IEEE Transactions on Network and Service Management最新文献

筛选
英文 中文
UAV-Assisted MEC Architecture for Collaborative Task Offloading in Urban IoT Environment 城市物联网环境下无人机辅助MEC架构协同任务卸载
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-27 DOI: 10.1109/TNSM.2025.3535094
Subhrajit Barick;Chetna Singhal
{"title":"UAV-Assisted MEC Architecture for Collaborative Task Offloading in Urban IoT Environment","authors":"Subhrajit Barick;Chetna Singhal","doi":"10.1109/TNSM.2025.3535094","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3535094","url":null,"abstract":"Mobile edge computing (MEC) is a promising technology to meet the increasing demands and computing limitations of complex Internet of Things (IoT) devices. However, implementing MEC in urban environments can be challenging due to factors like high device density, complex infrastructure, and limited network coverage. Network congestion and connectivity issues can adversely affect user satisfaction. Hence, in this article, we use uncrewed aerial vehicle (UAV)-assisted collaborative MEC architecture to facilitate task offloading of IoT devices in urban environments. We utilize the combined capabilities of UAVs and ground edge servers (ESs) to maximize user satisfaction and thereby also maximize the service provider’s (SP) profit. We design IoT task-offloading as joint IoT-UAV-ES association and UAV-network topology optimization problem. Due to NP-hard nature, we break the problem into two subproblems: offload strategy optimization and UAV topology optimization. We develop a Three-sided Matching with Size and Cyclic preference (TMSC) based task offloading algorithm to find stable association between IoTs, UAVs, and ESs to achieve system objective. We also propose a K-means based iterative algorithm to decide the minimum number of UAVs and their positions to provide offloading services to maximum IoTs in the system. Finally, we demonstrate the efficacy of the proposed task offloading scheme over benchmark schemes through simulation-based evaluation. The proposed scheme outperforms by 19%, 12%, and 25% on average in terms of percentage of served IoTs, average user satisfaction, and SP profit, respectively, with 25% lesser UAVs, making it an effective solution to support IoT task requirements in urban environments using UAV-assisted MEC architecture.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 1","pages":"732-743"},"PeriodicalIF":4.7,"publicationDate":"2025-01-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143621874","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Analytical Scheduling for Selfishness Detection in OppNets Based on Differential Game 基于微分对策的OppNets自利检测分析调度
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-27 DOI: 10.1109/TNSM.2025.3535082
Yang Gao;Jun Tao;Zuyan Wang;Yifan Xu
{"title":"Analytical Scheduling for Selfishness Detection in OppNets Based on Differential Game","authors":"Yang Gao;Jun Tao;Zuyan Wang;Yifan Xu","doi":"10.1109/TNSM.2025.3535082","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3535082","url":null,"abstract":"Selfishness detection offers an effective way to mitigate the routing performance degradation caused by selfish behaviors in Opportunistic Networks but leads to extra network traffic and computational burden. Most existing efforts focus on designing the selfishness detection scheme by exploiting the behavioral records of nodes. In this paper, we investigate the scheduling strategy of selfishness detection during the message lifespan with the game theory. Specifically, the Long-term Selfishness Detection Game (LSDG) is proposed based on the differential game and the payoff in the integral form. LSDG formulates the selfishness detection and the node’s selfishness with the Ordinary Differential Equations (ODEs). Then, we prove the existence of the Nash equilibrium in LSDG and deduce the necessary conditions of the equilibrium strategy based on Pontryagin’s maximum principle. The recursion-based algorithm is designed in this paper to compute the numerical solution of the equilibrium strategy via Euler’s method. Both the soundness of our modeling approach and solution properties are verified by extensive experiments. The simulations also show that the obtained solution can achieve the Nash equilibrium, where neither the source node nor relay nodes can benefit more by solely changing their own strategies.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 1","pages":"270-283"},"PeriodicalIF":4.7,"publicationDate":"2025-01-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143621619","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Energy-Efficient UAV-Assisted Federated Learning: Trajectory Optimization, Device Scheduling, and Resource Management 高能效无人机辅助联合学习:轨迹优化、设备调度和资源管理
