{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T15:47:07Z","timestamp":1782834427413,"version":"3.54.5"},"reference-count":42,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2020,3,18]],"date-time":"2020-03-18T00:00:00Z","timestamp":1584489600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2020,3,18]],"date-time":"2020-03-18T00:00:00Z","timestamp":1584489600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Netw Syst Manage"],"published-print":{"date-parts":[[2020,7]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Software-Defined-Networking (SDN) has been recently arising as a new technology in the IT industry. It is a network architecture that hopes to provide better solutions to most of the constraints in contemporary networks. SDN is a centralized control architecture for networking in which the control plane is separated from the data plane, the network services are abstracted from the underlying forwarding devices, and the network\u2019s intelligence is centralized in a software-based directly-programmed device called a controller. These features of SDN provide more flexible, programmable and innovative network\u2019s architecture. However, they may pose new vulnerabilities and may lead to new security problems. In this paper, we propose the application-aware firewall mechanism for SDN, which can be implemented as an extension to the network\u2019s controller. In order to provide more control and visibility in applications running over the network, the system is able to detect network applications that may at some point affect network\u2019s performance, and it is capable to dynamically enforce constraint rules on applications. The firewall architecture is designed as four cooperating modules: the Main Module, the Filtering Module, the Application Identification Module, and the Security-Enforcement Module. The proposed mechanism checks the network traffic at the network, transport, and application levels, and installs appropriate security instructions down into the network. The proposed solution features were implemented and tested using a Python-based POX controller, and the network topology was built using Mininet emulation tool.<\/jats:p>","DOI":"10.1007\/s10922-020-09518-z","type":"journal-article","created":{"date-parts":[[2020,3,18]],"date-time":"2020-03-18T12:39:16Z","timestamp":1584535156000},"page":"605-626","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":20,"title":["Application-Aware Firewall Mechanism for Software Defined Networks"],"prefix":"10.1007","volume":"28","author":[{"given":"Fahad N.","family":"Nife","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zbigniew","family":"Kotulski","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2020,3,18]]},"reference":[{"key":"9518_CR1","doi-asserted-by":"publisher","first-page":"25487","DOI":"10.1109\/ACCESS.2017.2762291","volume":"5","author":"JH Cox","year":"2017","unstructured":"Cox, J.H., Chung, J., Donovan, S., Ivey, J., Clark, R.J., Riley, G., Owen, H.L.: Advancing Software-Defined Networks: a survey. IEEE Access 5, 25487\u201325526 (2017). https:\/\/doi.org\/10.1109\/ACCESS.2017.2762291","journal-title":"IEEE Access"},{"issue":"2","key":"9518_CR2","doi-asserted-by":"publisher","first-page":"321","DOI":"10.1007\/s10922-016-9393-9","volume":"25","author":"S Singh","year":"2017","unstructured":"Singh, S., Jha, R.K.: A Survey on Software Defined Networking: architecture for next generation network. J. Netw. Syst. Manag. 25(2), 321\u2013374 (2017). https:\/\/doi.org\/10.1007\/s10922-016-9393-9","journal-title":"J. Netw. Syst. Manag."},{"issue":"1","key":"9518_CR3","doi-asserted-by":"publisher","first-page":"325","DOI":"10.1109\/COMST.2016.2618874","volume":"19","author":"DB Rawat","year":"2017","unstructured":"Rawat, D.B., Reddy, S.R.: Software Defined Networking architecture, security and energy efficiency: a survey. IEEE Commun. Surv. Tutor. 