A Systematic Literature Review on Military Software Defined Networks <s> Tools <s> Global Environment for Network Innovation (GENI) is a comprehensive test bed technology to promote rapid network research and application development. It provides sliceable experimental spaces for conducting isolated computational experiment and supports Open Flow and other Software Defined Network (SDN) features for conducting comprehensive network research. GENI deployment at US Army Research Laboratory (ARL) uses its own Aggregate Manager (AM) and slice authority. In future, ARL GENI will provide clearinghouse services via Department of Defense (DOD) GENI Authority (DGA) portal to other DOD GENI nodes. <s> BIB001 </s> A Systematic Literature Review on Military Software Defined Networks <s> Tools <s> Tactical military networks present a challenging environment for the delivery of information services. A tactical network must support a dynamically changing force in the face of physical and electronic threats and where bandwidth is scarce. The network manager faces an almost impossible task to deliver vital information with the required quality of service in the face of changing operational priorities. This paper describes a structured methodology to assess emerging technologies such as Software Defined Networks (SDN) which can deliver increased agility and reduce the operator burden in tactical networks. It presents initial results from the application of this methodology. <s> BIB002 </s> A Systematic Literature Review on Military Software Defined Networks <s> Tools <s> While attackers have used deception to hide their identities, cause surprise, or mislead victims, defensive use of deception has been limited to honeypots and moving target defenses (MTDs). This has left unexplored a powerful defensive strategy namely, active manipulation of the adversary's decision loop. In contrast to the passive approach of honeypots and MTDs, this active approach deliberately interacts with the adversary to cause him to think he is succeeding and expend effort in an alternate reality. The work described in this paper took initial steps to realize active defensive deception in the context of distributed systems and built a prototype that creates an alternate reality in which to trap, learn about, and manipulate adversarial actors without affecting normal and legitimate operations. This prototype, called KAGE, employs Software Defined Networking (SDN), and virtualization to create a malleable substrate in which deception can occur. Deception is necessarily context dependent. In the case of KAGE, deception is tied to the mission purpose served by the distributed system being defended, specifically the services running, and the configuration, scale, and complexity of the environment. Consequently, there is no single deception strategy that will fit all system and mission contexts. KAGE therefore presents a framework through which a wide array of deceptions can be composed from component building blocks. This work-in-progress paper introduces the concept of active defensive cyber deception, discusses the early stage KAGE prototype, and introduces some of the challenges intrinsic to enabling defensive deception in distributed environments. <s> BIB003 </s> A Systematic Literature Review on Military Software Defined Networks <s> Tools <s> Tactical networks are wireless in nature to support mobility and rapid deployment in contested environments. These networks also consist of various heterogeneous networking technologies. Since the tactical networks are specialized purpose built networks and their main motivation is to solve a special purpose functions, the interoperability between different technologies was not initially viewed as essential. As the deployment of wireless networks become ubiquitous both in private and government sectors, the lack of interoperability has become a disadvantage in creating a unified control plane. A unified control plane can abstract the complexity of heterogeneous wireless networks and can provide a centralized control over the network resources. In this paper, we develop necessary mathematical model to realize the unified programmable control plane for heterogeneous wireless networks. We develop a cross-layer optimization framework, which characterizes the interaction between physical, link, and network layer for the unified programmable control plane in a heterogeneous wireless network. By applying the framework on a throughput maximization problem, we will show an application of the model to solve practical issues in a tactical network and gain some theoretical insight on the optimal behavior of the unified programmable control plane for a heterogeneous wireless network. <s> BIB004 </s> A Systematic Literature Review on Military Software Defined Networks <s> Tools <s> Software-defined networks offer a promising framework for the implementation of cross-layer data-centric security policies in military systems. An important aspect of the design process for such advanced security solutions is the thorough experimental assessment and validation of proposed technical concepts prior to their deployment in operational military systems. In this paper, we describe an OpenFlow-based testbed, which was developed with a specific focus on validation of SDN security mechanisms - including both the mechanisms for protecting the software-defined network layer and the cross-layer enforcement