Unknown cyber-attacks have appeared constantly. Several anomaly detection techniques based on semi-supervised learning have been proposed to detect these unknown cyber-attacks. Among them, the Denoising Auto-Encoder (DAE) scheme performs better than others in accuracy but is not good enough in precision. This paper proposes a novel two-stage deep learning structure for network flow anomaly detection by combining the models of Gate Recurrent Unit (GRU) and DAE. By using supervised anomaly detection with a selection mechanism to assist semi-supervised anomaly detection, the precision and accuracy of the anomaly detection system are improved. In the proposed structure, we first use the GRU model to analyze the network flow and then take the outcome from the Softmax function as a confidence score. When the score is more than or equal to the predefined confidence threshold, the GRU model outputs the flow as a positive result, no matter the flow is classified as normal or abnormal. When the score is less than the confidence threshold, GRU model outputs the flow as a negative result and passes the flow to DAE model for flow classification. DAE then determines a reconstruction error threshold by learning the pattern of normal flows. Accordingly, the flow is normal or abnormal depending on whether it is under or over the reconstruction error threshold. A comparative experiment is performed using NSL-KDD dataset as benchmark. The results revealed that the precision using the proposed scheme is 0.83% better than DAE. The accuracy using the proposed approach is 90.21%, which is better than Random Forest, Naïve Bayes, One-Dimensional Convolutional Neural Network, two-stage Auto-Encoder, etc. In addition, the proposed approach is also applied to the environment of software defined network (SDN). By adopting our approach in SDN environment, the precision and F-measure are significantly improved.

Due to the increasing number of computer hosts deployed in an enterprise, automatic management of electronic applications is inevitable. To provide diverse services, there will be increases in procurement, maintenance, and electricity costs. Virtualization technology is getting popular in cloud computing environment, which enables the efficient use of computing resources and reduces the operating cost. In this paper, we present an automatic mechanism to consolidate virtual servers and shut down the idle physical machines during the off‐peak hours, while activating more machines at peak times. Through the monitoring of system resources, heavy system loads can be evenly distributed over physical machines to achieve load balancing. By integrating the feature of load balancing with virtual machine live migration, we successfully develop an automatic private cloud management system. Experimental results demonstrate that, during the off‐peak hours, we can save power consumption of about 69 W by consolidating the idle virtual servers. And the load balancing implementation has shown that two machines with 80% and 40% CPU loads can be uniformly balanced to 60% each. And, through the use of preallocated virtual machine images, the proposed mechanism can be easily applied to a large amount of physical machines.

In reactive mode software-defined networking (SDN) networks, a new initiated flow requires back-and-forth communications between the controller and the switches along the forwarding route. As SDN is getting popularly accepted, many studies have reported on how to reduce the amount of communication traffic and to release the controller’s loading. Several techniques have been proposed, such as proactive and active mode integration, MPLS adoption, and various forwarding rule installation techniques. In this paper, we adopt the idea of the tunnel penetration technique, called the tunnel boring machine in SDN or SDN-TBM, to effectively cut down the traffic between switches and the controller as well as to speed up packet delivery. Using the TBM mechanism, the communication symmetry between the controller and the switches on the path is broken and transformed into asymmetry. Only the first and last switches of each application flow need to make forwarding queries to the controller, and all intermediate switches simply forward packets consisting of the forwarding information needed to determine the next-hop switch. An M/M/1 queueing model is developed to verify the feasibility and efficiency of the proposal. Under the simulation of more than a million flows with 3–8 intermediate switches, the packet sojourn time using SDN-TBM mechanism is less than that of adopting the conventional SDN and JumpFlow model. Additionally, by adopting SDN-TBM, both the number of packet-in and packet-out packets and the controller’s loading are significantly reduced.

In this paper we focus on how to efficiently mitigate the traffic without changing the packet routing in SDN networks. We propose a lightweight packet delivery scheme to mitigate the communication load between the SDN controller and switches. Whenever an initial packet-in packet arrives, the packet's data is deposited on the controller, so called a depository buffer, until the destined switch is reached. Simulation environment includes ONOS, Mininet with topology of Fat Tree and Spine leaf. The experimental results show that a significant reduction of the network traffic load can be accomplished, especially when more intermediate switches are getting involved.