19(1), 325\u2013346 (2017). https:\/\/doi.org\/10.1109\/COMST.2016.2618874","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"2","key":"9518_CR4","doi-asserted-by":"publisher","first-page":"69","DOI":"10.1145\/1355734.1355746","volume":"38","author":"N McKeown","year":"2008","unstructured":"McKeown, N., Anderson, T., Balakrishnan, H., Parulkar, G., Peterson, L., Rexford, J., Shenker, S., Turner, J.: Openflow: enabling innovation in campus networks. SIGCOMM Comput. Commun. Rev. 38(2), 69\u201374 (2008)","journal-title":"SIGCOMM Comput. Commun. Rev."},{"issue":"1","key":"9518_CR5","doi-asserted-by":"publisher","first-page":"14","DOI":"10.1109\/JPROC.2014.2371999","volume":"103","author":"D Kreutz","year":"2015","unstructured":"Kreutz, D., Ramos, F.M.V., Verissimo, P.E., Rothenberg, C.E., Azodolmolky, S., Uhlig, S.: Software-Defined Networking: a comprehensive survey. Proc. IEEE 103(1), 14\u201376 (2015). https:\/\/doi.org\/10.1109\/JPROC.2014.2371999","journal-title":"Proc. IEEE"},{"key":"9518_CR6","unstructured":"Heller, B., Sherwood, R., McKeown, N.: The controller placement problem. In Proc. 1st ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking (HotSDN), Helsinki, Finland, pp. 7\u201312, (2012)"},{"key":"9518_CR7","unstructured":"Kreutz D., Ramos F. M. V., and Verissimo P.: Towards secure and dependable software\\_defined\\_networks. In: Proc. 2nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking (HotSDN), Hong Kong, China, pp. 55\u201360, (2013)"},{"key":"9518_CR8","unstructured":"The Open Networking Foundation, OpenFlow Switch Specification (2014)"},{"key":"9518_CR9","doi-asserted-by":"publisher","first-page":"1617","DOI":"10.1109\/SURV.2014.012214.00180","volume":"16","author":"BN Astuto","year":"2014","unstructured":"Astuto, B.N., Mendonca, M., Nguyen, X.N., Obraczka, K., Turletti, T.: A survey of Software-Defined Networking: past, present, and future of programmable networks. IEEE Commun. Surv. Tutor. 16, 1617\u20131634 (2014)","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"9518_CR10","unstructured":"Sharma, R. K., Kalita, H. K., Issac, B.: Different firewall techniques: a survey. In: 5th IEEE ICCCNT, Hefei, Anhui, China, pp. 1\u20136, (2014)"},{"issue":"1","key":"9518_CR11","doi-asserted-by":"publisher","first-page":"65","DOI":"10.26599\/TST.2018.9010003","volume":"24","author":"Y Cheng","year":"2018","unstructured":"Cheng, Y., Wang, W., Wang, J., Wang, H.: FPC: a new approach to firewall policies compression. Tsinghua Sci. Technol. 24(1), 65\u201376 (2018). https:\/\/doi.org\/10.26599\/TST.2018.9010003","journal-title":"Tsinghua Sci. Technol."},{"issue":"7","key":"9518_CR12","doi-asserted-by":"publisher","first-page":"73","DOI":"10.1109\/MCOM.2013.6553681","volume":"51","author":"Q Duan","year":"2013","unstructured":"Duan, Q., Al-shaer, E.: Traffic-aware dynamic firewall policy management: techniques and applications. IEEE Commun. Mag. 51(7), 73\u201379 (2013). https:\/\/doi.org\/10.1109\/MCOM.2013.6553681","journal-title":"IEEE Commun. Mag."},{"key":"9518_CR13","unstructured":"Trabelsi, Z.: Teaching stateless and stateful firewall packet filtering: a hands-on approach. In: Proc. 16th Colloquium for Information Systems Security Education, Florida, USA, pp. 95\u2013102, (2012)"},{"key":"9518_CR14","doi-asserted-by":"publisher","unstructured":"Krit, S., and Haimoud, E.: Overview of firewalls: Types and policies: Managing windows embedded firewall programmatically. In: 2017 International Conference on Engineering & MIS (ICEMIS), Monastir, pp. 1\u20137, (2017). https:\/\/doi.org\/10.1109\/ICEMIS.2017.8273003","DOI":"10.1109\/ICEMIS.2017.8273003"},{"key":"9518_CR15","doi-asserted-by":"publisher","first-page":"89","DOI":"10.1016\/j.jnca.2019.01.019","volume":"131","author":"R Sahay","year":"2019","unstructured":"Sahay, R., Meng, W., Jensen, C.D.: The application of Software Defined Networking on securing computer networks: a survey. J. Netw. Comput. Appl. 131, 89\u2013108 (2019). https:\/\/doi.org\/10.1016\/j.jnca.2019.01.019","journal-title":"J. Netw. Comput. Appl."