Mitigation of DDOS and MiTM Attacks using Belief Based Secure Correlation Approach in SDN-Based IoT Networks

In recent years the domain of Internet of Things (IoT) has acquired great interest from the ICT community. Environmental observation and collecting information is one of the key reasons that IoT infrastructure facilitates the creation of many varieties of the latest business methods and applications. There are however still issues about security measures to be resolved to ensure adequate operation of devices. Distributed Denial of Service (DDoS) attacks are currently the most severe virtual threats that are causing serious damage to many IoT devices. With this in mind, numerous research projects were carried out to discover new methods and develop Novel techniques and solutions for DDOS attacks prevention. The use of new technology, such as software-defined networking (SDN) along with IoT devices has proven to be an innovative solution to mitigate DDoS attacks. In this article, we are using a novel data sharing system in IoT units that link IoT units with the SDN controller and encrypt information from IoT unit. We use conventional Redstone cryptographic algorithms to encrypt information from IoT devices in this framework. The Proposed Belief Based Secure Correlation methodology supports the prevention of DDOS attacks and other forms of data attacks. The system proposes new routes for transmission through the controller and communicates with approved switches for the safe transmission of data. To simulate our entire scenario, we proposed the algorithm Belief Based Secure Correlation (BBSC) implemented in SDN–IoT Testbed and verified IoT data is secure during transmission in the network.

Introduction
The entire world can be considered a vast network of wired and interacting devices in today's rapidly evolving ecosystem of automated and connected devices. The Internet of Things (IoT) is a ubiquitous computing system in which sensors and actuators are interacting with living and non-living 'things,' and all of these, not just computers and smartphones, will be connected to the Internet. However, as the network grows, the problems also grow. The security problems surrounding IoT have a significant effect on the domain's future, raising concerns about the security of devices in use. Meanwhile, distributed denial of service (DDoS) assaults has been increasingly popular in the cyber security world. DDoS attacks have risen dramatically after things are linked over the Internet Since there are now more devices to hack and launch attacks. The resource-constrained systems used in IoT scenarios have made it much easier for an attacker to break in. All these research interests have increased in the recent past in this field of IoT defense. The IoT ecosystem consists of several devices with various capabilities and attributes. It varies from high-end computer systems to low memory and processing capability basic microprocessors. Security solutions must also be formulated at different levels in this diverse climate. Since the capacities of devices at various levels of the Internet of Things vary, the dimensions and properties of enforcing protection measures at each level can differ. In general, there is a variety of distributed denial of service (DDoS) and denial of service (DoS) attacks, and MITM attacks that cause various IoT devices to fail.
The Internet of Things (IoT) is a concept in which physical objects can be linked to the Internet and recognize themselves to various devices [1]. RFID, sensor technologies, and remote advancements are all closely linked to IoT devices. It allows objects to be detected and monitored from a distance using an existing device framework. The web is a network that connects people all over the world for purposes such as texting, gaming, conferencing, and web-based information exchange [2]. The ability for information broadcast, wide-ranging inspection, and planning is distributed among the universal objects. The term "intelligent" is used here to refer to a function that is considered essential. Distributed smart elements such as sensors, actuators, and information centers are made possible by the intelligent

Architecture of SDN-IoT
In SDN-IoT architecture, the IoT network has its backbone network as Software Defined Network and not the traditional network. The integration of SDN and IoT makes the IoT network more programmable and provides a single view of the whole network. The attacks like DDoS and MiMA can happen in any network. But the severity of these attacks is more crucial in IoT networks. Hence the current paper discusses different techniques by which attacks like DDoS and MiM can be mitigated at the earliest by other researchers also the performance of the proposed algorithm is compared with recent mitigation techniques.
SDN will help drive the expansion of IoT-enabled devices, increase the efficiency of network resource sharing and improve IoT service-level agreements. The configuration flexibility that SDN offers can allow both network operators

Multi-Layer Sdn-Iot Architecture
IoT four-layer architecture is illustrated in Figure. 2that includes IoT devices that monitor the environment and collect the data. IoT gateways that collect data from different IoT devices, SDN switches to route the packets based on flow rules created by SDN Controller, Cloud servers to store data for IoT-based applications. In the layer of the IoT device, there are two types of data IoT sensor network data and the user's Wi-Fi network. Various protocols such as Bluetooth, ZigBee, and Wi-Fi relay packets are available. IoT gateways add sensor information from a range of sensors. For the IoT environment, the system employs a multi-layer DDoS attack detection system. The DDoS sources are divided into two IoT groups. One is the flux of network sensor data and the other is the flux of user equipment network data. To detect and block DDoS attacks the following measures are proposed. First, we design IoT security authentication faster than existing system layer encryption standards. Secondly, we choose the features of the IoT gateway captured packets and the SDN switches according to attack styles. Thirdly, in our system architecture, we incorporate data flow, control flow, and training processes.

Organaisation of Paper
In Section 3 we have covered a brief survey on works done in the field of DDoS and MiM attacks. The detection, mitigation techniques, and efficiency of different techniques to resolve DDoS and MiM attacks. In Section 4 we discussed the proposed architecture, methodology, and algorithms used for creating a secure software-defined architecture to make the IoT environment more secure and efficient. In Section 5 based on the proposed methodology, we have implemented the setup architecture and done a detailed result analysis. In this section, simulation results of DDoS and MiM attacks are done, the detection and mitigation time for DDoS and MiM attacks are compared with other systems that we came across during the literature survey in Section 3. The simulation results are tabulated based on a comparison of the accuracy and efficiency of our systemconcerningDDoS and MiM attacks.

Related Work
In this section, there are 2 sub-sections 4.1 and 4.2. In section 4.1 a survey of different techniques explored by other researchers to detect and mitigate denial of service attacks in SDN-IoT is done. The time taken for them to detect and mitigate attacks are been considered. In section 4.2 similarly to section 4.1 a broad survey is done on different techniques to detect and resolve MiM attacks in SDN-IoT. The result analysis of this survey is later considered for comparison with our proposed architecture's implementation and performance evaluation in Section 5.

