Large latency of applications will bring revenue loss to cloud infrastructure providers in the cloud data center. The existing controllers of software-defined networking architecture can fetch and process traffic info...Large latency of applications will bring revenue loss to cloud infrastructure providers in the cloud data center. The existing controllers of software-defined networking architecture can fetch and process traffic information in the network. Therefore, the controllers can only optimize the network latency of applications. However, the serving latency of applications is also an important factor in delivered user-experience for arrival requests. Unintelligent request routing will cause large serving latency if arrival requests are allocated to overloaded virtual machines. To deal with the request routing problem, this paper proposes the workload-aware software-defined networking controller architecture. Then, request routing algorithms are proposed to minimize the total round trip time for every type of request by considering the congestion in the network and the workload in virtual machines（VMs）. This paper finally provides the evaluation of the proposed algorithms in a simulated prototype. The simulation results show that the proposed methodology is efficient compared with the existing approaches.展开更多
Over the past few decades, the world has witnessed a rapid growth in mobile and wireless networks（MWNs） which significantly change human life. However, proliferating mobile demands lead to several intractable challe...Over the past few decades, the world has witnessed a rapid growth in mobile and wireless networks（MWNs） which significantly change human life. However, proliferating mobile demands lead to several intractable challenges that MWN has to face. Software-defined network is expected as a promising way for future network and has captured growing attention. Network virtualization is an essential feature in software-defined wireless network（SDWN）, and it brings two new entities, physical networks and virtual networks. Accordingly, efficiently assigning spectrum resource to virtual networks is one of the fundamental problems in SDWN. Directly orienting towards the spectrum resource allocation problem, firstly, the fluctuation features of virtual network requirements in SDWN are researched, and the opportunistic spectrum sharing method is introduced to SDWN. Then, the problem is proved as NP-hardness. After that, a dynamic programming and graph theory based spectrum sharing algorithm is proposed.Simulations demonstrate that the opportunistic spectrum sharing method conspicuously improves the system performance up to around 20%–30% in SDWN, and the proposed algorithm achieves more efficient performance.展开更多
针对传统的IP欺骗攻击缓解方法存在运算开销大、缺乏灵活性等问题,提出了一种基于动态限制策略的软件定义网络(software defined network,SDN)中IP欺骗攻击缓解方法。首先,利用Packet-In消息中三元组信息回溯攻击路径,定位IP欺骗攻击源...针对传统的IP欺骗攻击缓解方法存在运算开销大、缺乏灵活性等问题,提出了一种基于动态限制策略的软件定义网络(software defined network,SDN)中IP欺骗攻击缓解方法。首先,利用Packet-In消息中三元组信息回溯攻击路径,定位IP欺骗攻击源头主机;然后,由控制器制定动态限制策略对连接攻击源头主机的交换机端口的新流转发功能进行限制,待限制期满再恢复其转发新流的功能,限制期的大小随着被检测为攻击源的次数而增长。研究结果表明:这种动态的限制策略可阻隔攻击流进入SDN网络,从而有效避免SDN交换机、控制器以及链路过载;由于在限制期间无需再对这些限制的交换机端口进行实时监测,该方法在应对长时攻击时较传统方法具有更高的缓解效率和更少的资源消耗。展开更多