},{"key":"9518_CR16","doi-asserted-by":"publisher","unstructured":"Zeineddine A., and El-Hajj W.: Stateful Distributed Firewall as a Service in SDN. In: 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, 2018, pp. 212-216 (2018). https:\/\/doi.org\/10.1109\/NETSOFT.2018.8460126","DOI":"10.1109\/NETSOFT.2018.8460126"},{"key":"9518_CR17","doi-asserted-by":"publisher","unstructured":"Krongbaramee P., and Somchit Y.: Implementation of SDN Stateful Firewall on Data Plane using Open vSwitch. In: 2018 15th International Joint Conference on Computer Science and Software Engineering (JCSSE), Nakhonpathom, 2018, pp. 1\u20135, (2018). https:\/\/doi.org\/10.1109\/JCSSE.2018.8457354","DOI":"10.1109\/JCSSE.2018.8457354"},{"key":"9518_CR18","doi-asserted-by":"publisher","unstructured":"Neu C. V., Tatsch C. G., Lunardi R. C., Michelin R. A., Orozco A. M. S.,and Zorzo A. F.: Lightweight IPS for port scan in OpenFlow SDN networks. In NOMS 2018 IEEE\/IFIP Network Operations and Manag. Symposium, Taipei, Taiwan, pp. 1\u20136, (2018). https:\/\/doi.org\/10.1109\/NOMS.2018.8406313","DOI":"10.1109\/NOMS.2018.8406313"},{"key":"9518_CR19","doi-asserted-by":"publisher","unstructured":"Chang Y., and Lin T.: Cloud-clustered firewall with distributed SDN devices. In: 2018 IEEE Wireless Communications and Networking Conference (WCNC), Barcelona, pp. 1\u20135. (2018). https:\/\/doi.org\/10.1109\/WCNC.2018.8377305","DOI":"10.1109\/WCNC.2018.8377305"},{"key":"9518_CR20","doi-asserted-by":"publisher","first-page":"74","DOI":"10.1007\/978-3-319-92459-5_7","volume-title":"New SDN-Oriented authentication and Access Control Mechanism","author":"F Nife","year":"2018","unstructured":"Nife, F., Kotulski, Z.: Computer networks. CN 2018. Communications in computer and information science. In: Gaj, P., Sawicki, M., Suchacka, G., Kwiecie\u0144, A. (eds.) New SDN-Oriented authentication and Access Control Mechanism, vol. 860, pp. 74\u201388. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-92459-5_7"},{"key":"9518_CR21","doi-asserted-by":"publisher","unstructured":"Liu, C., Raghuramu, A., Chuah C., Krishnamurthy, B.: Piggybacking network functions on SDN reactive routing: a feasibility study. In Proc. ACM SOSR \u201917. Santa Clara, CA, USA, pp. 34\u201340, (2017). https:\/\/doi.org\/10.1145\/3050220.3050225","DOI":"10.1145\/3050220.3050225"},{"key":"9518_CR22","unstructured":"Snort: https:\/\/snort.org"},{"key":"9518_CR23","doi-asserted-by":"crossref","unstructured":"Jarschel, M., Wamser, F., H\u00f6hn, T., Zinner, T., Tran-Gia, P.: SDN-based application-aware networking on the example of YouTube video streaming. In: 2013 Second European Workshop on Software Defined Networks (EWSDN), pp. 87\u201392. IEEE, (2013)","DOI":"10.1109\/EWSDN.2013.21"},{"key":"9518_CR24","doi-asserted-by":"crossref","unstructured":"Braga, R., Mota, E., Passito, A.: Lightweight DDoS flooding attack detection using NOX\/OpenFlow. In 2010 IEEE 35th Conference on Local Computer Networks (LCN), pp. 408\u2013415, (2010)","DOI":"10.1109\/LCN.2010.5735752"},{"key":"9518_CR25","first-page":"1","volume":"2015","author":"B Ng","year":"2015","unstructured":"Ng, B., Hayes, M., Seah, W.K.G.: Developing a traffic classification platform for enterprise networks with SDN: experiences amp; lessons learned. IFIP Netw. Conf. 2015, 1\u20139 (2015)","journal-title":"IFIP Netw. Conf."