Time Dependent Diffusion Model for Security Driven Software Defined Networks Tadeusz Czachórski1 , Erol Gelenbe1 , Godlove Suila Kuaban1 , and Dariusz Marek2 1 Institute of Theoretical and Applied Informatics Polish Academy of Sciences ul. Baltycka 5, 44-100 Gliwice, Poland 2 The Silesian University of Technology Akademicka 16, 44-100 Gliwice, Poland Abstract. We present a model of a Software Defined Network (SDN) where frequent changes in routing and traffic rates at routers are needed to respond to the security, quality of service (QoS), and energy savings re- quirements of applications such as the Internet of Things. Such frequent path and traffic changes introduce time-dependent network behaviours, and standard queueing models are not well adapted to analyse the tran- sient regime, we propose a tractable diffusion approximation for both the transient and steady-state behaviour. Our model can represent any net- work topology transmitting time-dependent flows with routing changes, and computes queue length and delay distributions at each network node and along complete paths between senders and receivers. Using realistic router parameters, we show that transients occupy a significant fraction of system time, so that the optimisation conducted with SDN controllers needs to include the effect of time-dependent behaviours. Keywords: SDN, IoT Networks, Security, QoS, Routing, Transients, Diffusion Approximation 1 Introduction The Internet of Things (IoT) and its increasing volumes of traffic for new ser- vices such as video related to security, server virtualisation of the Cloud and Fog [38,8] and highly distributed data storage [22,9], create new challenges for the Internet [26,35]. Indeed, expanding IoT applications such as Health Moni- toring [32], Smart Homes [3] and Smart Vehicles [18], create large volumes of intermittent traffic with stringent security, QoS and energy minimisation needs [6]. Thus network structures based on static switches are not well suited to deliver high performance, energy efficiency and reliability in such dynamically chang- ing environments, and are not flexible enough to maintain Quality of Service (QoS) for increasingly complex networks. On the other hand, SDN [34,39] with intelligent programmable controllers can be aware of the overall state of nodes Copyright © 2020 for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). and links, and dynamically manage the network and adapt to new conditions [25]. Indeed, SDN provides flexible and scalable routing for intelligent networks [14] by separating the control and data planes for traffic engineering, link failure recovery, load balancing [40] and security issues [41]. Thus the concentration of network intelligence and management in SDN controllers enables innovative smart cognitive routing [17,21] to respond by changing network paths and traffic levels to meet the dynamic security, QoS and energy savings requirements of the IoT. Earlier studies of SDN switches have used steady-state queueing models such as M/M/1, M/H2 /1, M/G/1, M/Geo/1, GI/M/1/K, based on Markov chains, embedded Markov chains [29,2,36,28,16,31] or network calculus [4,5]. Thus they do not consider the frequent traffic changes due to controller decisions. To ad- dress this concern, we recently considered a single SDN forwarder and modelled it with a diffusion approximation [13], and considered a network of forwarders [12] to determine its transient behaviour. These studies have shown that under certain conditions, the transient regime can become dominant so that SDN based optimisation should consider the effect of transients. In SDN, paths are selected by a controller, and the SDN data plane routers are then simple forwarding devices that follow the rules given by the controller. An analysis of the performance of SDN switches and their cooperation with the controller may be found in [33,27,40]. Therefore this paper, we extend these studies to address a SDN based net- work that supports IoT applications, and modifies its paths and traffic levels to respond to unpredictable changes in security and QoS, so that the network has time-dependent routing. To address this challenge we apply a diffusion approxi- mation [24,20,30] which is well suited to investigate transient queueing problems with general interarrival and service time distributions for realistic network data. The next section details the method for a single network node, while the mathematical model of time-dependent routing in the network is presented in Section 3 where the system equations such as (12), ... , (16) include routing probabilities which are functions of time, leading to a novel approach in diffusion models. Numerical examples are provided in Section 4 and conclusions are drawn in Section 5. 