Transforming Network Management: Intent-Based Flexible Control Empowered by Efficient Flow-Centric Visibility  
[PERSON]  
1 Information and Communication Technology Academic Cluster, Singapore Institute of Technology (SIT), Singapore 138683, Singapore; [EMAIL_ADDRESS]  
[PERSON]  
2 Department of Mathematics and Computer Science, Karlstad University, 65188 Karlstad, Sweden  
environment with multiple cloud providers and control domains. In such an environment, intent-based networking control [2] is necessary to accommodate multiple policies and heterogeneous network device configurations. Thus, the most critical question is how to address both challenges simultaneously for providing networking control in BGP-based IP interconnections, leveraging flow information.  
Previous studies have focused on diverse topics relevant to network management and security. These include establishing initial flow-level visibility for an OF@TEIN testbed [3], traffic flow monitoring and analysis for security incidents [4; 5; 6], flexible samples for monitoring and security application in OpenFlow [7], traffic engineering (measurement and management) in SDN [8; 9], and intent-driven security in software-defined networks [10]. Unfortunately, the majority of these proposals attempt to solve individual problems without considering an end-to-end closed-loop monitoring and control solution. For instance, some works focus solely on flow-level visibility (e.g., counting or sampling), providing statistical data without outlining how these data can be utilized effectively for traffic control. Traffic engineering works, on the other hand, concentrate solely on traffic control with limited statistical data from the network. Hence, it is critical to propose a solution that simultaneously addresses these monitoring and control problems and provides an integrated solution.  
To address the challenge of efficiently measuring and collecting flow-level information, we utilize IO Visor-based ([[https://github.com/iovisor](https://github.com/iovisor)]([https://github.com/iovisor](https://github.com/iovisor)), accessed on 22 June 2024) tracing to efficiently capture network packets for flow-level visibility analysis. This collected visibility information is then analyzed to generate an IP prefix-based recommendation policy, building on our previous work [3] to assist networking control. Finally, we employ the ONOS SDN controller to apply the recommended policy as an action through the ONOS intent framework, which translates this action into flow rules. Proposed solution working is verified in a distributed testbed and results demonstrate that proposed flow-level visibility effectively utilizes traced network packets for generating redirect action for unknown flows originating from an IP prefix exceeding the permissible threshold. In summary, the key contributions of this work are listed below:  
* We propose a network packet-precise flow visibility approach to measure and analyze incoming and outgoing traffic from the Linux servers.  
Figure 1: An example of a distributed multi-site cloud infrastructure.  
* We propose a networking control solution for a complex multi-domain environment with hybrid SDN-IP interconnection that is assisted by flow-level visibility.
* We verify the end-to-end integration of proposed solutions and evaluate their performance efficiency when processing the traced data from a distributed testbed (i.e., OF@TEIN playground).  
The rest of this paper is structured as follows. Section 2 discusses and compares the proposed work with closely related studies in the literature. Section 3 presents the proposed solution, followed by insights into the implementation details in Section 4. Experimental evaluation results are provided in Section 5. Section 6 discusses the potential use case scenarios and future directions. Finally, Section 7 concludes the paper.