DDoS Attacks on SDNand IoT
Various methods are in use to notice and prevent assaults from DDoS because they are behaviorally different. Daoerntu [9] will create a table for the manager during a DDoS attack that tracks packets using the IP address. All latest elements are flagged as guarded, and the flow entry gives them a short timeout value. The number of packets sent over the link is measured against the smallest rate to decide if the application is legitimate otherwise malicious. This approach effectively reduces the flow input of the switch, and according to the simulation, the bandwidth of the regulator switch channel is currently usable through DDoS attacks. Even though if the attacker alters the basis address, this process consumes a lot of controller resources. Because of its randomness calculating ability, Mouhasavin and StHilaeirene [10] suggest the methodology used for DDoSdiscovery.While the proposed techniques can increase detection precision in the actual system, only discovery and solutions are addressed.
Dongen [11] proposed a statistical method called an SPRT that detected DDoS attack but its mitigation was not considered. The DARPA interruption information set [12] was evaluated and presented in a timely and accurate manner. On the other hand, rather than using random variables, the approach is evaluated solely based on mathematical outcomes.
Yanare et [13] suggest a "Multislot" approach for managing requirements on a per-request basis, so that valid users be able to talk with one another correctly during DDoS attacks. Large flow latencies are introduced when the user and the aggressor use a similar switch because the legitimate and malicious requests are placed in a similar line.
Dharmaname [14] proposes using a "flow collector" connecting the controller and switch. If the number of invalid packets goes beyond the limit for some time, the manager will inspect those suspicious packets more closely. This, however, leads to a delay for legitimate users. Moreover, no statistical investigation, simulation is available.
Shnaebr and Chithualehakm [15] established a maximum time and stage of confidence in the defense of data and control aircraft from DDoS attacks. The confidence level of the node is used to determine the priority of the control process when the value is determined based on the behavior in normal times. The manager rejects requests from certain nodules with several requirements that exceed a definite threshold during peak time. The controller responds by switching to a new rule with a shorter time-out for normal nodes. The authors, however, do not demonstrate how to describe the maximum time and its threshold. Furthermore, the suggested procedure is not simulated or evaluated on actual equipment.
To detect connection flood attacks in the SDN, Xiao et al. [16] propose using a Bloom filter. In this model, there are two subsystems: a collector and a detector. If the connection isn't right, the collector scans the switch's flow table for abnormal flows and flags them in the flow entry statistics. The detector uses a controller to keep track of the entire network and sniff packets. Because the related IP characteristics are saved in the Bloom filter, the categorization of such packets is transferred to the Bloom filter to decide whether they are irregular. However, there is no concept of abnormal link usage, and the controller makes no mention of how this problem can be detected.
Koukilaman [17] suggests that DDoS attacks should be detected using the SVM category. The SVM studies the model with training examples and forecasts that the anonymous traffic samples are natural or attackable. SVM is instructed to collect scenario-specific information on the DARPA intrusion in 2000. In comparison to other simulation approaches, the SVM is more accurate and less false. However, the output of SVM depends on the training datasets.
Phanmenor [18] also recommended using SVM and SOM combinations to differentiate DDoS attacks. Until the model is used for research, ready-made datasets will condition SVM and SOM. A special SVM is provided for each protocol to filter aircraft traffic. If a certain flow is indicated by the SVM in the attack field, it is forwarded to the classifier. If the flow is in the trendy area, the decision will be sent to SOM. The simulations show that the SVM-SOM combination works better than individually.
To reduce DDoS attacks, Lim et al. [19] recommend changing the victim's IP address. The DDoSjamming Method (DJM) on the manager uses a protected channel to connect straight to the server. When a server notices metric DDoS attacks, DJMallocates it to the latest IP address and requests that packets be transferred. When the number of packets sent to a host's default address goes beyond a certain value, the source is tagged as an aggressive one. After the IP address has been updated. DDoS attacks are prevented, according to the simulation results. However, no mention is made of how defense and drop action measures and thresholds are established.
Chin et al. [20] are using the Monitor, Correlator, and Controller to detect DDoS attacks by concert. The monitoring section monitors the anomaly detection network and activates IDS to inspect auxiliary packets. When the IDS detects an assault, it sends the corresponding data to the monitor and notifies the organizer to find the flow table of hubs. The manager initiates the hub to act as per the avoidance behavior when the suspicious factor corresponds to any function associated with the flow table.
Macedomer proposed the DDoS Attack Mitigation Protocol for Multiple regulator SDN Networks [21], which is a multi-controller cluster model. PATMOS is divided into three phases: identifying the overloaded controller through control message delay or stability; selecting the best output regulator to synchronize alleviation, and minimizing the impact of DDoS attacks. PATMOS' efficiency in falling CPU usage, increasing the throughput, and lowering waiting time is demonstrated by the simulation results. Hameedullaha et al. [22] recommended a secure protocol (C-to-C) regulator to control the implementation of a collaborative DDoS mitigation process. The most important are the files, certificates, and signature parts of the C-to-C protocol. The certificate part establishes a chain to verify the authenticity and honesty of the controller. When a controller recognizes a DDoS threat, it modifies the data plane policy and sends to the controller next door a list of malicious IP addresses. such packets are therefore stopped in diverse networks. Simulation results in evidence that it acquires a very small time to notify adjacent managers and overcome attacks.
Sahayamer. [23] recommended ArOMA to mitigate malicious traffic on aircraft, a DDoS protection system. ArOMA uses streamID to classify network courses and the detection engine determines whether the traffic run to the service provider is suspected. The flow status is passed on to the ISP controller through the customer's controller. The ISP controller selects the direction in which the malicious flow to the filter is being inspected. Correspondence between controllers must, however, also be protected.
BhavikaPande [24] proposed SDN based setup to prevent DDOS attacks from occurring in the same and different domains. They used a Mininet based setup for topology creation that consists of RYU Controller and OpenFlow protocol. The DDoS Prevention Mechanism is simulated and for an average of 50 nodes the detection time is 4.23 ms and the Detection accuracy is 89%.
YinqiYang [25] suggested a promising network architecture for dropping malicious traffic in the propagation path to avoid an avalanche effect on the victim server in a traditional network. A significant amount of time and effort has been invested in the existing works. Using the SDN controller wastage of resources and detection of attacks can be done in less time. they consider the characteristics of IoT traffic and employ the edge. computing to provide local services through the use of detection and mitigation methods into the IoTOpenFlow (OF) switches. The DDoS Detection and Mitigation Framework are simulated and for an average of 50 nodes the detection time is 6.9 ms and the Detection accuracy is 85%.
DDoS attacks in SDN, as mentioned in the previous section, are a well-studied subject that still requires attention to progressDDoS detection and mitigation. Security [24] is the most important issue in the IoT system as a result of IoT device flaws. The security of IoT networks can be improved by combining SDN and IoT networks, particularly next toDDoSattacks [26][27].
Tortonesisedc [28] proposed SPF as an SDN-based design for reducing data bursts in IoT, which was similar to the DDoS attack situation. The processing and distribution element, which includes a programming unit, replaces the data plane in the SDN. This module allows you to get instructions from the SPF controller. The processing module divides user application requests into categories based on the type of service requested and then assigns a priority to each request as a point of reference for dissemination. The expertise of SDN controllers is used to make informed decisions.
To identify and overcome DDoS attacks on an IoT network's edge node, Ozç elikmanl. [29] use a scheme called Border centered Software-Defined IoT Defense (BCESID). The discovery calculation relies upon the suspicions (i) a kind association is bound to prevail over a malicious association, and (ii) association demands from a contaminated host are more normal than demands from a typical host. Thus, the number of connection endeavors and disappointment checks over the long run can be utilized to decide if a host is contaminated. From the SDN regulator to the switch, altered stream rules are embedded to hinder all streams from that malicious host.
Based on IoT paradigms, Sarwar. [30] suggested a trust framework for defending SDN controllers against DDoS attacks. Each network user's historical record is assigned a trust value, which means that a superior trust rate represents the manager will give the request higher priority, whereas a low confidence level means the user will discard packets. In addition, the controller has a queue buffer request; if such storage is overloaded, the appeal with a small confidence level is crashed in favor of a more reliable inquiry.
To recognize DDoS assaults in the IoT organization, Ravi and the remaining [31] utilize semi-administered AI calculations. Learning-driven recognition relief is a progressive control plane component that sorts IoT gadgets into two gatherings: fixed and versatile. A nearby regulator is accountable for a solitary organization fragment, while an allinclusive regulator is responsible for all neighborhood regulators. LEDEM distinguishes DDoS assaults dependent on approaching parcel highlights, and an AI model is prepared with both named and unlabeled information to decide if an IoT framework has been settled.
According to Sharma et al. [32], machine learning should be used to detect DDoS attacks, and cloud networks and wireless SDN should be used in tandem to safeguard IoT networks from DDoS attacks. When the latest node joins the network, the OpCloudSecsystem analyses it using a deep brief network to determine whether it is attacked or not. Regular traffic will be transferred, but identified assault traffic will be sent to the manager for additional directions. if the attack is latest, OpCloudSecpermits administrators to add it to the attack catalog, making it an imminent attack for the subsequent time it occurs.
According to Nobnmerkht [33], IoT-IDM is a smart home-dependent method for intrusion detection in IoT networks that employs machine learning. IoT-IDM relies on the number of times in control and reply packets, as well as the inter-packet interval, as detection indicators because smart home IoT devices must be switched on and off physically. The precision rate from actual implementation could reach over 91 percent if mutually linear and nonlinear logistic regression methods of machine learning are used. In the survey different detection and mitigation techniques of DDOS attack and their accuracy is noted for furthers comparisons.

