## 4 Implementation
### Flow-Centric Visibility to Assist Networking Control
```
valflowPolicy=spark.sql(SELECTprocessing_time,src_ip,dst_ip,subnet,subnetcluster,packets,databytes,CASE WHENsubnectcluster='IDENTIFIED'THEN'FORWARD' WHENsubnectcluster='KNOWN'ANDpackets<='Lower_Threshold>' THEN'FORWARD' WHENsubnectcluster='KNOWN'AND(packets>'Lower_Threshold>'AND packets<='Upper_Threshold>') THEN'REDIRECT' WHENsubnectcluster='KNOWN'ANDpackets>'Upper_Threshold>'THEN'DROP' WHENsubnectcluster='UNKNOWN'ANDpackets<'Lower_Threshold>' THEN'REDIRECT' ELSE'DROP'ENDasFlowPolicy FROM( SELECTprocessing_time,src_ip,dst_ip,subnet,CASE WHENCOALESCE(subnet,'UNKNOWN')='UNKNOWN'THEN( CASE WHENsrc_ip='CKNOWN'THEN'KNOWN' ELSE'UNKNOWN'END


```
_index=':\"flow-control-policy\", +_id=':\"hjBUUmHB3i0 tmM831 CEp\", +_version=':1, -_score=':1, -_source=':{ \"processing_time\":\"1715863785697\", \"src_ip\":\"192.168.116.6\", \"dst_ip\":\"192.168.116.35\", \"subnet\":\"192.168.116.0/24\", \"subnetcluster\":\"IDENTIFIED\", \"packets\":1758, \"databytes\":242604, \"flowPolicy\":\"FORWARD='}
```

Listing 4: Flow to control policy mapping. ### ONOS Intent-Leveraged Networking Control

Our implementation includes building an intent-leveraged application atop the ONOS SDN controller. This application relies on the ONOS intent framework to check and modify intent specifications. Currently, it is integrated with the ONOS SDN IP application that is used to establish inter-connection between the distributed cloud sites. We implemented this application in Java because the ONOS intent framework only provides Java API for the ONOS application. This application requires two mandatory parameters as the inputs (i.e., subnet address and recommended policy). It can query and partially modify/override the SDN IP intent specification for a specific given subnet address, which is important to identify the originating site (e.g., AS - autonomous system) and respective controller for that subnet. It checks the originating AS number through BGP route information and also finds the authorized controller for that AS number from the ONOS network configuration. Before defining a new intent specification for a subnet, it checks for any installed intent for that subnet in the local or remote controllers. Depending on the recommended policy from the flow-centric visibility, this application submits an intent specification into the ONOS intent framework for compilation. Currently, we only implement redirect and drop policies, while the forward policy follows the default of SDN IP application intent. The application creates a point-to-point intent specification with different Traffic-Treatment. The redirect policy needs to set the inspection port as the egress port without changing the TrafficTreatment, while the drop policy ignores the egress port but adding drop as TrafficTreatment. The detailed logic of this application is shown in Figure 6.

To limit the authority of the application in querying and configuring the ONOS intent in a multi-controller environment, basic authentication is also defined as part of the ONOS network configuration. This includes specifying the local or remote site, controller IP address, account (username and password) information, managed AS number, and redirection or inspection port (i.e., sinkPort), as shown in Listing 5. If multiple controllers are working together, then each controller needs to be added manually in the controller configuration. This addition requires careful management of the configurations, as they contain sensitive credential information for all controllers. Additionally, communication based on Elasticsearch APIs is developed to retrieve recommended action policies for specific subnets from received route information. This integration streamlines the retrieval of visibility data and their utilization in determining appropriate networking policies.