# A Comprehensive Survey on Knowledge-Defined Networking
## 7 Application Plane
### Application Scenarios
#### 7.3.3 Security
Deviating from the static access control mechanism, Behavior-Based Access Control (BEAM) defines policies to dynamically grant permissions based on network behavior, which can upgrade or downgrade assigned access permissions at run-time [490]. BEAM further verifies and builds trust for an application. In [491], attribute-based encryption and certificate-based access control protocols are used to achieve access control, while a blockchain is used to add various transactions among controllers, applications, and switches where blocks are added using a consensus mechanism. Virtual Private Networks (VPN)  
To establish a safe connection between two networks over the internet, a virtual private network is employed. It is possible to develop an application that constructs a secure tunnel between two networks. MPLS VPNs rely on multiple protocols to function correctly, which provide security, QoS, and flexibility in networks. In [492], based on the network performance, the IPSec policy of the MPLS VPN tunnels is dynamically updated to provide better security. A secure approach called software-defined VPN, where each application is allocated its own overlay VPN and flow tables related to each VPN, are pushed by the controller to switches to improve security by separating VPN traffic and by utilizing service chaining [493]. A P4 switch-based concept for IpSec VPN, where P4 switches are served as tunnel end points for site-to-site and host-to-site applications without the exchange of complex key exchange protocols, has been presented in [494]. Firewall  
A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall can be implemented as an application that enforces policies to restrict or allow network traffic. In [495], the authors present a concept called pre-firewall, which is a framework to monitor firewall rules to avoid collision, redundancy, and overlapping issues, and present an algorithm to resolve rule anomalies. A virtual firewall (ACLSwitch) that filters traffic across the network at switch level using the OpenFlow protocol to distribute flow rules and defines policy domains to allow different filtering configurations to apply to different switch domains has been proposed in [496]. ACLSwitch allows subsets of switches to enforce different security policies. Similarly, in [497], a network function virtualization-based virtual firewall having policies to filter traffic with a Click module has been presented to efficiently use network hardware resources, while having equivalent performance to a firewall based on the POX controller. Another study uses network function virtualization to implement a stateful firewall, which uses a set of guidelines and rules (policies) to avoid network-hazardous connectivity [498]. A firewall called FlowTracker, which is a stateful firewall with reduced controller processing and communication overhead, uses an adaptive connection tracking policy to detect and monitor network traffic [499]. Similarly, in [500], a stateful firewall is implemented in the controller to filter traffic based on the complete context of incoming packets, having a policy to evaluate the entire context of traffic flows to filter traffic. A framework called FleXight uses per-flow dynamic sampling to convey packet-level information to the controller, which enforces a firewall application policy to detect horizontal port scans [501]. An application known as ChainGuard, which provides security to blockchains by filtering traffic to make sure that the origin of the traffic is legitimate, where illegitimate packets will be intercepted by the firewall [502]. ChainGuard is capable of mitigating flooding attacks and providing access control functionality. Considering the fact that firewall policies need to be changed when the types and sources of attacks change, a computationally efficient firewall Rule Update Algorithm (RUA) to compute the rules related to the updated policies while preserving non-updated policies is presented in [503].