Literature on Man-in the Middle Attack
Man in the middle attack happens in a network when an attacker tries to intercept the packets that are sent between two legitimate nodes. The communication channel is less secure due to which attackers can intrude on the network. U. Meyer and S. Wetzel discussed the man-in-the-middle attack on mobile communication which they presented in a report in the year 2014, [34]. In 2016, the author published his research on an encryption method of MITM using Kirchhoff-loop-Johnson in a master listed journal [35]. In paper [36]  FarouqAliyu [44] proposed a system to resolve Man in the Middle (MitM) attack at the fog layer. These systems are Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) The IDS consists of IDS nodes that periodically interrogate nodes one hop away. The IPS uses lightweight encryption to preventsMiMA. The solution in this work is the IPS-IDS System framework which is evaluated and the detection time and detection accuracy is 4.5ms and 90% for an average of 50 nodes Cheng Li, [45] specifically investigated the potential threats of Man-in-the-Middle attacks on the OpenFlow control channel. They first introduced a feasible attack model in an IoT-Fog architecture, and then implemented attack demonstrations to show the severe consequences of such attacks. Additionally, they proposed a lightweight countermeasure using Bloom filters. They implemented a prototype for this method to monitor stealthy packet modifications.
YiLi [46] proposed a system that can provide a global view of a network so that the Wifi network can be managed. The SDN controller is deployed with two components detection and mitigation. Once the attack is detected the mitigation module will update the flow rules and redirect the packets. These attack packets are stored to perform further analysis of the attack pattern. Extensive experimental results demonstrate that the proposed framework can efficiently detect and mitigate KRACK framework. For 50 nodes the attack detection time and accuracy are 6.3ms and 86% respectively. A survey on different recent techniques to mitigated MiMA and its time duration is noted for further comparisons.

Proposed Architecture and Methodology
In this section, we will discuss the proposed secure defined architecture for IoT networks and its implementation. The secure SDN-IoT architecture in Figure 3, has an IoT environment from which data is collected and send through the IoT gateway. The IoT Gateway is part of a Software-Defined Network along with many other hosts, gateways, SDN Controller and OpenFlow enabled switches. The SDN controller has a northbound API in which the proposed methodology of section 4 is implemented. The API helps in detecting and mitigating different attacks like DDoS and MiM attacks. SDN-enabled IoT network makes the network more scalable and adaptable as per dynamic traffic compared to the traditional network used for IoT. The cloud platform used to store IoT data is Thingsboard.
We developed the Belief Based Secure Correlation (BBSC) algorithm. Clients can connect to enabled networks thanks to the SDN architecture represented by BBSC. To provide users with contact to a verification check, the BBSC scheme employs ciphertext-policy attribute-based encryption. Overall, ciphertext policies, which will be implemented as both SDN controllers and information plane OpenFlow switches, are used to power the device.
The primary goal of the BBSC working procedure is to make communication among users and switches easier. It connects to the network's platform and performs access authentication for client individuality. The SDN controller controls the decision to accept users and prevents unauthorized users from accessing the network through an access authentication service. We used a reliable method that is essentially ciphertext-policy attribute-dependent encryption [49]. The BBSC method is maintained by the SDN controller process, and the access authentication service is checked by the SDN controller process. Following that, the SDN IoTadmissionmachine validates each request and grants the right of entry as per the rule. The validation method is encrypted with one SDN controller's public key to prevent an unauthorized client from gaining access to it. When a user first joins the architecture, it checks the user's uniqueness as well as the access platform.  An output containing the public key and its corresponding private key. The publish and delivery systems are implemented using the trusted authority scheme. The public key is connected to the published system, and the master secret key is connected to the delivery system. The authentication process is depicted in Figure 4.The client's authorization is experienced throughthe network platform and uniqueness during the verification process, and the access method is embedded in that method. The authentication mechanism and the encrypted access policy both keep track of a division of characteristics.  A request from an IoT access system is received by the authorization method's core, which then transfers it to SDN switches. SDN switch is excluded from the SDN network if it fails to maintain security or service efficiency. In this case, the SDN controller in our proposed system creates a new multicast route and enhances multicast protection by generating keys that are broadcast to switches. To turn at the primary phase in the series, the process controller must be approved and authenticated. As a result, the Controller devised new forwarding paths between source and destination that were previously difficult to locate using the traditional scheme. Approved switches are installed on the routes during data transfers to ensure that data is effectively protected against attacks. As shown in Algorithm. 1, the Redstone algorithm encrypts user data so that it can only be accessed by authorized switches. The data is readable after it has been decrypted, as shown in Algorithm 2. . After that, the access strategy is applied to the obtained user data, which has been encrypted using the public key principle used in the authentication process. The data is processed, decrypted with a secret key, and the client's individuality, as well as system characteristics, are verified in the last step of the access strategy. The verification tool, which is built on top of the controller, generates the flow table. Multi-access privileges are granted to customers who effectively complete the validation process. It will also take into account the characteristics of the network platform as well as the individuality of each client. When compared to previous approaches, this is a vastly improved definition. The proposed approach would provide greater versatility while also lowering costs. The authentication method in BBSC-based SDNs ensures a secure communication of data in combination with an authorization access policy. Sections 4 and 5 go over the system's performance in detail, including a description of the simulation, as well as simulation environments and graphs that show the system's advantages. For client access, multi-point access has been integrated, making the multi-client authentication process easier for users. The authentication cryptography principle has also been completed. This is an important feature of our proposed system because many network providers are not able to provide it, which compromises both the availability of authentication and approval aspects. The authentication procedure for the BBSC-based SDN network is depicted in Algorithms 1 and 2 . Since the controller can limit acts that violate the SDN network's security, the SDN network was tested with crypt-analysis attacks. MININET testbed was used to validate the proposed procedure. We were able to monitor the results and check the progress in this manner.

DDoS and Man in the Middle Attacks Simulation in SDN-Based IoT Architecture
A MININET simulation was used to carry out the research. An experimental network was used to start the evaluation. The controller in the SDN network is responsible for the multicasting module's execution. The development of a safe path was combined with the use of dependable switches to determine the multicast transmission path. The mechanism for establishing trust among the switches and controller is critical. The controller is responsible for sending the information of the devices that create the multipath to the trust establishment. The trust establishment mechanism can detect any suspicious behavior by the switches, allowing the switches to be isolated and the multicast path's efficiency to be improved. The encoding and decoding of the vector were combined with the network communication overhead. The time-consuming computation mechanism ensures that stable switches are maintained. The controller addresses the trusted switches and initiates contact along with network specifications. By default, the switches receive the session key with broadcast encryption. The controller allocates to the network the keys generated in the network. The switches serve as a non-recipient storage point.
Mininet (accessible at: http://mininet.org/) is used to test the performance of the SDN-dependent IoT DDOS algorithm BBSC, and the simulation is run on Ubuntu 12 with an Intel i3 CPU and 4 GB RAM. The configuration of the practical network is shown in Figure 6. This network has 05 switches (s1-s5) connected to the same controller, each with two subordinate hosts (h1-h8), for a total of 16 hosts (h1-h8). The bandwidth of every connection among switches and hosts is restricted to 2 GB. From h1 to h18, the iPerf tool (Traffic generator, available at: https://iperf.fr) is in use to calculate accessible bandwidth, allowing us to compare performance when the network is regular, when an attack occurs, are covered. Here, h1 represents a new client, and h18 represents a server. There are 05 IoT attackers among the remaining 17 hosts; these compromised hosts produce malicious traffic to use network resources. A new user is represented by h1, and a server is represented by h18. Among the remaining 17 hosts, 05 attackers produce malicious traffic to use network resources.  The usable bandwidth in normalandDDoS attack states is compared to confirm the output of BBSC. Figure 7 depicts the results of ten runs for each scenario. The total available bandwidth on the network is 1850 Mbps when it is in a normal state, but it drops to 753 Mbps during DDoS attacks. The average bandwidth is 1835 Mbps when BBSC is activated in response to a DDoS attack. As a result of the findings, it is clear that BBSC can protect the network from DDoS attacks coming from a variety of directions. Figure 7 is a graphical representation of bandwidth utilization in the network during the attack. It is found that due to DDOS attack utilizes maximum bandwidth of network thus accessibility to legitimate resources are less. Hence by implementing the proposed algorithm the bandwidth utilization is less even when the network is under attack as the detection and mitigation of the attack was more efficient comparatively.

