## 4 Innovation through SDN-Based Network Applications
### Security and Network Access Control  
Traditional enterprise network security relies on securing the hosts and the application of middleboxes, such as firewalls, intrusion detection systems and network address translators. However, middleboxes are often placed at the edges of the network, due to the lack of network routing control. In [44], the authors allow middleboxes to be placed freely in the network, e.g., in a virtual machine on any physical host. OpenFlow-based SDN is used to steer traffic directly to the responsible middleboxes. Furthermore, in [45], middlebox traversal depending on network policies is controlled by SDN. Network function virtualization (NFV) [46] is a highly related topic and is standardized at the European Telecommunications Standards Institute (ETSI). Network functions, which are often provided by specialized hardware, can be virtualized with NFV. Then, virtual network functions can reside as virtual machines on general purpose servers within the network. As with middleboxes, SDN can be used to steer traffic to virtualized middleboxes and network functions. Service function chaining (SFC) is used to combine various network services. SFC is standardized in the IETF [47] and was previously called network service chaining (NSC) in the IETF. In [48], the authors point out future research directions in NSC. As illustrated in [44,45], SDN can achieve service function chaining by steering traffic to middleboxes depending on network policies. In [49], the authors propose the system \"Resonance\" that provides dynamic access control policies. Their solution is based on OpenFlow to implement network access control in network elements. Due to the flexibility and the possibility of fine-grained entries, they can achieve reactive and dynamic network access control without the use of specialized middleboxes. They also highlight the disadvantages and limitation of their current VLAN-based access control architecture and show how the SDN approach overcomes those limitations and problems. A similar topic, the enforcement of network-wide policies, is discussed in [50]. The authors propose the VeriFlow architecture, which can be used to check and enforce network policies and invariants in real time. Such invariants can include checks for forwarding loops, suboptimal routing and access control violations. [PERSON] _et al._[51] implement address validation based on SDN so that address spoofing can be efficiently prohibited. The approach is based on selective installation of flow entries that either allow or drop packets. If a packet arrives that does not match any installed entry, the controller is queried. Then, the controller checks if the given address is authorized to send the packets. When spoofing is detected, explicit drop rules are installed in the switches to prevent further actions by a malicious intruder. Moving target defense prevents attacks that rely on static IP address assignments, such as stealthy scanning and worm propagation. The basic idea of moving target defense is to frequently change IP addresses of hosts over time. In [52], an SDN-based moving target defense method is presented. A host has a persistent IP address and SDN translates this IP address to different IP addresses over time. Thereby, the host operates on the same IP address, while from the outside world, it appears to frequently change its IP address. This method effectively prevents scanning of the host from external, as well as internal attackers. The detection and defense against Denial of Service (DoS) and distributed DoS (DDoS) attacks have been investigated several times on the basis of SDNs. [PERSON] _et al._[53] detect DDoS attacks by measuring the frequency of the traffic of a flow. If the flow frequency exceeds a specified threshold, they assume that a DoS attack is happening. In such a case, the controller instructs the switches to drop the packets that belong to the malicious flow to mitigate the effects of the attack.