针对基于真实流量的空、天、地、海异构波形组网验证需求,提出了一种基于容器的天地一体化软件定义网络(Software Defined Network,SDN)半实物组网验证架构,开展了面向SDN的异构子网组网能力验证,突破了异构网虚-实接口技术、基于真实...针对基于真实流量的空、天、地、海异构波形组网验证需求,提出了一种基于容器的天地一体化软件定义网络(Software Defined Network,SDN)半实物组网验证架构,开展了面向SDN的异构子网组网能力验证,突破了异构网虚-实接口技术、基于真实流量的组网仿真技术和模拟干扰应用环境组网验证技术。通过实验表明,该技术虚-实接口接入速率可达到物理总线最高传输速率90%以上,仿真网络可承载真实流量,能有效实现模拟应用环境的异构波形半实物组网验证,具有良好的可扩展性。展开更多
在卫星网络中,受地理位置及人们生活习惯等因素影响,卫星覆盖区域内用户的需求差异会造成卫星网络负载不均衡。针对这一问题,提出了一种基于卷积双延迟深度确定性策略梯度的多路径路由算法(Convolutional Twin Delayed Deep Determinist...在卫星网络中,受地理位置及人们生活习惯等因素影响,卫星覆盖区域内用户的需求差异会造成卫星网络负载不均衡。针对这一问题,提出了一种基于卷积双延迟深度确定性策略梯度的多路径路由算法(Convolutional Twin Delayed Deep Deterministic Policy Gradient Multipath Routing,CTD3-MR)。该算法在软件定义网络(Software Defined Network,SDN)结构下,将CTD3作为智能体部署在控制器中,并将动态变化的链路剩余带宽、传输时延、丢包率和时空等级作为网络状态输入智能体进行训练,输出动作为网络链路的权值,使用最大链路带宽利用率、平均端到端时延和网络丢包率的加权和作为奖励函数来调整动作。智能体训练收敛后,控制器根据智能体输出的网络链路权重得到k-最短路径,把路径权重比作为路径流量分配比率,生成最优路由策略转发至卫星进行多路径传输。最后将CTD3-MR与TD3,TMR和ECMP路由算法进行比较,实验结果表明,CTD3-MR相较于其他路由算法,平均端到端时延至少缩短了7.64%,丢包率降低了28.65%,最大链路带宽利用率降低了11.44%,流量分布指数提高了5.82%,提高了网络负载均衡性能。展开更多
针对工业物联网中业务需求多样性和服务质量(Quality of Service,QoS)要求差异性导致的网络资源利用低问题,提出一种基于深度强化学习的网络切片资源分配策略。该策略运用深度强化学习优化网络切片资源分配的准入控制,通过智能体在特定...针对工业物联网中业务需求多样性和服务质量(Quality of Service,QoS)要求差异性导致的网络资源利用低问题,提出一种基于深度强化学习的网络切片资源分配策略。该策略运用深度强化学习优化网络切片资源分配的准入控制,通过智能体在特定时间窗口内处理资源请求,并根据不同网络切片的QoS要求及请求准入结果进行资源的动态分配。实验结果表明,所提策略相比基准算法在提高网络收益、资源利用率和接收率方面分别提升了8.33%、9.84%和8.57%。该策略能够在保证服务质量的同时提高整个网络的效率和性能。展开更多
针对工业控制网络(Industrial Control Network, ICN)远程接入场景下未经授权访问、拒绝服务攻击、欺骗攻击以及信息披露等安全问题,通过STRIDE威胁建模方法对该场景下的潜在威胁进行分析,提出一种基于动态贝叶斯博弈的接入检测框架。...针对工业控制网络(Industrial Control Network, ICN)远程接入场景下未经授权访问、拒绝服务攻击、欺骗攻击以及信息披露等安全问题,通过STRIDE威胁建模方法对该场景下的潜在威胁进行分析,提出一种基于动态贝叶斯博弈的接入检测框架。该方法能够将试图接入ICN的非法、恶意请求筛选出来并阻断,同时利用持续进行的多轮博弈迭代以及SDN灵活动态的特性对策略参数进行实时调整,以防止相同恶意接入源的再次访问。仿真实验结果表明,随着博弈轮数的增加,相比于现有的两类恶意接入防御方法,该框架的检测准确性提升了3%以上,假阳性比例下降了1.2%以上,检测效率提升了14.7%以上,且具有较好的鲁棒性。展开更多
基金supported by the National Postdoctoral Science Foundation of China(2014M550068)
文摘Large latency of applications will bring revenue loss to cloud infrastructure providers in the cloud data center. The existing controllers of software-defined networking architecture can fetch and process traffic information in the network. Therefore, the controllers can only optimize the network latency of applications. However, the serving latency of applications is also an important factor in delivered user-experience for arrival requests. Unintelligent request routing will cause large serving latency if arrival requests are allocated to overloaded virtual machines. To deal with the request routing problem, this paper proposes the workload-aware software-defined networking controller architecture. Then, request routing algorithms are proposed to minimize the total round trip time for every type of request by considering the congestion in the network and the workload in virtual machines（VMs）. This paper finally provides the evaluation of the proposed algorithms in a simulated prototype. The simulation results show that the proposed methodology is efficient compared with the existing approaches.