Detection Time:
In the detection process, the running device needs analysis to detect malicious traffic leading to DDoS attacks Detection entails using a sophisticated method to detect vast amounts of illegal GET request traffic directed at a web server. Pattern matching, clustering, deviation analysis, associations, and correlations are only a few of the detection strategies that have been used to detect DDoS attacks. Detection time in this work refers to the total time taken to detect the DDOS attack. Here we will compare the algorithm for our BBSC with two other related DDOS, namely DDOS. Prevention Mechanism [24] and DDoS Detection and Mitigation Framework [25]. Here we compare our BBSC algorithm. The attack detection time is measured in milliseconds. In this time we will consider both the time taken to send the packets from switches to servers and vice versa as well as the total time taken for the attack to happen for the network. The algorithms are evaluated on mininet and the acquired results are in Table 1:  Figure 8 illustrates the attack detection time of three different algorithms. here the attack detection time is directly proportional to the number of packets. As the traffic in the network increases automatically detection time also will be increased. but the results show that when compared to the remaining algorithms our BBSC security algorithm has very little detection time because of its security mechanism used. Hence the detection time using the BBSC security algorithm is reduced by 26% compared to [24] and 43% compared to [25].

Detection Accuracy:
While transferring the packets in the network some DDOS attacks may happen in the network. When an attack happens we will classify the packets as attack packets and normal packets. It is characterized as the system's ability to classify a packet as an "attack packet" and "normal packet." It describes the ratio of the right prediction for all samples. It is expressed mathematically in the following equation: In equation 1, the notations are as follows: TP-True Positive, TN-True Negative, False Positive, and FN-False Negative depending upon the classification of packets into these categories we evaluate the detection accuracy of the algorithm. As mentioned in the preceding section we compare our BBSC algorithm Detection accuracy with two more similar DDOS algorithms namely DDOS Prevention Mechanism [24] and DDoS Detection and Mitigation Framework [25]. Detection accuracy is measured in terms of percentage(%). The evaluated results of the three algorithms detection times are present in Table 2: The Figure 9 graph illustrates the attack detection accuracy of three different algorithms. here the attack detection accuracy is very high when we have a few packets. As the traffic in the network increases automatically detection accuracy will be decreased when the packets are more automatically traffic will be more and there is a loss of packets due to DDOS attacks. Hence, the results show that when compared to the remaining algorithms our BBSC security algorithm has very high detection accuracy because of its novel algorithms used in the BBSC security mechanism. Hence the detection accuracy using the BBSC security algorithm is improved by 6% compared to [24] and 15% compared to [25].

Simulation of Mitm Attack:
In this Section Man in the middle attacks are being simulated. Our proposed system BBSC is capable ofsolving Mitm attacks also.In this section, we are going to compare the BBSC algorithm with the IPS-IDS System framework [44] and KRACK mitigation Framework [46].We will simulate the BBSC in terms of detection time and detection accuracy and the results are as follows:

Detection Time for MitM:
The attack detection time is measured in milliseconds. In this time we will consider both the time taken to send the packets from switches to servers and vice versa as well as the total time taken for the attack to happen for the network. The algorithms are evaluated on mininet and the acquired results are in Table 3 Figure 10 graph illustrates the attack detection time of three different Frameworks for solving MItM attacks. here also the attack detection time is directly proportional to the number of the packet. If the data traffic increases which increases the detection time as the number of defective packets are more. but the results show that when compared to the remaining algorithms our BBSC security algorithm has very little detection time because of its security mechanism used. Hence the detection time using the BBSC security algorithm is better by 31% compared to [44] and 39% compared to [46].

Detection Accuracy for MItM attacks:
Detection accuracy is measured in terms of percentage(%). The evaluated results of the three frameworks detection times are in Table 4:  Figure 11 graph illustrates the attack detection accuracy of three different algorithms. here the attack detection accuracy is very high when we have fewer packets similar to the previous section. As the traffic in the network increases automatically detection accuracy will be decreased because more number of vulnerable packets when traffic increases. Hence, the results show that when compared to the remaining algorithms our BBSC security algorithm has very high detection accuracy because of the BBSC security mechanism. Hence the detection accuracy using the BBSC security algorithm is improved by 12% compared to [44] and 10% compared to [46].
In the paper [47] we had done an extensive Survey on Security threats in IoT and Emerging Countermeasures form which we had concluded that major security issues in IoT networks are denial of service (DoS) attack, distributed denial of service (DDoS) attack and Man in the Middle attack which was not effectively mitigated and resolved with a traditional network. Later in our paper [48], we understood the need of replacing the traditional IoT network paradigm with SDN to detect and mitigate network DDoS thus in the paper we implemented a testbed to resolve DDoS attacks. In our current proposed system, we have designed secure software-defined architecture for IoT networks that can detect and mitigate network attacks like DDoS and MiMA effectively. The implemented architecture is adaptable and easily configurable, scalable as the number of nodes increases.

Conclusion
In the current paper, we proposed a BBSC multipoint access SDN broadcast encryption method for a securely improved IoT-dependent SDN network. The proposed system will offer safe authentication access using BBSC based SDN Network. The routers are regulated by IoT multicast-protected transmission, which ensures data protection during transmission by transmitting the keys parallel to the SDN switches. The multi-client verification access requests meet a cryptography authentication system. The BBSC algorithm is tested and analyzed to secure the IoT network based on SDN in real testbeds to detect and mitigate DDoS and MiTM attacks. Since IoT has a wide range of applications in diverse areas, IoT is vulnerable to DDoS attacks, which have a significant effect on SDN-based IoT networks. Periodic and random IoT traffic is simulated and tested in the actual MININET testbed. We have evaluated the available bandwidth, compared our BBSC algorithm with two more popular DDOS Security algorithms in terms of detection time and detection accuracy, and shown that our algorithm performs well in terms of both parameters. This SDN-based architecture is easily adaptable, scalable in any IoT network also can detect and mitigate DDoS attacks efficiently. Currently, the testbed has considered periodic data transmission from IoT devices in the future would like to improvise the algorithm further such that even for random data generation from IoT devices the attacks will be detected and mitigated efficiently.


extfieldsofstudy:
Computer Science
Engineering

text:
Intelligent Spectrum Learning for Wireless Networks with Reconfigurable Intelligent Surfaces

Reconfigurable intelligent surface (RIS) has become a promising technology for enhancing the reliability of wireless communications, which is capable of reflecting the desired signals through appropriate phase shifts. However, the intended signals that impinge upon an RIS are often mixed with interfering signals, which are usually dynamic and unknown. In particular, the received signal-to-interference-plus-noise ratio (SINR) may be degraded by the signals reflected from the RISs that originate from non-intended users. To tackle this issue, we introduce the concept of intelligent spectrum learning (ISL), which uses an appropriately trained convolutional neural network (CNN) at the RIS controller to help the RISs infer the interfering signals directly from the incident signals. By capitalizing on the ISL, a distributed control algorithm is proposed to maximize the received SINR by dynamically configuring the active/inactive binary status of the RIS elements. Simulation results validate the performance improvement offered by deep learning and demonstrate the superiority of the proposed ISL-aided approach.