},{"key":"9518_CR26","doi-asserted-by":"publisher","unstructured":"Santos, R., Bozakov, Z., Mangiante, S., Brunstrom A., Kassler, A.: A NEAT framework for application-awareness in SDN environments. In: 2017 IFIP Networking Conference (IFIP Networking) and Workshops, Stockholm, pp. 1\u20132, (2017). https:\/\/doi.org\/10.23919\/IFIPNetworking.2017.8264887","DOI":"10.23919\/IFIPNetworking.2017.8264887"},{"key":"9518_CR27","doi-asserted-by":"publisher","unstructured":"Mekky, H., Hao, F., Mukherjee, S.: Application-aware Data Plane Processing in SDN. In: Proc. of the 3th Workshop on Hot Topics in Software Defined Networking, pp. 13\u201318, USA, (2014). https:\/\/doi.org\/10.1145\/2620728.2620735","DOI":"10.1145\/2620728.2620735"},{"key":"9518_CR28","doi-asserted-by":"publisher","first-page":"271","DOI":"10.1007\/978-3-319-59767-6_22","volume-title":"Multi-level Stateful Firewall Mechanism for Software Defined Networks","author":"F Nife","year":"2017","unstructured":"Nife, F., Kotulski, Z.: Computer networks. CN 2017. Communications in computer and information science. In: Gaj, P., Kwiecie\u0144, A., Sawicki, M. (eds.) Multi-level Stateful Firewall Mechanism for Software Defined Networks, vol. 718, pp. 271\u2013286. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-59767-6_22"},{"issue":"4","key":"9518_CR29","doi-asserted-by":"publisher","first-page":"673","DOI":"10.18576\/amis\/120401","volume":"12","author":"F Nife","year":"2018","unstructured":"Nife, F., Kotulski, Z., Reyad, O.: New SDN-oriented distributed network security system. Appl. Math. Inf. Sci. 12(4), 673\u2013683 (2018). https:\/\/doi.org\/10.18576\/amis\/120401","journal-title":"Appl. Math. Inf. Sci."},{"key":"9518_CR30","doi-asserted-by":"crossref","unstructured":"Aceto, G., Dainotti, A., de Donato, W., Pescape, A.: PortLoad: taking the best of two worlds in traffic classification. In: 2010 INFOCOM IEEE Conference on Computer Communications Workshops, pp. 1\u20135, (2010)","DOI":"10.1109\/INFCOMW.2010.5466645"},{"key":"9518_CR31","doi-asserted-by":"publisher","unstructured":"Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., Lee, K.: Internet traffic classification demystified: myths, caveats, and the best practices. In Proc. ACM CoNEXT Conf., pp. 1\u201312, (2008). https:\/\/doi.org\/10.1145\/1544012.1544023","DOI":"10.1145\/1544012.1544023"},{"key":"9518_CR32","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.2006.883010","author":"T Auld","year":"2007","unstructured":"Auld, T., Moore, A.W., Gull, S.F.: Bayesian neural networks for internet traffic classification. IEEE Trans. Neur. Netw. (2007). https:\/\/doi.org\/10.1109\/TNN.2006.883010","journal-title":"IEEE Trans. Neur. Netw."},{"issue":"1","key":"9518_CR33","doi-asserted-by":"publisher","first-page":"50","DOI":"10.1145\/1071690.1064220","volume":"33","author":"Andrew W. Moore","year":"2005","unstructured":"Moore, A., Zuev, D.: Internet traffic classification using Bayesian analysis techniques. In ACM SIGMETRICS, pp. 50\u201360, (2005). https:\/\/doi.org\/10.1145\/1071690.1064220","journal-title":"ACM SIGMETRICS Performance Evaluation Review"},{"key":"9518_CR34","doi-asserted-by":"publisher","unstructured":"Prete, L. R., Shinoda, A. A., Schweitzer, C. M., de Oliveira, R. L. S.: Simulation in an SDN network scenario using the POX Controller. In :2014 IEEE Colombian Conference on Communications and Computing (COLCOM), Bogota, pp. 1\u20136, (2014). https:\/\/doi.org\/10.1109\/ColComCon.2014.6860403","DOI":"10.1109\/ColComCon.2014.6860403"},{"key":"9518_CR35","doi-asserted-by":"publisher","unstructured":"de Oliveira, R. L. S., Schweitzer, C. M., Shinoda, A. A., Prete, L. R.: Using Mininet for emulation and prototyping Software-Defined Networks. In: 2014 