# Enforcing Optimal ACL Policies Using K-Partite Graph in Hybrid SDN
## 2 Related Work
### ACL Implementation in SDN  
This section provides a thorough overview of the work related to policy implementation mechanism in Software Defined Networks. [PERSON] et al. [31] proposed a scalable two-layers mechanism for implementing ACL policies. In the first layer, data packets are divided into different classes and forwarded to switches according to ACL policies. A class denotes the packets with some common properties i.e., having the same _Destination IP_ address or same source subnet. Secondly, network security policies for different classes are deployed on different switches. These two-layer switches are known as a classified switch, i.e., to classify traffic and filter switch, i.e., to implement policy. By using this technique, the total number of flow entries are reduced by using the specific class to install policy. The entire system can be scaled easily by adding more switches and assigning a proper traffic class. Simulation results indicate that this mechanism is effective for moderate traffic load and robust. The limitation of this approach is the classification of traffic because traffic behavior changes dynamically which requires more intelligent traffic classification. Moreover, this technique does not consider the policy deployment for hybrid SDN.  
NetEgg [32] is a programmable framework that facilities the network operators to implement different network policies to manage the network. It provides flexible and efficient ways to deploy network policies using example behaviors. In this approach, different example policies are designed based on the network operator's response implementing actual policies on the network devices as shown in Figure 4. An algorithm is used to automatically synthesize policy implementation from these examples of policies. NetEgg [32] observes the operator's behavior for the creation of network policies using time-line and topology. This algorithm infers the states that are required to be maintained to exhibit the desired behavior as well as the rule to process network packets according to policies. Most of the examples are taken from the literature to stipulate different policies, and later, these are used to infer other policies. The model results indicate that implementation scenarios exhibit the example used for policies. However, the overhead for this implementation is a significant issue that needs to be lowered.  
Figure 3: Example of Shared HyperCuts tree: (**Left**) Two separate HyperCuts trees. (**Right**) The corresponding shared HyperCuts tree.  
In [33], behavior of different distributed routing protocols in traditional networks, such as OSPF [34] and IS-IS [35], are studied. It is concluded that these are robust and scalable, however, they lack flexibility. By using a centralized control plane, SDN provides fine-grained routing control and management. The paper [33] proposes a technique, known as fibbing [36; 37], which combines the advantages of SDN route control and traditional routing protocols. Fibbing offers central control of the distributed computation of forwarding paths while striving for both flexibility and scalability. Fibbing introduces fake nodes, fake links, and fake routes to achieve load balancing. Through this fibbing, the SDN controller can persuade the legacy routers into computing desired paths by presenting the routers with carefully crafted network topologies. Fibbing does not require the installation of low-level rules in the legacy forwarding devices. Instead, the legacy routers simply run the legacy routing protocols based on their link state knowledge (which includes the fake nodes and links). A limitation of this approach is the computational effort for finding the fake nodes and links. If the network topology changes, then the fake nodes and links need to be recalculated.