I. INTRODUCTION
Due to the dynamic nature of the wireless environment that results in severe signal fluctuations caused by multipath fading and the presence of large obstacles, the wireless link between a desired cellular user and a base station (BS) may not be reliable enough or may even undergo a complete outage. To tackle this issue, reconfigurable intelligent surfaces (RISs) have been proposed to improve the received signal-to-interference-plus-noise ratio (SINR) at the users by appropriately reflecting the incident signals and generating directional beams [1].
In the literature, some preliminary works investigated the optimization of RIS-assisted wireless communications. In [2], a joint transmit power allocation and phase shift design was developed to maximize the energy efficiency. In [3], the authors considered a downlink RIS-assisted multiuser communication system and studied a joint transmission and reflection beamforming problem to minimize the total transmit power. In [4], the channel estimation problem was investigated for an RIS-aided wireless communication system by jointly optimizing the training sequence of the transmitter and the reflection pattern of the RIS.
Furthermore, an RIS-assisted anti-jamming solution was proposed for securing wireless communications via reinforcement learning [5]. In [6], the authors introduced RISs in mobile edge computing systems, where a joint design of computing and communications was developed to minimize the computational latency.
However, most of the existing works assume either that no interference exists, which rarely occurs in practice, or that the interference is known and can be taken into account, which is not trivial to estimate since the interference is usually dynamically changing. These issues are exacerbated in RISaided systems, since they are nearly-passive surfaces with no active sensing capabilities for channel and interference estimation [7]. In order to elucidate the problem at hand, let us consider the case study depicted in Fig. 1(a), in which we consider a practical scenario where all the RISs serve one desired user (e.g., U 1 ). In the analyzed case study, the other users (e.g., U l , l ∈ [2, L]) are considered as interfering users for U 1 at each RIS. As a result, the signal reflected by each RIS is a mixture of the desired signal from U 1 and the interfering signals from the other users. In this context, the received SINR at the BS via an RIS that does not account for the interfering signals could be even worse than the SINR of the direct link. This impact of the interference is, in particular, more severe if the interfering devices are close to the desired user, e.g., in Fig. 1(a) U 2 may cause severe interference to U 1 at RIS 1 when the angle between them (i.e., λ) is small.
To overcome these challenges, in this paper, we empower a conventional RIS-assisted wireless system with 'intelligent spectrum learning (ISL) capabilities', by leveraging appropriately trained convolutional neural networks (CNN) at the RIS controller in order to predict/estimate the interfering devices from the incident signals, as highlighted in Fig. 1(b). In the proposed system, the active-inactive (or ON-OFF) status of each RIS 1 and the corresponding phase shifts need to be carefully optimized, since the interference distribution at each RIS is, in general, different. The corresponding SINR maximization problem turns out to be a mixed-integer nonlinear program (MINLP), which is usually difficult to solve. To tackle this issue, we decompose the original problem into two subproblems, which are solved independently and in a distributed manner. The proposed solution equips a conventional RIS with the capability to dynamically 'think-and-decide' whether reflecting or not the incident signals through the proposed distributed ISL principle.

II. SYSTEM MODEL AND PROBLEM FORMULATION
We consider an RIS-assisted uplink wireless system that consists of one BS, a set K of K RISs, and a set L of L users, where K ≥ 1 and L > K usually hold. We assume that the BS allocates all the RISs to serve one user at a time in order to improve the quality of the wireless link. Also, the direct links between the users and the BS are available. Under these assumptions, all the other users act as interferers for the intended user either through the direct links or through the links reflected by the RISs.
Each RIS operates as a nearly-passive surface, i.e., the RIS elements are passive but the RIS controller may consume power [8]. In particular, the RIS controller is equipped with a CNN, as shown in Fig. 1(b).
The CNN is discussed in the next sections.

A. RIS-Assisted Communication Model
Each RIS, denoted as R k , k ∈ K, is equipped with N k reflecting elements, which can be appropriately configured by the RIS controller to reflect the signals of the users towards the BS. In general, the RISs can be appropriately deployed so that line-of-sight (LoS) links can be established with the BS and, possibly, the users. We assume that the channel state information (CSI) of all channels involved is perfectly known at the BS 2 , which, in turn, can feed back the CSI to the RIS controller via a dedicated control channel [3], [6].
Each RIS can be in two possible states: ON and OFF. We introduce a binary variable β k ∈ {0, 1} to indicate the ON-OFF state of R k . β k = 1 indicates that R k is ON, which means that it reflects the incident signals, while β k = 0 indicates R k is OFF, which means that it does not reflect any signals.
As for the kth RIS that is ON, the amplitude reflection coefficient is assumed to be equal to one for all the N k reflecting elements and the phase reflection matrix is where Θ k = θ k 1 , θ k 2 , ..., θ k Nk denotes the vector of phase shifts that can be optimized by R k .

B. Wireless Channel Model
We consider an RIS-aided uplink wireless system, where the channels from the desired user (denoted as U l ) to R k , from R k to the BS, and from the mth interfering user (denoted as U m , m ∈ L, m = l) to R k , are h l,k ∈ C Nk×1 , g k ∈ C 1×Nk , and h m,k ∈ C Nk×1 , respectively. The channel gains of the direct links from U l to BS and from U m to BS are denoted by h d,l and h d,m , respectively. These channels are assumed to be perfectly estimated and quasi-static, hence remaining nearly-constant during the transmission time [3].
Without loss of generality, we assume that the users are randomly distributed and have time-varying traffic demands. This implies that the users may not be all active during the considered transmission time 3 . In particular, the total number of interfering users for U l is given by ω l = m∈L,m =l α m , where α m ∈ {0, 1} is a binary variable that indicates that U m is active (α m = 1) or inactive (α m = 0) and therefore can cause or not interference to U l , respectively. Accordingly, the set of active interfering users is W = {U m |α m = 1}, where ∀m = l and ∀m ∈ L.
Since the number of active interferers is dynamic, it is not easy to estimate the interference distribution over time. The received signal at the BS depends on the desired signal sent from U l (including the direct link and the link reflected by the RIS), the interference from the interfering users in W, and the white Gaussian noise: Interference from other users where p l and p m denote the transmit power of U l and U m , respectively, s l and s m are the unit-power information signals sent from U l and U m , respectively, and n l ∼ CN (0, σ 2 ) is the white Gaussian noise.
In addition, ξ k m,l ∈ [0, 1] accounts for the impact of the interference caused by U m to U l and that is associated to the kth RIS, as clarified in Assumption 1. Assumption 1. We assume that the impact of the strength of the interference reflected by an RIS is inversely proportional to the difference of the angles of incidence between the desired user and the interfering users at the RIS (see λ in Fig. 1(b) for an example).

C. Problem Formulation and Analysis
Let B = {β 1 , β 2 , ..., β K } denote the RIS binary decision vector that collects the binary variables that identify the ON-OFF status of the RISs. The set of RISs that are active is R = {R k |β k = 1} , ∀k ∈ K.
Accordingly, the SINR at the BS for the intended user U l is Our objective is to maximize the SINR in (3), by optimizing the RIS binary activation vector (B), and the phase shifts matrix of the active RISs which is denoted as To this end, we need to solve the following optimization problem:  Constraint (4b) indicates that the kth RIS can only be ON (i.e., β k = 1) or OFF (i.e., β k = 0) at one time. Constraint (4c) indicates that each RIS reflecting element can only provide a phase shift θ i n ∈ [0, 2π) without amplifying the signals.
Our Proposal: We observe that P 1 is an MINLP, which is NP-hard and whose global optimal solution is, in general, difficult to obtain. In addition, traditional optimization methods may be computationally intensive. An emerging approach to tackle this issue is to apply deep learning methods to solve P 1 at a reduced computational complexity [10], [11]. P 1 , however, may not be easy to solve even using deep learning methods, since the number of interfering users is a random variable that is unknown. In addition, during the channel estimation phase, the RISs cannot estimate on their own the active interferers because they only reflect the incident signals in a passive manner. This makes the solution of P 1 even more difficult. To address this challenge, we propose a distributed control mechanism that solves P 1 with the aid of the ISL algorithm.

III. DISTRIBUTED RIS CONTROL VIA INTELLIGENT SPECTRUM LEARNING
In this section, the ISL-aided distributed RIS control mechanism is introduced. The proposed approach leverages appropriately trained CNNs at the controller of the RISs, which can identify the active interfering users in a distributed way.

