a. bohlooli

Software defined networks have attracted enormous attention because they simplify the process of setting up the     network. They have been able to leave behind in a short time, most of the technologies that were used in traditional networks by industrialists and researchers. The ease and efficiency are due to the separation of control and data planes from each other such that the control plane is a logically centralized controller and the data plane switches in as the flow table has been implemented. In these networks, network topology adjustment is done using a flow table that has special flow rules and network services, such as Qos, security and etc., which operate as programs on the network. Flow tables can be directly or indirectly changed by any of these services in the network. Although access to the table of current units simplifies network configurations, it could lead to anomalies between flow rules for separate modules. In addition to consuming too much switch memory, these anomalies can cause problems for network security and    applications. Fortunately, so far, some researches on the detection of anomalies in flow tables of software defined  networks has been done but this method is not only imposing a great deal of time and processing on the controller, in some cases only conflict resolution has been performed. In this paper we have shown how to speed up the detection algorithm and then tried to improve the speed of anomaly detection algorithm in the flow table of switches in the    software defined networks using different variables.

Deep packet inspection is an unavoidable task to prevent the web-based attacks. HTTPS traffic constitutes a significant percentage of web traffic. In order to perform the deep packet inspection on HTTPS traffic, searchable encryption is used. Using searchable encryption, there is no need to decrypt the packet contents; hence the privacy is preserved. Besides, a significant percentage of HTTPS traffic is compressed before reaching the SSL layer. Compression consists of two stages: LZ77 compression and Huffman encoding. For compressed traffic, required tokens for performing searchable encryption are not accessible and the full decompression should be applied to access the tokens. In this case, token extraction is done by parsing a nondeterministic finite automata (NFA) on the decompressed contents. The goal of this paper is to decrease the time complexity of NFA parsing process. In the proposed method, instead of full decompression of the compressed traffic, at first Huffman decoding is applied on the packets to access the LZ77 compressed content. Then, the LZ77 pointers can be used to recognize the repeated substrings and to skip the NFA parsing process. Hence, the token extraction process is accelerated. The evaluations show that the proposed method decreases 65% of time of compressed HTTPS token extraction by skipping the 44% of characters.