Flow Rule Sampling for SDN Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined networking (SDN) environments, network anomalies such as network loops and packet leaks can occur due to incorrectly programmed or unexpectedly behaving flow rules, which are difficult to identify using traditional flow counters.
Innovation Solution
The implementation of flow rule sampling techniques, where sampling rules are included in flow rules to selectively transmit packet samples to the controller, allowing for the identification of unexpected network behavior by comparing actual network behavior with expected behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional flow counters are used to monitor network traffic, then the system complexity is low, but the ability to detect and characterize network anomalies is insufficient
Solution Approach 1:
The flow rule is segmented into multiple independent components: match fields, meters, go-to instructions, and actions. The sampling rule is further segmented into separate parameters (sampling enabled field, sampling criterion field) that can be independently configured and processed, allowing detailed anomaly detection without monolithic complexity
Solution Approach 2:
The patent adds a new dimension to flow rule monitoring by introducing sampling-based packet inspection alongside traditional flow counters. This dimensional expansion allows the system to detect anomalies at the packet level while maintaining aggregate statistics, resolving the contradiction between detection precision and system complexity
2Reliability
If flow rules are programmed to enforce network policies, then network security and control are improved, but unexpected behavior such as network loops and packet leaks may occur that are difficult to identify
Solution Approach 1:
The system implements feedback by sampling packets and comparing their actual path against the expected path defined by flow rules. When discrepancies are detected (such as packets taking unexpected routes indicating loops or leaks), the system can identify and report these anomalies, providing feedback on flow rule effectiveness and reliability
Solution Approach 2:
The sampling rule is configured in advance within the flow rule itself, enabling proactive monitoring of packet flows before anomalies can cause significant network damage. The sampling criterion field allows pre-definition of monitoring parameters for each flow rule, facilitating early detection of potential issues
Data Source
AI summary
A network anomaly may be detected by comparing the network behavior of a packet to an expected network behavior. The network behavior may be determined using a packet sample of a packet matching a flow rule that includes a sampling rule.