IEEE Colombian Conference on Communications and Computing (COLCOM), Bogota, pp. 1\u20136, (2014). https:\/\/doi.org\/10.1109\/ColComCon.2014.6860404","DOI":"10.1109\/ColComCon.2014.6860404"},{"key":"9518_CR36","unstructured":"Pfaff, B., Pettit, J., Koponen, T., Jackson, E. J., Zhou, A., Rajahalme, J., Gross, J., Wang, A., Stringer, J., Shelar, P., Amidon, K., Casado, A.: The Design and Implementation of Open vSwitch. In: Proc.12th USENIX Symposium on Networked Systems Design and Implementation, NSDI, pp. 117\u2013130, (2015)"},{"key":"9518_CR37","unstructured":"Internet Assigned Numbers Authority (IANA).http:\/\/www.iana.org\/assignments\/port-numbers"},{"key":"9518_CR38","unstructured":"Fontugne, R., Borgnat, P., Abry, P., Fukuda, K.: MAWILab: Combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking. ACM CoNEXT 2010. Philadelphia, PA, (2010). http:\/\/mawi.wide.ad.jp\/mawi\/"},{"key":"9518_CR39","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.02.019","author":"A Botta","year":"2012","unstructured":"Botta, A., Dainotti, A., Pescape, A.: A tool for the generation of realistic network workload for emerging networking scenarios. Comput. Netw. Int. J. Comput. Telecommun. Netw. (2012). https:\/\/doi.org\/10.1016\/j.comnet.2012.02.019","journal-title":"Comput. Netw. Int. J. Comput. Telecommun. Netw."},{"key":"9518_CR40","doi-asserted-by":"publisher","unstructured":"Bradner, S., McQuaid, J.: RFC2544-Benchmarking Methodology for Network Interconnect Devices. (1999) https:\/\/doi.org\/10.17487\/RFC2544","DOI":"10.17487\/RFC2544"},{"key":"9518_CR41","doi-asserted-by":"publisher","first-page":"10332","DOI":"10.1109\/ACCESS.2018.2799879","volume":"6","author":"AAA El-Latif","year":"2018","unstructured":"El-Latif, A.A.A., Abd-El-Atty, B., Hossain, M.S., Elmougy, S., Ghoneim, A.: Secure quantum steganography protocol for fog cloud internet of things. IEEE Access 6, 10332\u201310340 (2018). https:\/\/doi.org\/10.1109\/ACCESS.2018.2799879","journal-title":"IEEE Access"},{"key":"9518_CR42","doi-asserted-by":"publisher","first-page":"283","DOI":"10.1007\/978-3-642-34135-9_29","volume-title":"Communications in Computer and Information Science","author":"Jerzy Konorski","year":"2012","unstructured":"Konorski, J., Pacyna, P., Ko\u0142aczek, G., Kotulski, Z., Cabaj, K., Sza\u0142achowski, P.: A Virtualization-Level Future Internet Defense-in-Depth Architecture. CCIS, Recent Trends in Computer Networks and Distributed Systems Security, Part 1, vol.335, Springer-Verlag, Berlin Heidelberg, pp. 283\u2013292, (2012). https:\/\/doi.org\/10.1007\/978-3-642-34135-9_29"}],"container-title":["Journal of Network and Systems Management"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10922-020-09518-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10922-020-09518-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10922-020-09518-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,3,18]],"date-time":"2021-03-18T00:34:57Z","timestamp":1616027697000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10922-020-09518-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,3,18]]},"references-count":42,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2020,7]]}},"alternative-id":["9518"],"URL":"https:\/\/doi.org\/10.1007\/s10922-020-09518-z","relation":{},"ISSN":["1064-7570","1573-7705"],"issn-type":[{"value":"1064-7570","type":"print"},{"value":"1573-7705","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,3,18]]},"assertion":[{"value":"28 June 2019","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 November 2019","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"27 February 2020","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"18 March 2020","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}