be deployed to promote the implementation of intelligent network business, including projects concerning information infrastructure, vertical industry network, space–earth integrated network, ubiquitous interconnection of human and things. In addition, this paper proposes some suggestions on the guarantee measures of polymorphic definable and intelligent network in China from the aspects of policy guarantee, scientific research platform support and joint research, international communication expansion, and human resource cultivation and employment.

软件定义网络(Software-Defined Networking,SDN)的集中式管控为网络带来了创新与便利,但主控制器被赋予了足够的管理权限,仅依赖其自身内部的防御技术,难以确保其不发生异常,以独裁的能力来危害整个网络.本文提出基于拟态防御的SDN控制层安全机制,以一种多样化民主监督的方式,使用多个异构的等价控制器同时处理数据层的请求,通过对比它们的流表项来检测主控制是否存在恶意行为.其中,重点研究了如何在语义层面对比多个异构控制器的流表项,以解决它们在语法上的差异化问题.该安全机制不依赖于对恶意行为的先验知识,实验结果验证了它检测恶意行为是有效的,同时具有较好的性能.

SDN控制器可实现网络的集中化管控,但易受到各种各样潜在的攻击导致整个网络崩溃.为提高SDN控制层的安全性,拟态防御技术被引用到SDN控制层,通过多个异构控制器同时处理请求,再对请求结果进行一致性判别,最后将最可能安全的规则下发给交换机,从而避免控制器因未知漏洞或后门而遭受攻击.然而,由于异构控制器生成的流规则在内容、数量等方面的不同,流规则的一致性判别较困难.从边缘端口输出流的一致性角度出发,通过建立流表规则的管道图,用几何方式表示边缘端口的输出流,并建立边缘端口流矩阵,通过对比矩阵判别规则的一致性.实验结果表明,该方法能够准确判别流规则的一致性,在性能方面可满足一般网络的实时性要求.

The centralized control of Software-Defined Networking (SDN) brings innovation and convenience to the network, but many current SDN controllers also have some security bugs that are easily exploited by attackers. Once the master controller which has sufficient management rights is compromised, entire network can be damaged. For this, we propose a mechanism of democratic supervision in SDN, which adds a proxy between the control plane and the data plane to monitor whether the master controller is abnormal. The proxy sends OpenFlow requests from the switch to multiple diverse controllers and collects flow entries that they respond to. Then it compares these flow entries to judge whether the behavior of the master controller is different from that of other controllers. However, flow entries with the same function may be different in number or content, so we need to analyze their forwarding semantics to compare them, instead of simply comparing their contents. The advantage of this supervision mechanism is that it allows the controller to defend against many known or unknown attacks without debugging all its vulnerabilities. Experimental results show that it is effective in detecting malicious behavior, and it is also efficient under a certain scale of networks.

Software defined network (SDN) proposes the architecture of separating the control logic and forwarding devices in networks,which brings the open API for freely programing and makes the network management more fine.However,while the centralized control of SDN brings innovation and convenience for network applications,it also brings other problems,for example the reliability problem and the scalability problem simultaneously.For the problem of control plane's reliability in SDN,the method that voting deals with the same OpenFlow messages by combing multiple controllers to a quorum view is proposed to tolerate Byzantine faults,which is different from the current OpenFlow protocol.Firstly,we concretely explain the network structure,workflow and exception handling in the application of Byzantine fault-tolerance algorithm with the feature of SDN,and establish the analytical model of multi-controller's deployment.Secondly,we design a heuristic algorithm to solve the problem of multi-controller's deployment.Finally,to verify the fault tolerance method and deploy algorithms by simulation,experimental results show that this method can effectively deal with controllers' faults,improving the reliability of the control layer,but it will sacrifice the system's performance at some level.Meanwhile,the deployment algorithm can effectively reduce the transmission delay of processing OpenFlow request.

Great convenience has been brought by the centralized control plane of Software-Defined Network (SDN),but a lot of security risks have been introduced into it as well.In the light of single point failure,unknown vulnerabilities and back doors,static configuration and other security problems of the controller,a secure architecture for SDN based on Byzantine protocol was proposed,in which the Byzantine protocol was executed between controllers and each switching device was controlled by a controller view and control messages were decided by several controllers.Furthermore,the dynamics and heterogeneity were introduced into the proposed structure,so that the attack chain was broken and the capabilities of network active defense were enhanced;moreover,based on the quantification of the controller heterogeneity,a two-stage algorithm was designed to seek for the controller view,so that the availability of the network and the security of the controller view were ensured.Simulation results show that compared with the traditional structure,the proposed structure is more resistant to attacks.

With the increasing diversity of network functions,packet classification had a higher demand on the number of match fields and depth of match table,which placed a severe burden on the storage capacity of hardware.To ensure the efficiency of matching process while at the same time improve the usage of storage devices,an information entropy based cutting algorithm on match fields was proposed.By the analysis on the redundancy of match fields and distribution pattern in a rule set,a match field cutting model was proposed.With the mapping of matching process to the process of entropy reduction,the complexity of optimal match field cutting was reduced from NP-hard to linear complexity.Experiment results show that compared to existing schemes,this scheme can need 40% less TCAM storage space,and on the other side,with the growing of table size,the time complexity of this algorithm is also far less than other algorithms.

For the problem of multi-controller’s consensus in SDN,a quantitative approach was proposed,which provided a more accurate and effective method of sharing network view for the control layer's east-west extension.Firstly,the metrics of consensus,performance and availability between the controllers with the feature of SDN was provided,establishing the common model for quantitative research.Secondly,for the three typical questions in the research of multi-controller’s consensus,the condition to achieve its optimal value was explicated,which provided a reference for the configuration of consensus.Finally,to verify the validity of the quantitative approach by simulation,experimental results show that this approach can improve the performance and availability of the control layer in SDN effectively.