of higher level policies, such as data-centric security policies. We also present initial experimentation results obtained using the testbed, which confirm its ability to validate simulation and analytic predictions. Our objective is to provide a sufficiently detailed description of the configuration used in our testbed so that it can be easily re-plicated and re-used by other security researchers in their experiments. <s> BIB005 </s> A Systematic Literature Review on Military Software Defined Networks <s> Tools <s> The Cyber Security Simulation Service (CSSS) is a platform that provides a simulation environment modeling the impact of cyber attacks and related countermeasure in tactical networks exploiting the software defined networking (SDN) paradigm. CSSS integrates a generator of tactical scenarios, a network simulator, a graphical user interface, and a real SDN controller. The scenario generator, network simulator and user interface interact with each others exploiting a NATO standard called High Level Architecture (HLA); the real SDN controller instead interacts with the simulator by exploiting the system in the loop approach and can interact with the graphical user interface through a proprietary protocol. The CSSS can be used as training tool and/or Decision Support System by cyber and IT operators in tactical contexts. <s> BIB006
With a research contribution related to tools, one article provided a basic evaluation related to tactical networks. In this, Spencer et al. BIB002 assessed the integration of the SDN paradigm across tactical networks, discussing the expected benefits and potential threats. The article provides a comprehensive analysis of the characteristics of tactical networks, in conjunction with an overview of the architectural and operational attributes of SDN, aligning the two by extracting the expected benefits to the tactical user. These relate primarily to enhancements of information dissemination, service delivery, and link utilization. Furthermore, the authors provide an iterative assessment methodology regarding the performance gains by such an integration, the design options in respect to tactical SDN controllers, and challenges that need to be addressed. It must be noted that no extensive validation is provided within the article referring to the proposed methodology. Therefore, it is not clear if the results of the study are exhaustive, mutually exclusive, or if there are any identified interdependencies. Furthermore, three articles within this sub-category have a scope related to security, either directly related to military or distributed networks. Wrona et al. BIB005 described an OpenFlow-based test-bed for the validation of SDN security mechanisms-including both the mechanisms for protecting the SDN and the cross-layer enforcement of higher level policies, such as data-centric security policies. Such cross-layer security mechanisms are important in the context of software-defined infrastructure and implementation of new security paradigms, such as data-centric security. Furthermore, the authors demonstrate the functional correctness of the test-bed, as well as its suitability to provide validation and additional insight into the behavior of analytically designed security mechanisms. The authors present a low-cost implementation of a flexible SDN test-bed, specifically focused on security experimentation in respect to security services provided by SDN to both the network and application layer. The test-bed consists of seven switches (annotated S1 to S7), a controller, a server and a typical switch for VPN connection. It can be split into two networks: a control network (connections between the switches and the controller) and a data network (connections between the switches, including the server). There is also a VPN network allowing remote configuration of all test-bed nodes via SSH protocol. All switches use the Ubuntu 16.04 operating system and OpenVSwitch 2.1.1-based (OVS) implementation of OpenFlow protocol in bridge configuration. The test-bed can be also used for the validation of earlier results, obtained analytically or from emulation (e.g., Mininet) and simulation (e.g., ns-3) tools. Lee et al.  proposed a redesigned untraceable Blind Packet Forwarding (BPF) method, based on the Public-key Encryption with Keyword Search for Restricted Testability (PEKS-RT) algorithm, in which the specific host IP address cannot be guessed. The main feature of this approach is that when the source host encrypts the destination host address, it includes the source host's private key, the destination host's public key, and the destination host address as parameters for encryption. Another feature is that the destination host generates the trapdoor value using the destination host address, the source host's public key and the destination host's private key. A centralized SDN controller is used for reducing the overhead of routing data processing of the existing method, increasing this way the operational efficiency. The authors describe a prototype implementation for the blind packet forwarding using PEKS-RT. Their approach is realized in the SDN environment using the Mininet emulator, where Open vSwitch is used as a switch and Floodlight as a controller. The function of the Floodlight controller is expanded to implement the untraceable blind packet forwarding, and it can manage the trapdoor table and control the path using PEKS-RT. Stanford