A. Intelligent Spectrum Learning
ISL is a multi-class classification algorithm that, based on a CNN, returns the set of interfering users for each intended user U l . To design the ISL algorithm, three main aspects need to be discussed: 1) RF traces collection, 2) offline CNN training, and 3) online CNN inference.
1) RF Traces Collection: As far as the RF data collection phase is concerned, historical RF traces are collected using a universal software radio peripheral (USRP2) testbed, which is wired connected (e.g., Gigabit Ethernet) to a host PC with an implementation of the GNU Radio, as illustrated in Fig. 2(a). In particular, the users are emulated through a laptop that is mainly responsible for baseband processing while a USRP2 platform is used for the up-conversion, the digital-to-analog (D/A) conversion, and wireless transmission of the signals. As far as the BS is concerned, another USRP2 module first receives the signals from the radio interface and then performs A/D and down-conversion. Subsequently, the laptop receives the signals from the USRP2 via the Ethernet and executes the baseband processing. Finally, the Inphase (I) and Quadrature (Q) sequences are stored as a file. In particular, the experimental setup for RF data collection using the USPR2 is performed by using signals at 2.4 GHz carrier frequency with 1 MHz bandwidth. In order to collect realistic RF signals in the presence of interference, we let multiple USRP2 units transmit RF signals to an USRP2 receiver. The RF traces have been collected as I/Q sequences, by including the wireless channel, for a wide range of SNR (e.g., from 0 to 20 dB with interval of 5 dB) in order to account for different interfering cases [12].
2) CNN Offline Training: The acquired RF traces have been used for training the CNN architecture illustrated in Fig. 2(b), where each convolutional layer is followed by a rectified linear units activation function for feature extraction. Fully-connected (FC) layers are used to classify the signals by using the softmax activation function for the output layer [13]. The training algorithms is based on the Adam algorithm that uses the cross entropy as the loss function. The CNN model is trained offline using TensorFlow on a GPU cluster (NVIDIA Tesla P100-PCIE-16GB).
Even though the training of the CNN does not account for all possible channel conditions, the generalization property of deep learning enables the trained CNN to infer channel conditions not included in the training dataset [14]. It is also noteworthy that several methods have been proposed to scale up the training process of deep neural networks across GPU clusters, which helps to further reduce the runtime of the offline training. Once the CNN model is appropriately trained, it can directly infer incident signals in near real-time. In other words, the proposed ISL-based framework moves the complexity from online computation to offline training.

3) CNN Online Inference:
The CNN is, in particular, trained in order to return the set of active interfering users based on different input signals at each RIS. Specifically, the received RF signals first undergo A/D conversion and frequency down-conversion. Then the baseband I/Q sequences are fed into the trained CNN model to perform online inference at the RIS controller.
By performing feed-forward calculation via the CNN model (i.e., online inference), the intefering users set for the desired user U l is obtained as {U m | α m = 1}, ∀m ∈ L, ∀m = l, If ω l ≥ 1,

∅,
If ω l = 0, where α m denotes the inferred state flag of U m , and ω l indicates the inferred total number of intefering users in the incident signal.

4) An Illustrative ISL Example:
To better understand the proposed ISL algorithm, we illustrate an example with only two users (denoted as U 1 and U 2 ), and each user has a binary state, i.e., 'active'/'ON' and 'inactive'/'OFF'. In this case, there exist four combinations of signals from the perspective of each RIS: (1) 'Idle' (indicating that both U 1 and U 2 are inactive), (2) 'Only U 1 ' (indicating that only U 1 is active), (3) 'Only U 2 ' (indicating that only U 2 is active), and (4) 'U 1 +U 2 ' (indicating that both U 1 and U 2 are active). Based on the superimposed incident signal(s), the RIS needs to identify the composition of the signal(s), i.e., to identify the correct class out of the four possible classes of signals. Therefore, this signal identification boils down to a four-class classification problem, as illustrated in Table I.

1) Optimal Phase Shifts Calculation:
To calculate the phase shifts at the RIS, we denote the obtained CSI associated to the kth RIS as C k = {h l,k , h m,k , g k , h d,l , h d,m }. Based on the inferred interfering users (including I l and ω l ) obtained via the trained CNN, the received SINR of the signal sent from U l is given by Based on (6), we first obtain the phase shifts of each RIS under the assumption β k = 1, ∀k ∈ K, and then optimize the optimum binary ON-OFF vector B based on the obtained phase shifts. The first step, in particular, can be formulated as We observe that P 2 is a non-convex problem, which can be tackled by using several methods, such as the semidefinite relaxation (SDR) method [3] and the successive convex approximation (SCA) method [15].
The optimal solution for the kth RIS is denoted by Θ * k , and the corresponding reflection-coefficient matrix is Φ * k . With the obtained reflection-coefficient matrix, each RIS ON-OFF status is optimized via the following RIS binary control algorithm.
2) Distributed RIS Binary Control Algorithm: Assuming that only the kth RIS is ON, i.e., β k = 1, the received SINR of the signal sent from U l to the BS via the kth RIS is If, on the other hand, all the K RISs are OFF, i.e., β k = 0 for k ∈ K, the received SINR of the signal sent from U l to the BS via the direct link is Based on (8) and (9), the kth RIS decides whether to be ON or OFF as detailed in Remark 1.

Remark 1.
The kth RIS should be ON if γ k l ≥ γ D l holds. This indicates, in fact, that the desired signal from U l can be enhanced via the kth RIS. Otherwise, the kth RIS should be OFF to avoid the degradation of the desired signal. In this case, the incident angle between the signals of the desired user and the interfering signals at the RIS is in general small.
The approach for solving P 2 is summarized in Algorithm 1, which is executed at each RIS controller when the incident signal is received. Specifically, upon receiving the incident signal, each RIS controller identifies the set of interfering devices by extracting the I/Q samples from a copy of the incident signal and feeding them into the trained CNN. Based on the classification outcome of the CNN, the RIS controller can set the RIS ON-OFF state in a distributed manner.
3) Computational Complexity: The total computational complexity includes the online inference via the CNN and the iterative algorithm to solve the phase shift optimization problem P 2 and the RIS ON-OFF optimization problem.
• Complexity for CNN online inference: The CNN is trained offline in a supervised fashion, therefore the complexity of training can be ignored. The trained CNN model has a quadratic time complexity Calculate Θ * k and Φ * k by solving problem P 2 ; 5: Calculate γ k l and γ D l via (8) and (9), respectively; 6: if γ k l ≥ γ D l then 7: Keep the kth RIS ON, i.e., β k = 1; Add the kth RIS binary decision β k to B. • Complexity for solving the phase shift optimization problem P 2 : To solve the problem P 2 , the complexity lies in computing the optimal phase shift at each iteration of the optimization method, e.g., the SCA method [15] whose complexity is O(Qz), where Q = K k=1 N k denotes the total number of elements of all the RISs, and z is the total number of the iterations required.
• Complexity for solving the RIS ON-OFF optimization problem: Since γ k l and γ D l need to be calculated via (8) and (9), respectively, the computational complexity of solving the RIS ON-OFF optimization problem required at each RIS controller is O(K).
As a result, the total complexity is O(M 2 CK + Qz + K), which grows linearly with the total number of RISs.

IV. SIMULATION RESULTS
In this section, we first evaluate the inference accuracy of the trained CNN model and the computational complexity of the proposed ISL-based DRBC algorithm. Then we validate the benefits of deploying the ISL-based DRBC algorithm.

B. Computation Time
The proposed ISL-based DRBC algorithm allows us to obtain the optimal ON-OFF status of each RIS.
As detailed in previous text, the optimal ON-OFF status of the RISs can be formulated as the solution of a non-convex MINLP, which is usually challenging to solve [15]. In this section, we compare the proposed ISL-based DRBC algorithm against the spatial branch and bound (sBB) method, which is often employed to solve non-convex MINLP [16], in terms of computation time.  Table III. Compared to the traditional sBB method, the ISL-based DRBC algorithm results in much lower computation time while still yielding the optimal ON-OFF status for each RIS.
The computation time of the proposed algorithm is less than one-thousandth of the computation time of the sBB method when the number of RISs varies from 2 to 5. The incident angle between the BS and U 1 at the RIS is 150 o , and the incident angle between U 2 and We assume that ξ k m,l is linearly inversely proportional to λ. The channel parameters are selected according to the 3GPP Urban Micro standard [17], which describes the path loss for both line-of-sight and non-line-of-sight components [18]. The transmission power of U 1 is 20 dBm, the noise power σ 2 is -94 dBm, the carrier frequency is 3 GHz, and the reflection amplitude is equal to one.
2) Simulation Results: We evaluate the performance of the proposed ISL-aided algorithm by comparing it with two benchmarks: 'RIS always ON' and 'RIS always OFF'. Figs. 3(a)-(b) depict the achievable SINR versus the angle of incidence (λ) for K = 1 and p m = 10, 15, 20 dBm. We observe that the SINR first gradually decreases as λ increases due to the reduction of the distance between U 2 and BS, and then increases due to the perfect interference elimination at the RIS. When λ is small in particular, the RIS is prone to be OFF since the interference reflected via the RIS is more pronounced. If λ is large, on the other hand, the impact of the interference is reduced and it is more probable that the RIS is ON. In general terms, however, the impact of λ on the system performance is still an open issue, whose analysis is postponed to a future research work.
In Figs. 4(a)-(c), the SINR versus K is illustrated, where p m = 10 dBm, the distance between U 2 and the RIS is 5 m. We observe that the RISs are always OFF if λ = 0, since the impact of the interference is too high. If λ is very large, e.g., λ = 150 o in Fig. 4(b), the impact of the interference is low and the RISs are always ON. When λ is randomly selected, e.g., λ ∈ [30 o , 120 o ] in Fig. 4(c), the SINR  obtained by the ISL algorithm increases with K and outperforms the two benchmarks, by about 100% with respect to 'RIS always OFF' and by nearly 300% with respect to 'RIS always ON' when K = 5.
From Figs 4(a)-(c), we conclude that the performance of the proposed ISL algorithm largely depends on λ, which impacts the interference cancellation at the RISs.

