Nowadays, Source Address Validation (SAV) is increasingly important for defending Distributed Denial of Service (DDoS) attacks and other malicious activities. Existing ingress/edge filtering-based solutions, such as SAVI, filter spoofed source addresses using Access Control Lists (ACL) or unicast Reverse Path Forwarding (uRPF), but they only provide coarse-grained filtering. Source Address Validation in intra-domain and inter-domain NETworks (SAVNET) has recently attracted much attention in both industry and the Internet Engineering Task Force (IETF), deploying SAV inside Internet Service Provider (ISP) networks and generating SAV tables by binding source address prefixes with incoming interfaces. However, SAVNET requires upgrading almost all routers across networks, which is impractical—especially in inter-domain scenarios. Moreover, due to policy routing and load balancing, determining the exact incoming interface for each source prefix is challenging. In this paper, we propose SAVNFV, a Network Functions Virtualization (NFV) based platform that provides SAV capabilities by building a “clean” virtual overlay network. SAVNFV randomly generates paths for each flow through a centralized controller, making the SAV table easy to obtain. The paths are periodically refreshed, and packets are transmitted through multiple routes, making it nearly impossible for attackers to identify the correct incoming interface. We formulate the multi-path transmission as an optimization problem and prove it to be NP-Complete, then design approximation algorithms with theoretical guarantees. Comprehensive simulations show that SAVNFV blocks 94.6% more malicious traffic than traditional solutions while maintaining acceptable path stretch. We also implement the system using open-source routing software and build a real-world experimental platform to further validate our design.

Segment routing has been a novel architecture for traffic engineering in recent years. However, segment routing brings control overheads, i.e., additional packets headers should be inserted. The overheads can greatly reduce the forwarding efficiency for a large network, when segment headers become too long. To achieve the best of two targets, we propose the intelligent routing scheme for traffic engineering (IRTE), which can achieve load balancing with limited control overheads. To achieve optimal performance, we first formulate the problem as a mapping problem that maps different flows to key diversion points. Second, we prove the problem is nondeterministic polynomial (NP)-hard by reducing it to a k-dense subgraph problem. To solve this problem, we develop an ant colony optimization algorithm as improved ant colony optimization (IACO), which is widely used in network optimization problems. We also design the load balancing algorithm with diversion routing (LBA-DR), and analyze its theoretical performance. Finally, we evaluate the IRTE in different real-world topologies, and the results show that the IRTE outperforms traditional algorithms, e.g., the maximum bandwidth is 24.6% lower than that of traditional algorithms when evaluating on BellCanada topology.