基金supported by the National Natural Science Foundation of China(6102100161133015+4 种基金61171065)the National Natural Science Foundation of China(973 Program)(2013CB329001)the National High Technology ResearchDevelopment Program(863 Program)(2013AA0106052013AA013500)
文摘Over the past few decades, the world has witnessed a rapid growth in mobile and wireless networks（MWNs） which significantly change human life. However, proliferating mobile demands lead to several intractable challenges that MWN has to face. Software-defined network is expected as a promising way for future network and has captured growing attention. Network virtualization is an essential feature in software-defined wireless network（SDWN）, and it brings two new entities, physical networks and virtual networks. Accordingly, efficiently assigning spectrum resource to virtual networks is one of the fundamental problems in SDWN. Directly orienting towards the spectrum resource allocation problem, firstly, the fluctuation features of virtual network requirements in SDWN are researched, and the opportunistic spectrum sharing method is introduced to SDWN. Then, the problem is proved as NP-hardness. After that, a dynamic programming and graph theory based spectrum sharing algorithm is proposed.Simulations demonstrate that the opportunistic spectrum sharing method conspicuously improves the system performance up to around 20%–30% in SDWN, and the proposed algorithm achieves more efficient performance.
文摘针对传统的IP欺骗攻击缓解方法存在运算开销大、缺乏灵活性等问题,提出了一种基于动态限制策略的软件定义网络(software defined network,SDN)中IP欺骗攻击缓解方法。首先,利用Packet-In消息中三元组信息回溯攻击路径,定位IP欺骗攻击源头主机;然后,由控制器制定动态限制策略对连接攻击源头主机的交换机端口的新流转发功能进行限制,待限制期满再恢复其转发新流的功能,限制期的大小随着被检测为攻击源的次数而增长。研究结果表明:这种动态的限制策略可阻隔攻击流进入SDN网络,从而有效避免SDN交换机、控制器以及链路过载;由于在限制期间无需再对这些限制的交换机端口进行实时监测,该方法在应对长时攻击时较传统方法具有更高的缓解效率和更少的资源消耗。
文摘针对基于真实流量的空、天、地、海异构波形组网验证需求,提出了一种基于容器的天地一体化软件定义网络(Software Defined Network,SDN)半实物组网验证架构,开展了面向SDN的异构子网组网能力验证,突破了异构网虚-实接口技术、基于真实流量的组网仿真技术和模拟干扰应用环境组网验证技术。通过实验表明,该技术虚-实接口接入速率可达到物理总线最高传输速率90%以上,仿真网络可承载真实流量,能有效实现模拟应用环境的异构波形半实物组网验证,具有良好的可扩展性。
文摘针对工业物联网中业务需求多样性和服务质量(Quality of Service,QoS)要求差异性导致的网络资源利用低问题,提出一种基于深度强化学习的网络切片资源分配策略。该策略运用深度强化学习优化网络切片资源分配的准入控制,通过智能体在特定时间窗口内处理资源请求,并根据不同网络切片的QoS要求及请求准入结果进行资源的动态分配。实验结果表明,所提策略相比基准算法在提高网络收益、资源利用率和接收率方面分别提升了8.33%、9.84%和8.57%。该策略能够在保证服务质量的同时提高整个网络的效率和性能。
文摘针对工业控制网络(Industrial Control Network, ICN)远程接入场景下未经授权访问、拒绝服务攻击、欺骗攻击以及信息披露等安全问题,通过STRIDE威胁建模方法对该场景下的潜在威胁进行分析,提出一种基于动态贝叶斯博弈的接入检测框架。该方法能够将试图接入ICN的非法、恶意请求筛选出来并阻断,同时利用持续进行的多轮博弈迭代以及SDN灵活动态的特性对策略参数进行实时调整,以防止相同恶意接入源的再次访问。仿真实验结果表明,随着博弈轮数的增加,相比于现有的两类恶意接入防御方法,该框架的检测准确性提升了3%以上,假阳性比例下降了1.2%以上,检测效率提升了14.7%以上,且具有较好的鲁棒性。