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-27 DOI: 10.1109/TNSM.2025.3531237
Zhenyu Fu;Juan Liu;Yuyi Mao;Long Qu;Lingfu Xie;Xijun Wang
{"title":"Energy-Efficient UAV-Assisted Federated Learning: Trajectory Optimization, Device Scheduling, and Resource Management","authors":"Zhenyu Fu;Juan Liu;Yuyi Mao;Long Qu;Lingfu Xie;Xijun Wang","doi":"10.1109/TNSM.2025.3531237","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3531237","url":null,"abstract":"The emergence of intelligent mobile technologies and the widespread adoption of 5G wireless networks have made Federated Learning (FL) a promising method for protecting privacy during distributed model training. However, traditional FL frameworks rely on static aggregators such as base stations, encountering obstacles such as increased energy demands, frequent disconnections, and poor model performance. To address these issues, this paper investigates an innovative aUtonomous Aerial Vehicle (UAV)-assisted FL framework, aiming to utilize UAVs as mobile model aggregators to collaborate with devices in training models, while minimizing the total energy consumption of devices and ensuring that FL can achieve the target model accuracy. By adopting the Distributed Approximate NEwton (DANE) method for local optimization, we analyze the convergence of FL and derive device scheduling constraints that aid in convergence. Accordingly, we formulate a problem of minimizing the total energy consumption of devices, integrating a constraint on global model accuracy, and jointly optimizing the UAV trajectory, device scheduling, bandwidth allocation, time slot lengths, as well as the uplink transmission power, CPU frequency, and local convergence accuracy. Then, we decompose this non-convex optimization problem into three subproblems and propose an iterative algorithm based on Block Coordinate Descent (BCD) with convergence guarantee. Simulation results indicate that, compared with various benchmark methods, our proposed UAV-assisted FL framework significantly reduces the total energy consumption of devices and achieves an improved trade-off between energy and convergence accuracy.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"974-988"},"PeriodicalIF":4.7,"publicationDate":"2025-01-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860954","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
DRL-Based Maximization of the Sum Cross-Layer Achievable Rate for Networks Under Jamming 干扰下基于drl的网络跨层可达速率总和最大化
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-24 DOI: 10.1109/TNSM.2025.3534028
Abdul Basit;Muddasir Rahim;Tri Nhu Do;Nadir Adam;Georges Kaddoum
{"title":"DRL-Based Maximization of the Sum Cross-Layer Achievable Rate for Networks Under Jamming","authors":"Abdul Basit;Muddasir Rahim;Tri Nhu Do;Nadir Adam;Georges Kaddoum","doi":"10.1109/TNSM.2025.3534028","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3534028","url":null,"abstract":"In quasi-static wireless networks characterized by infrequent changes in the transmission schedules of user equipment (UE), malicious jammers can easily deteriorate network performance. Accordingly, a key challenge in these networks is managing channel access amidst jammers and under dynamic channel conditions. In this context, we propose a robust learning-based mechanism for channel access in multi-cell quasi-static networks under jamming. The network comprises multiple legitimate UEs, including predefined UEs (pUEs) with stochastic predefined schedules and an intelligent UE (iUE) with an undefined transmission schedule, all transmitting over a shared, time-varying uplink channel. Jammers transmit unwanted packets to disturb the pUEs’ and the iUE’s communication. The iUE’s learning process is based on the deep reinforcement learning (DRL) framework, utilizing a residual network (ResNet)-based deep Q-Network (DQN). To coexist in the network and maximize the network’s sum cross-layer achievable rate (SCLAR), the iUE must learn the unknown network dynamics while concurrently adapting to dynamic channel conditions. Our simulation results reveal that, with properly defined state space, action space, and rewards in DRL, the iUE can effectively coexist in the network, maximizing channel utilization and the network’s SCLAR by judiciously selecting transmission time slots and thus avoiding collisions and jamming.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1295-1313"},"PeriodicalIF":4.7,"publicationDate":"2025-01-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860777","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Self-Adaptive Dynamic In-Band Network Telemetry Orchestration for Balancing Accuracy and Stability 平衡精度和稳定性的自适应动态带内网络遥测编排