2 Single Node Transient Analysis The diffusion approximation replaces the number of packets in a queueing system by the real-valued diffusion process {X(t)} ∈ [0, N ] where N is the maximum size of the queue. Following the approach in [19,23], at the extremities x = 0 and x = N of the diffusion interval, two absorbing barriers are placed so that when {X(t)} reaches a barrier, it stays there for a random time and jumps from x = 0 to x = 1 with intensity λ and from x = N to x = N − 1 with intensity µ. The resulting diffusion equation is: ∂f (x, t; x0 ) α ∂ 2 f (x, t; x0 ) ∂f (x, t; x0 ) = 2 −β + ∂t 2 ∂x ∂x +λp0 (t)δ(x − 1) + µpN (t)δ(x − N + 1) , dp0 (t) α ∂f (x, t; x0 ) = lim [ − βf (x, t; x0 )] − λp0 (t) , dt x→0 2 ∂x dpN (t) α ∂f (x, t; x0 ) = lim [− + βf (x, t; x0 )] − µpN (t) , (1) dt x→N 2 ∂x where δ(x) is the Dirac delta function, p0 (t), pN (t) are probabilities that the process is at the barrires at x = 0 or x = N , respectively, and f (x, t; x0 ) is probability density function (pdf) of the process {X(t)} f (x, t; x0 )dx = P [x ≤ X(t) < x + dx | X(0) = x0 ]. The incremental changes of {X(t)}, dX(t) = X(t + dt) − X(t) are normally distributed with the mean βdt and variance αdt where β, α are coefficients of the diffusion equation. The changes of the process {N (t)} during an interval θ 2 3 2 3 tend to normal distribution with mean (λ − µ)θ and variance (σA λ + σB µ )θ 2 2 where 1/λ and 1/µ are the mean interarrival and service times, and σA , σB are the variances of the interarrival and service times, respectively. The choice 2 3 2 3 2 2 β = λ − µ and α = σA λ + σB µ = CA λ + CB µ, 2 2 where CA , CB are squared coefficients of variation of interarrival and service times, assures that the changes of both processes {X(t)} and {N (t)} have normal distributions with the same parameters. To determine the solution of (1) we use the following appoach from [11]. First we consider a diffusion process with two absorbing barriers at x = 0 and x = N , started at t = 0 from x = x0 . Its probability density function φ(x, t; x0 ) has the following form [10]: δ(x − x0 )   for t = 0  ∞ n  0 0 2  1 βx (x − x − x − βt)  0  X √ n n exp −  φ(x, t; x0 ) = 2Π αt n=−∞ α 2αt  00 (x − x0 − x00n − βt)2 o     βxn   − exp − for t > 0 , α 2αt  (2) where x0n = 2nN , x00n = −2x0 − x0n . If the initial condition is defined by a function ψ(x), x ∈ (0, N ), limx→0 ψ(x) = limx→N ψ(x) = 0, then the pdf of the process is Z N φ(x, t; ψ) = φ(x, t; ξ)ψ(ξ)dξ. 0 The probability density function f (x, t; ψ) of the diffusion process with jumps from the boundaries is composed of the function φ(x, t; ψ) referring to the dif- fusion process before it reaches any barrier and of a spectrum of functions φ(x, t − τ ; 1), φ(x, t − τ ; N − 1) representing diffusion processes with absorb- ing barriers at x = 0 and x = N , started with densities g1 (τ ) and gN −1 (τ ) at time τ < t at points x = 1 and x = N − 1 due to jumps from the barriers: Z t Z t f (x, t; ψ) = φ(x, t; ψ)+ g1 (τ )φ(x, t−τ ; 1)dτ + gN −1 (τ )φ(x, t−τ ; N −1)dτ , 0 0 (3) where the densities g1 (τ ), gN −1 (τ ), as well as p0 (t) and pN (t), are obtained from the probability balance equations at the barriers. First, we compute densities γ0 (t), γN (t) of probability that at time t the process enters to x = 0 or x = N are Z t γ0 (t) = p0 (0)δ(t) + [1 − p0 (0) − pN (0)]γψ,0 (t) + g1 (τ )γ1,0 (t − τ )dτ 0 Z t + gN −1 (τ )γN −1,0 (t − τ )dτ , 0 Z t γN (t) = pN (0)δ(t) + [1 − p0 (0) − pN (0)]γψ,N (t) + g1 (τ )γ1,N (t − τ )dτ 0 Z t + gN −1 (τ )γN −1,N (t − τ )dτ , (4) 0 where γ1,0 (t), γ1,N (t), γN −1,0 (t), γN −1,N (t) are densities of the first passage time between corresponding points, e.g. α ∂φ(x, t; 1) γ1,0 (t) = lim [ − βφ(x, t; 1)] . (5) x→0 2 ∂x For absorbing barriers lim φ(x, t; x0 ) = lim φ(x, t; x0 ) = 0 , x→0 x→N hence γ1,0 (t) = limx→0 α2 ∂φ(x,t;1) ∂x . The functions γψ,0 (t), γψ,N (t) denote densi- ties of probabilities that the initial process, started at t = 0 at the point ξ with density ψ(ξ) will end at time t by entering respectively x = 0 or x = N . Finally, we may express g1 (t) and gN (t) with the use of functions γ0 (t) and γN (t): Z τ Z τ g1 (τ ) = γ0 (t)l0 (τ − t)dt , gN −1 (τ ) = γN (t)lN (τ − t)dt , (6) 0 0 where l0 (x), lN (x) are the densities of sojourn times in x = 0 and x = N ; the distributions of these times are not restricted to exponential ones as it is in Eq. (1). Technicaly, it is easier to compute this solution in Laplace domain where convolutions of functions become products. For any function h(t) we denote by h̄(s) its Laplace transform. The Laplace transform f¯(x, s; ψ) of the density function f (x, t; ψ) is f¯(x, s; ψ) = φ̄(x, s; ψ) + ḡ1 (s) φ̄(x, s; 1) + ḡN −1 (s) φ̄(x, s; N − 1) , (7) and the Laplace transform of φ(x, t; x0 ) can be expressed as ∞ exp[ β(x−x 0) |x − x0 − x0n |   α ] X n φ̄(x, s; x0 ) = exp − A(s) A(s) n=−∞ α |x − x0 − x00n |  o − exp − A(s) , (8) α p where A(s) = β 2 + 2αs. For computational efficiency, we rearranged the Eq. (8) to the form exp[ β(x−x 0)       α ] xA(s) x0 A(s) φ̄(x, s; x0 ) = 1(x≥x0 ) exp − 2 sinh A(s) α α      x0 A(s) xA(s) + 1(x0