V. CONCLUSION AND FUTURE WORK
In this paper, we introduced an ISL algorithm that uses appropriately trained CNNs for the interference management in RIS-aided multi-user uplink networks. With the aid of the ISL algorithm, the RISs are capable of inferring the interfering signals directly from the incident signals. A distributed control algorithm was proposed to maximize the received SINR by dynamically configuring the binary status of the RIS elements. Simulation results validated the performance improvement offered by the proposed ISL-aided RIS approach. Offline training is only a candidate way to train a CNN, which may need to be retrained when RF data distribution changes significantly. This issue may be avoided by using online training methods, such as federated learning, which is a promising method for application in dynamical wireless environments.


extfieldsofstudy:
Physics
Computer Science

text:
An Optimal Scheduling Method for Numerical Weather Model Assimilation with Dense Observations

In this paper, the scheduling problem of dense observation data in a numerical weather model assimilation system is studied and an algorithm of "deal-reveal" is proposed. The algorithm identifies the area where all dense observation stations are located, and then obtains a certain number of grid point on which the value represents the stations quantity overlaid on it. The algorithm selects the stations with maximum value corresponding to the dense observation data iteratively and make the amount of each batch of dense observation stations as more as possible to reduce the batch number, enhances the overall performance of the system finally.

Introduction
In recent decades, there has been a great improvement in weather forecasting. The calculation of modern meteorological numerical prediction is usually completed by high-performance computer platform, which involves many disciplines, such as atmospheric science, computational mathematics, highperformance computer structure system, etc. [1]. And Data assimilation is one of the key techniques to improve the effectiveness of numerical weather prediction. Since Panofsky [2] put forward the differential polynomial method in 1949, the objective analysis method of data assimilation has been greatly developed. Current meteorological applications are usually built on high-performance computer platforms. So parallel computing technology is an important part of them. In a numerical weather model assimilation system, the parallel processing of dense observations is a key factor in determining system performance. The fundamental problem discussed in this paper is to use an appropriate scheduling strategy to complete the scheduling of dense observation data in the shortest time.
Scheduling problem refers to the process of allocating shared resources and scheduling production tasks within a certain period of time [3]. Scheduling problems involve various fields, such as mathematics, operations research and so on. Scientists have studied and solved many important scheduling and optimization problems by using the planning and analysis methods in various fields. Generally speaking, people regard the study of scheduling by Conway, Maxwell and Miller [4] as the beginning of the study of scheduling theory, on the basis of which the study of scheduling theory has made greater progress. Later, the study of scheduling complexity begins to enter people's horizon, and scientists find that the essence of various scheduling problems is NP hard problem [5].
In scheduling problems, resources are usually referred to as machines and tasks as artifacts. Tasks that need to be completed can be called artifacts, while machines are objects that provide processing, which are resources needed to complete tasks [6]. Among all scheduling problems, the workshop scheduling problem is one of the most classic scheduling problems. From the first issue of flow workshop published by Johnson [7] to the open workshop model proposed by Gonzalea & Sahni [8], people's research on the workshop scheduling problem has become more and more in-depth. Parallel machine scheduling problem is another branch of the scheduling problem, and it is also an important research area. Parallel machine scheduling is the study of task allocation to parallel machines and task ordering on parallel machines [9]. Research on parallel scheduling problem originated from the 1950s. After Mcnaughton [10] and Hu [11] published their research on the problems related to parallel scheduling, the parallel scheduling problem gradually came into people's field of vision.
The typical scheduling problem of parallel multi-machine is the scheduling problem of parallel multimachine with the minimum completion time. For the small-scale scheduling problem of parallel multimachine with a minimum completion time, heuristic algorithm is usually used to solve it [12]. However, it is usually a NP hard problem for the large-scale scheduling problem of parallel multi-machine with minimum completion time, and an effective scheduling strategy is needed in order to solve the problem. At present, intelligent optimization algorithms such as genetic algorithms are usually used to solve this kind of algorithm, but in practice, a new method is needed to solve the scheduling problem of parallel multi-machine with minimum completion time under special constraints.
Scheduling of dense observations is an important part of the parallel processing of a numerical weather model assimilation system. The essence of this scheduling problem is to minimize the completion time of a parallel multi-machine scheduling problem with special constraints. In this paper, the algorithm of "deal-reveal" is proposed to solve the scheduling problem of parallel multi-machine with minimum completion time under this special constraint.

Problem Description
Dense observation data refers to the observation data collected by actual observation sites that are densely distributed and unevenly distributed in a certain area. Consider N dense observation data assimilation system allocated to M is calculated in the parallel machine, each machine at the same time only for calculation, a dense observation data for each dense observation data can be calculated on any machine, processing time of each dense observation data consistent and calculate it only once, every batch of dense observations must be assigned to a machine to compute each other. In this assimilation system, the influence of dense observations is a rectangular area centered on the frank observation site. The calculation of the same batch of dense observation data needs to be independent of each other for the maximum efficiency of parallel machines. If there is conflict in the influence area of the same batch of dense observation data, the conflict observation data will be transferred to serial processing. The calculation of the next batch of observations cannot be conducted until all the current batch of dense observations have been calculated.
The distribution of dense observation data is dense and unbalanced. Each batch of dense observation data allocated to parallel machine calculation needs to be independent of each other, so the number of dense observation data that can be simultaneously calculated in parallel is bound to decrease. From this, important constraints of computing performance can be obtained, one is the number of parallel machines. The second is the number of batches calculated. The hardware limits the number of parallel machines and there is an upper limit to the number of each batch of mutually independent dense observation data. Therefore, when the number of parallel machines reaches this upper limit, the restriction condition is to calculate the number of batches. The number of calculated batches depends on the designed scheduling strategy. That is, the selection of dense observation data calculated for each batch. Therefore, the scheduling strategy has a significant impact on the performance of the system. The better the scheduling strategy, the higher the parallelism of the system in the calculation of dense observation data.
On the least finish time is parallel machine scheduling problem, the more "artifact" is a dense observation data, special constraints for each batch of dense observation data to each other and each batch of dense observation data must be finished all processing to the calculation of the next batch of dense observation data, so in this problem need to find the optimal scheduling strategy in order to handle all dense observation data through the shortest time.
In the traditional algorithm, there is no simple and easy-to-use algorithm that can be directly applied to this scheduling problem. The simpler method can adopt the random scheduling strategy, but the random scheduling strategy has great randomness, and it cannot guarantee that each scheduling can reduce the density of the dense observation data, so it cannot obtain better processing performance of the dense observation data.
In this paper, aiming at the scheduling problem of dense observation data, a "deal-reveal" scheduling algorithm is designed. Through the interaction between the map area and the real observation site, the algorithm guarantees that each scheduling will reduce the density of the dense observation data to the greatest extent, thus making the computation highly parallel and improving the performance of the system.