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-23 DOI: 10.1109/TNSM.2025.3530432
Tianhao Ouyang;Haipeng Yao;Wenji He;Tianle Mai;Fu Wang;F. Richard Yu
{"title":"Self-Adaptive Dynamic In-Band Network Telemetry Orchestration for Balancing Accuracy and Stability","authors":"Tianhao Ouyang;Haipeng Yao;Wenji He;Tianle Mai;Fu Wang;F. Richard Yu","doi":"10.1109/TNSM.2025.3530432","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3530432","url":null,"abstract":"In-band network telemetry (INT) is an emerging network measurement technique that offers real-time and fine-grained visualization capabilities for networks. However, the utilization of INT for network measurement introduces additional overheads to the network. The process of data collection consumes extra bandwidth resources, and adjustments to the data collection scheme can impact network stability. Additionally, the INT orchestration scheme requires adaptation to dynamics in the network to improve measurement accuracy. Therefore, striking a balance between accuracy and stability becomes a critical problem. In this paper, our focus lies in the trade-off between measurement accuracy and network stability. We consider the long-term orchestration of multiple telemetry tasks, rationally deploying distinct telemetry tasks to different application flows. To address the challenge, we propose a self-adaptive Dynamic INT Orchestration scheme, D-INTO. Specifically, we formulate a stochastic optimization problem for dynamic INT orchestration. Then we employ Lyapunov optimization to decouple the stochastic optimization problem and use surrogate Lagrangian relaxation to construct a polynomial-time approximation algorithm. Theoretical analysis and experimental results demonstrate that our proposed D-INTO outperforms existing schemes in terms of adaptability to the network dynamics.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1514-1530"},"PeriodicalIF":4.7,"publicationDate":"2025-01-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143871110","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Path Selection via Mutual Coherence Optimization in Network Monitoring 基于互相干优化的网络监控路径选择
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-21 DOI: 10.1109/TNSM.2025.3532343
XiaoBo Fan
{"title":"Path Selection via Mutual Coherence Optimization in Network Monitoring","authors":"XiaoBo Fan","doi":"10.1109/TNSM.2025.3532343","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3532343","url":null,"abstract":"Periodically monitoring the state of internal links is important for network diagnosis. One of the major problems in tomography-based network monitoring is to select which paths to measure. In this paper, we propose a new path selection scheme by means of optimizing the mutual coherence of the routing matrix. The proposed scheme exploits the sparse characteristic of link status and follows the matrix design methods in sparse signal theory. By picking the paths with the minimum average mutual coherence, we can recover a sparse vector more accurately. The effectiveness of the proposed algorithms is analyzed theoretically. We conduct simulation experiments of delay estimation on both synthetic and real topologies. The results demonstrate that our scheme can select the most useful paths for network tomography with lowest cost in an acceptable time.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1461-1472"},"PeriodicalIF":4.7,"publicationDate":"2025-01-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143870946","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Properties of Horizontal Pod Autoscaling Algorithms and Application for Scaling Cloud-Native Network Functions 水平 Pod 自动伸缩算法的特性及在云原生网络功能伸缩中的应用
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-20 DOI: 10.1109/TNSM.2025.3532121
Tien Van Do;Nam H. Do;Csaba Rotter;T. V. Lakshman;Csaba Biro;Tamas Bérczes
{"title":"Properties of Horizontal Pod Autoscaling Algorithms and Application for Scaling Cloud-Native Network Functions","authors":"Tien Van Do;Nam H. Do;Csaba Rotter;T. V. Lakshman;Csaba Biro;Tamas Bérczes","doi":"10.1109/TNSM.2025.3532121","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3532121","url":null,"abstract":"With the growing adoption of network function virtualization, telco core network elements and network functions will increasingly be designed and deployed as cloud-native application instances. To ensure the efficient use of virtualised resources and meet diverse requirements for quality of services a resource scaling algorithm is used to scale the number of application instances up or down depending on variations in offered traffic