PBC library is used to generate key pairs, trapdoor values and encrypted addresses. Furthermore, Soule et al. BIB003 described active defensive deception in the context of distributed systems, and built a prototype that creates an alternate reality in which to trap, learn about, and manipulate adversarial actors without affecting normal and legitimate operations. This prototype, called KAGE, employs SDN and virtualization in order to create a malleable substrate in which deception can occur. The authors demonstrate a preliminary feasibility test of an active deception approach. The test implemented and successfully executed multiple variations of a demonstration scenario that integrates and exercises many of the major KAGE components, in order to orchestrate a brief deception campaign. The demonstration makes use two KAGE plugins: a port scan detector acting as a sensor, and an SQL injection detector adapted to work as both a KAGE sensor and actuator. The distributed nature of KAGEs' building blocks adds complexity, in terms of dynamic distributed composition, and with respect to the timing expectations/challenges regarding interactions with networks, hosts, and services. Furthermore, deviation from expectations can provide indicators to attackers that they are being deceived. Mishra et al. BIB001 discuss the Global Environment for Network Innovation (GENI) deployment and research at the US Army Research Laboratory. GENI is a comprehensive test-bed technology to promote rapid network research and application development. It provides sliceable experimental spaces for conducting isolated computational experiment, and supports OpenFlow and other SDN features for conducting comprehensive network research. The Army Research Laboratory (ARL) deploys its own clearinghouse that can act as GENI authority for its own nodes, as well as for all other GENI nodes that come up on the Department of Defense (DOD) network. This customization helps ARL to stand up its node, without delegating its authority to an external entity. Moreover, Jalaian et al. BIB004 developed a mathematical model in order to realize a unified programmable control plane for heterogeneous wireless networks. The developed framework characterizes the interaction between the physical, link, and network layers for the unified programmable control plane in a heterogeneous wireless network. By applying the framework on a throughput maximization problem, the authors show an application of the model on solving practical issues in a tactical network and gaining some theoretical insights on the optimal behavior of the unified programmable control plane for a heterogeneous wireless network. The authors present numerical results to study the performance of the unified control plane for wireless heterogeneous network. Simulation settings consider a randomly generated multi-hop wireless network with 30 nodes that are distributed in a 100 × 100 area. All units for distance, data rate, bandwidth, and power with appropriate dimensions are normalized, while at the network layer minimum-hop routing is employed. Additionally, Battiati et al. BIB006 presented a Cyber Security Simulation Service (CSSS) platform, which provides a simulation environment for modeling the impact of cyber-attacks and related countermeasures in tactical networks using SDN. The CSSS integrates a scenario simulator, a network/cyber simulator, a graphical user interface, and a real SDN Controller. Furthermore, the authors showed the functionality of the CSSS in a specific use case, i.e., a black hole attack is performed and the BRAVO (A Black-hole Resilient Ad Hoc on demand distance Vector Routing for tactical communications) approach is utilized as a countermeasure. Finally, Li et al.  presented a hierarchical self-organizing SDN architecture for mobile tactical networks, where the network is dynamically self organized and partitioned into multiple temporary domains, while each domain is assigned with a node that operates as the local SDN controller. A corresponding protocol is proposed by the authors, including (i) a neighborhood discovery mechanism, (ii) a distributed network partition algorithm, and (iii) an abstraction of dynamics. The proposed mechanisms provide strong incentives towards future research and development, although extended verification and proof of concept experiments are recommended. Validation and evaluation of performance, resilience and security solutions for complex systems like military networks remain difficult problems. Simulators, emulation platforms and test-beds are useful for proving the efficiency and feasibility of new network architectures/designs and algorithms, and evaluate their capability to address specific challenges of military networks. Future research directions include: • Designing experiments to study SDN-enabled multi-domain heterogeneous networks, non-IP protocol innovations, and building SDN network exchange (SDX) to act as policy based SDN network peering point for connecting various SDN network prefixes. • Simulating/experimenting developed mathematical models for realizing a unified programmable control plane, with support of a realistic number of nodes for wireless heterogeneous network. • Testing the content-based security concept in network exchange points such as Software Defined Exchange. • Examining the performance of operational aspects of Software Defined Coalitions (SDC) in an emulated test-bed.