Problem Analysis
In the scheduling problem of the assimilation system, the key to improve the performance of the system is tantamount to complete the scheduling calculation of the dense observation data in a shorter time. The distribution of dense observation data is unbalanced, the density of each region is unique, and the same batch of dense observation data must not affect each other, in order to carry out parallel calculation normally.
The mutual non-influence of the dense observation data refers to the non-overlap of the influence areas of the same batch of dense observation data. Therefore, when there are enough parallel machines, the number of each batch of dense observation data that can be computed by parallel is limited. At this time, the scheduling strategy is the factor determining the performance of the assimilation system. The key point of this scheduling strategy is how to make the number of dense observations in each batch of parallel computation large enough.
On the basis of the above problem description and analysis, the following definition is made: there are N dense observation data, M parallel machines, the influence range of each dense observation data is the longitude and latitude range of the k*k size map centered on the location of the dense observation data, and all dense observation data fall within the map area S. The resolution of map region S is defined as S ratio , the number of grid points on the meridian line is Lon total , the number of grid points on the latitude line is Lat total , and the number of grid points on the map area is Grid total . When two populous area overlap between the influence of the observation data, said the two dense observation data conflict, define the influence of the i-th a dense observation data dense observation data of N i number, when all the dense observation data after being placed on the map region S, the influence of high density of each observation data will overwrite the grid points on the map. Set the freeze point value G ij to represent the number of dense observation data covering the grid point in the influence range, set the number of batches to be scheduled as C total , The number of dense observations processed in batch i is d i , the processing time of each batch of dense observation data as T deal , and the total processing time as T total .
The scheduling problem is described as follows:  In order to minimize T total , the number of batches to be processed, C total , should be minimized if the T deal value of each batch of observations is constant. To reduce the size of the C total , the amount of dense observations processed in each batch should be as large as possible d i for further analysis.
From the above description, it can be seen that making d i as large as possible is the key to the scheduling problem. The value of d i ranges from 1 to M, where M is the number of parallel machines. The essence of making d i as large as possible is to reduce the density of dense observations each time dense observations are scheduled. Dense intensive observation data distribution to a certain extent available maximum G max point value and maximum of dense observation data conflict R max described, when a lattice has a value of 0, represent the scope includes the lattice of all dense observation data calculation has been finished, so each batch of dense observation data calculation is the best result can make G max and R max to reduce to a great extent, when G max is 0, on behalf of all of the dense observation data are calculated.
In this paper, the corresponding influence range of each dense observation data is regarded as a "card", and the corresponding lattice point value is the number of "card" covering the lattice point. The scheduling and calculation of each batch of dense observation data can be regarded as taking out a certain number of "card" in the map area. After all the "card" are taken out from the map area, it represents that the dense observation data are all scheduled.
After the above analysis, the final scheduling strategy can be obtained, that is, when taking out the dense observation data in each round, the dense observation data corresponding to the lattice point value G max should be taken out first, and when G max corresponds to multiple dense observation data, the dense observation data corresponding to R max should be selected. This algorithm is named for the "deal-reveal" scheduling algorithm.

"deal-reveal" Algorithm
In this paper, the whole steps of the "deal-reveal" scheduling algorithm are divided into two steps, the first step is the "deal" step, the second step is the "reveal" step. In this algorithm, the influence range of observation data is regarded as a "card". "deal" places all observation data on the corresponding map area, and "reveal" puts the observation data into parallel machine for calculation according to certain strategies.
The "deal" step initializes the model as a whole, including initializing the region lattice, observation data, lattice matrix and relational matrix. The specific algorithm steps are as follows: 1) Initialize a map area to include all observation data, and set the resolution of the area, which is generally 0.01, indicating that every two adjacent grid points in the area are 0.01 longitude or 0.01 latitude apart; 2) Set the attributes of the observed data as id, lat, lon and qty, where id represents the sequence number, lat represents the latitude value, lon represents the longitude value, and qty represents the number of observed data in conflict with the observed data; 3) Three copies are obtained by copying all the observation data, named as lat-copy, lon-copy and qty-copy respectively. Among them, lat-copy is sorted in ascending order according to lat value, lon-copy in ascending order according to lon value, and qty-copy in descending order according to qty value; 4) The lattice point matrix G is initialized, where g ij is the value of row i and column j in G.
According to the influence range of observation data, the lattice point g ij on the map area is assigned a value, which is the number of observation data covering the lattice point; 5) Initialize the relationship matrix R, where r ij is the value of row i and column j in R. The value represents whether the observed data with id i is affected by the observed data with id j. If affected, the value is true, otherwise the value is false; 6) Initialize the selection array C, where C i is the value of index i in the relational matrix R, which represents whether the observation data with id i has been selected. If it has been selected, the value is true; otherwise, the value is false; In the "deal" process, the higher the value of the lattice point matrix G, the higher the density of the region, and the relational matrix R is rapidly initialized by two copies of the full observation data ordered by the values of lat and lon.
In the "reveal" step, observation data are taken out according to certain strategies. The observation data of each round are scheduled as follows: 1) Initialize the optional array O according to the selection array C, where O i if true means that the observation data with id of i has been selected, if false means that the data has not been selected; 2) According to the maximum lattice value in lattice matrix G, obtain the observation data with the highest quality value corresponding to all observation data that can be selected as the first observation data selected in this batch. The optional array O is updated by the relation matrix R and the array C is selected by the selected observation data update. If O i is true, it means that the observation data with id i has been selected or it conflicts with other selected observation data of the batch; 3) According to the optional array O, select the observation data with the largest qty value among the optional observation data as the next observation data, update the optional array O and selection array C; 4) Repeat step 3) until the number of observations required by the round is obtained or the round has no selected observations; 5) At the end of this round, the lattice point matrix G and the qty-copy are updated for the next round of scheduling; In the "reveal" step, the optional array O represents the optional array for this round, and the observations that are not optional for this round may be optional for the next round. Therefore, before each round, the optional array O should be cleared, and then initialized by the selection array C. The overall flow of this algorithm is shown in Figure. 1.

Experimental Result
The following results are produced by running the assimilation system using different scheduling methods with the same hardware configuration. From Figure. 2 experimental observation sites, and the number of dense observation data is thousands. The traditional scheduling algorithm and the "license-uncovered" scheduling algorithm are used to conduct scheduling tests on the same observation data respectively, and the first-round scheduling effect is shown in Figure. 3 and Figure. 4.
The overall time output of the assimilation system scheduled by the random scheduling algorithm is presented in Figure. 5, with a total time of about 34,200 seconds. The overall time output of the assimilation system scheduled by the "deal-reveal" scheduling algorithm is presented in Figure. 6, with a total time of about 4,300 seconds and an acceleration ratio of 7.95.
By contrast can be found that compared with the traditional random scheduling algorithm, when selecting observation data in each round, the "deal-reveal" scheduling algorithm takes into account the conflict relationship between observation data, and ensures that after each round of scheduling, the overall density of observation data is effectively reduced, thus reducing the overall number of scheduling rounds. By scheduling the observation data with this algorithm, the parallelization degree of each round of the scheduled observation data significantly increases, and the overall performance of the system is further greatly enhanced.

Conclusions
In this paper, we study a kind of numerical weather model dense observation data assimilation system scheduling problem. The essence of the problem is with special constraint conditions to minimize the completion time of parallel machine scheduling problem. It is difficult for traditional methods to solve the scheduling problem of the parallel multi-machine with the minimum completion time with this special constraint, so this paper proposes a "deal-reveal" scheduling algorithm to solve the scheduling problem of the parallel multi-machine with the minimum completion time under this special constraint. In this algorithm, the influence area of observation data is represented by "card", and the number of "card"s covering the grid point is recorded by the grid point value, so as to ensure that each scheduling can select non-conflicting observation data from the most dense map area. After each round of scheduling, the density of observation data decreases continuously, so a lower number of scheduling rounds can be obtained to reduce the overall processing time and effectively improve the performance of the assimilation system.
The results show that the algorithm can be effectively applied to a large scale parallel scheduling problem with minimum completion time under special constraints, and the algorithm can be further applied to other parallel scheduling problems with minimum completion time similar to this problem.