from customers. Most of the observed performance metrics for a service are a function of the current customer traffic and the current number of application instances providing the service. The ubiquitous use of Kubernetes, the popular open-source framework for deployment and management of cloud-native functions, has resulted in variants of the Kubernetes Horizontal Pod Autoscaling (HPA) algorithm being widely used to change the number of application instances providing network functions as traffic demands vary. This change is done by determining whether a selected performance metric of interest is outside a range set by two input parameters (the desired metric value and the tolerance parameter). In this paper, we investigate the characteristics of the HPA algorithms and prove that there are only a finite number of intervals for its tolerance parameter. Further any choice of the tolerance parameter from each interval leads to similar computational decisions on the recommended number of application instances. As a consequence, the number of parameter setting choices is finite due to the rule that the desired metric value can only be an integer in specific ranges. Additionally, we investigate the use of HPA for scaling application instances that provide session-based services and establish lower and the upper bounds for the performance of the HPA scaling algorithms in this scenario. Our contributions can help operators find appropriate parameter settings efficiently - administrators of Kubernetes clusters only need to select parameters from a limited and finite number of choices (instead of infinite) for scaling cloud-native applications.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"1889-1898"},"PeriodicalIF":4.7,"publicationDate":"2025-01-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860956","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Priority-Dominated Traffic Scheduling Enabled ATS in Time-Sensitive Networking 时间敏感型网络中优先级占主导地位的流量调度 ATS
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-20 DOI: 10.1109/TNSM.2025.3532080
Lihui Zhang;Gang Sun;Rulin Liu;Wei Quan;Hongfang Yu;Dusit Niyato
{"title":"Priority-Dominated Traffic Scheduling Enabled ATS in Time-Sensitive Networking","authors":"Lihui Zhang;Gang Sun;Rulin Liu;Wei Quan;Hongfang Yu;Dusit Niyato","doi":"10.1109/TNSM.2025.3532080","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3532080","url":null,"abstract":"Time-Sensitive Networking (TSN) employs shaping mechanisms such as Time-Aware Shaping (TAS) and Cyclic Queuing and Forwarding (CQF), which depend heavily on precise time synchronization and complex Gate Control Lists (GCL) configurations, limiting their effectiveness in large-scale mixed traffic networks like those in vehicular systems. In response, IEEE 802.1Qcr protocol introduces the Asynchronous Traffic Shaping (ATS) mechanism, based on Urgency-Based Schedulers (UBS), to asynchronously address diverse traffic needs and ensure low and predictable latency. Nonetheless, no traffic scheduling algorithm exists that can be directly applied to ATS shapers in generic large-scale traffic scenarios to solve for fixed end-to-end (E2E) delay constraints and the number of priority queues.In this paper, we propose an urgency-based fast flow scheduling algorithm (UBFS) to address the issue. UBFS leverages domain-specific optimizing strategies with a focus on traffic delay urgency inspired by greedy algorithm for priority allocation across hops and flows, complemented by preprocessing for scenario solvability and dynamic verification to ensure scheduling feasibility. We benchmark UBFS against the method with both scalability and solution quality in typical network topology and demonstrate that UBFS achieves more rapid scheduling within seconds across linear, ring, and star topologies. Notably, UBFS significantly outperforms the baseline algorithm in scheduling efficiency in mixed and large-scale traffic environments, scheduling a larger number of flows. UBFS also reduces time costs by 2-10 times in delay-sensitive environments and by more than 10 times in large-scale scenarios, effectively balancing time efficiency, performance and scalability, thereby enhancing its applicability in real-world industrial settings.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 1","pages":"470-484"},"PeriodicalIF":4.7,"publicationDate":"2025-01-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143621902","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Programmable Real-Time Scheduling of Disaggregated Network Functions: A Theoretical Model 分解网络功能的可编程实时调度:一个理论模型
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-20 DOI: 10.1109/TNSM.2025.3531989
