Distributed threat removal in software-defined networks

We propose an architecture for distributed threat removal in software-defined networks. This is a novel design of a large network, in which security analysis must be performed. In the classic paradigm, the security analyzer is an entry device, connected serially with the rest of the topology. Obviously, this device may suffer from a high processing load. Therefore, it may create a bottleneck, when the arriving traffic is waiting for the security verification, before being forwarded to next devices in the network. In the proposed architecture, traffic is immediately forwarded towards all destinations, while the security analysis is carried out in parallel, resulting in offloading the entry security device. We show that the proposed solution reduces the bottleneck in the topology and increases the rate of the carried traffic, while ensuring the same, as in the classic approach, security level.