A COMPROMISE-TOLERANT CROSS-LAYER RESILIENCE CONTROLLER ARCHITECTURE AND AN EQUAL-BUDGET BENCHMARK FOR PROGRAMMABLE NETWORKS
DOI:
https://doi.org/10.32689/maup.it.2026.2.6Keywords:
programmable networks, cyber resilience, controller compromise, federated control, digital twin, equal-budget benchmarkAbstract
This study defines a compromise-tolerant cross-layer resilience controller for programmable networks, combining a programmable data plane, federated control, provenance-aware state estimation, a digital twin, a formal policy shield, bounded local fallback, and deterministic reconciliation. B0-B8 were evaluated in a synthetic flow-level event-driven model under equal 16-vCPU, 32-GiB, and 1-Gbit/s budgets, nine scenarios, six scales, and 50 paired seeds. At 10⁴, B7 produced mission loss of 0,061 versus 0,155 for B6, recovery of 21,6 versus 30,9 s, and goodput of 78,0% versus 69,4%. The mean paired relative estimator was 57,9% (95% bootstrap interval, 57,0-58,9%), whereas the ratio of displayed aggregate means was 60,6%; these answer different questions. Under controller compromise, B7 retained Qmin=0,668. The 250-ms p99 limit was first exceeded at 25,000. Conclusions are bounded by the synthetic model, parameterization, resource accounting, scenarios, and trust assumptions.
References
Kreutz, D., Ramos, F.M.V., Verissimo, P.E., Rothenberg, C.E., Azodolmolky, S., Uhlig, S. (2015). Software-Defined Networking: A Comprehensive Survey. Proc. IEEE. 103, 14–76. https://doi.org/10.1109/JPROC.2014.2371999.
Bosshart, P., Daly, D., Gibb, G., Izzard, M., McKeown, N., Rexford, J., Schlesinger, C., Talayco, D., Vahdat, A., Varghese, G., Walker, D. (2014). P4: Programming Protocol-Independent Packet Processors. ACM SIGCOMM Comput. Commun. Rev. 44, 87–95. https://doi.org/10.1145/2656877.2656890.
Vieira, M.A.M., Castanho, M.S., Pacifico, R.D.G., Santos, E.R.S., Camargos, E.P.M., Jr., Vieira, L.F.M. (2020). Fast Packet Processing with eBPF and XDP: Concepts, Code, Challenges, and Applications. ACM Comput. Surv. 53, 1–36. https://doi.org/10.1145/3371038.
Mijumbi, R., Serrat, J., Gorricho, J.-L., Bouten, N., De Turck, F., Boutaba, R. (2016). Network Function Virtualization: State-of-the-Art and Research Challenges. IEEE Commun. Surv. Tutor. 18, 236–262. https://doi.org/10.1109/COMST.2015.2477041.
Scott-Hayward, S., Natarajan, S., Sezer, S. (2016). A Survey of Security in Software Defined Networks. IEEE Commun. Surv. Tutor. 18, 623–654. https://doi.org/10.1109/COMST.2015.2453114.
Katta, N.P., Zhang, H., Freedman, M.J., Rexford, J. Ravana: Controller Fault-Tolerance in Software-Defined Networking. In Proceedings of the 1st ACM SIGCOMM Symposium on Software Defined Networking Research, Santa Clara, CA, USA, 17–18 June 2015; Article 4, pp. 1–12. https://doi.org/10.1145/2774993.2774996.
Fett, M., Kraft, M., Wilking, F., Goetz, S., Wartzack, S., Kirchner, E. (2024). Medium-Level Architectures for Digital Twins: Bridging Conceptual Reference Architectures to Practical Implementation in Cloud, Edge and Cloud-Edge Deployments. Electronics, 13, 1373. https://doi.org/10.3390/electronics13071373.
El-Hajj, M. (2024). Leveraging Digital Twins and Intrusion Detection Systems for Enhanced Security in IoT-Based Smart City Infrastructures. Electronics, 13, 3941. https://doi.org/10.3390/electronics13193941.
Cho, H., Sung, J.-H., Kang, H.-J., Jang, J., Shin, D. (2025). Quantifying Cyber Resilience: A Framework Based on Availability Metrics and AUC-Based Normalization. Electronics, 14, 2465. https://doi.org/10.3390/electronics14122465.
Bocci, A., Forti, S., Ferrari, G.-L., Brogi, A. (2023). Declarative Secure Placement of FaaS Orchestrations in the Cloud-Edge Continuum. Electronics, 12, 1332. https://doi.org/10.3390/electronics12061332.
Yang, F., Sun, Y., Gao, Q., Chen, X. (2024). EDI-C: Reputation-Model-Based Collaborative Audit Scheme for Edge Data Integrity. Electronics, 13, 75. https://doi.org/10.3390/electronics13010075.
Ross, R., Pillitteri, V., Graubart, R., Bodeau, D., McQuaid, R. (2021). NIST SP 800-160 Vol. 2 Rev. 1: Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. National Institute of Standards and Technology: Gaithersburg, MD, USA, https://doi.org/10.6028/NIST.SP.800-160v2r1.
Rose, S., Borchert, O., Mitchell, S., Connelly, S. (2020). NIST SP 800-207: Zero Trust Architecture. National Institute of Standards and Technology: Gaithersburg, MD, USA, https://doi.org/10.6028/NIST.SP.800-207.
GPP TS 33.501; Security Architecture and Procedures for 5G System. 3rd Generation Partnership Project: Sophia Antipolis, France, Release 18.
Iyengar, J., Thomson, M. (2021). RFC 9000: QUIC: A UDP-Based Multiplexed and Secure Transport. Internet Engineering Task Force: Fremont, CA, USA, https://doi.org/10.17487/RFC9000.
Ford, A., Raiciu, C., Handley, M., Bonaventure, O., Paasch, C. (2020). RFC 8684: TCP Extensions for Multipath Operation with Multiple Addresses. Internet Engineering Task Force: Fremont, CA, USA, https://doi.org/10.17487/RFC8684.
Torres-Arias, S., Afzali, H., Kuppusamy, T.K., Curtmola, R., Cappos, J. in-toto: Providing Farm-to-Table Guarantees for Bits and Bytes. In Proceedings of the 28th USENIX Security Symposium, Santa Clara, CA, USA, 14-16 August 2019; pp. 1393–1410. https://doi.org/10.5555/3361338.3361435.
Samuel, J., Mathewson, N., Cappos, J., Dingledine, R. Survivable Key Compromise in Software Update Systems. In Proceedings of the 17th ACM Conference on Computer and Communications Security, Chicago, IL, USA, 4-8 October 2010; pp. 61–72. https://doi.org/10.1145/1866307.1866315.
National Telecommunications and Information Administration. The Minimum Elements for a Software Bill of Materials (SBOM). U.S. Department of Commerce: Washington, DC, USA, 2021. Available online: https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom (accessed on 17 August 2026).