Tamás Lévai;Balázs Vass;Gábor Rétvári
{"title":"Programmable Real-Time Scheduling of Disaggregated Network Functions: A Theoretical Model","authors":"Tamás Lévai;Balázs Vass;Gábor Rétvári","doi":"10.1109/TNSM.2025.3531989","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3531989","url":null,"abstract":"Novel telecommunication systems build on a cloudified architecture running softwarized network services as disaggregated virtual network functions (VNFs) on commercial off-the-shelf (COTS) hardware to improve costs and flexibility. Given the stringent processing deadlines of modern applications, these systems are critically dependent on a closed-loop control algorithm to orchestrate the execution of the disaggregated components. At the moment, however, the formal model for implementing such real-time control loops is mostly missing. In this paper, we introduce a new real-time VNF execution environment that runs entirely on COTS hardware. First, we define a comprehensive formal model that enables us to reason about packet processing delays across disaggregated VNF processing chains analytically. Then we integrate the model into a gradient-optimization control algorithm to provide optimal scheduling for real-time infocommunication services in a programmable way. We present experimental evidence that our model gives a proper delay estimation on a real software switch. We evaluate our control algorithm on multiple representative use cases using a software switch simulator. Our results show the algorithm drives the system to a real-time capable state in just a few control periods even in case of complex services.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 1","pages":"485-498"},"PeriodicalIF":4.7,"publicationDate":"2025-01-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143621756","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Elastic Cross-Layer Orchestration of Network Policies in the Kubernetes Stack Kubernetes堆栈中网络策略的弹性跨层编排
IF 4.7 2区 计算机科学
IEEE Transactions on Network and Service Management Pub Date : 2025-01-17 DOI: 10.1109/TNSM.2025.3531040
Gerald Budigiri;Christoph Baumann;Eddy Truyen;Wouter Joosen
{"title":"Elastic Cross-Layer Orchestration of Network Policies in the Kubernetes Stack","authors":"Gerald Budigiri;Christoph Baumann;Eddy Truyen;Wouter Joosen","doi":"10.1109/TNSM.2025.3531040","DOIUrl":"https://doi.org/10.1109/TNSM.2025.3531040","url":null,"abstract":"Packaging applications in Containers, dynamically managed using a cluster orchestrator, is the de-facto approach for deployment of cloud-native applications. When Containers run inside Virtual Machines (VMs) to protect infrastructural assets, Network Policies at the Container layer and Security Groups at the VM layer provide complementary firewall mechanisms that strengthen defenses against lateral movement of attackers. However, least-privilege network policies at the Container layer may not always be consistent with statically defined, over-permissive Security Groups at the VM layer. This is especially a problem with low-latency configuration of Container networking solutions that requires every opened Container protocol, port and traffic direction also to be opened at the VM layer. In any post-exploitation scenario where attackers escape from within an already compromised or infected Container, such over-permissive Security Groups do not prevent the attacker from spreading across VMs to find powerful tokens for accessing the cluster orchestrator. In this paper, we introduce GrassHopper, a fast and dynamic cross-layer enforcement approach for Network Policies, which automatically generates Security Group configurations from dynamically verified Network Policies and Container scheduling decisions. Given the low-latency context, the design of GrassHopper must ensure that dynamically generated Security Group rules come in a timely manner to effect before the newly scheduled Containers become ready to serve traffic. We evaluate the performance of GrassHopper on a Kubernetes cluster running on OpenStack at the network and application level. In comparison to a Security Group management approach that is not scheduling-aware, our findings show that for low-latency applications GrassHopper can reduce the network attack surface between VMs at a ratio of 78-to-99%, while causing no network performance overhead at the application level with respect to latency and throughput.","PeriodicalId":13423,"journal":{"name":"IEEE Transactions on Network and Service Management","volume":"22 2","pages":"2031-2058"},"PeriodicalIF":4.7,"publicationDate":"2025-01-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143860759","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术官方微信