MISSION-AWARE ADMISSION AND RESILIENT ROUTING OF CRITICAL FLOWS
DOI:
https://doi.org/10.28925/2663-4023.2025.35.1350Keywords:
controlled rollback, synthetic evaluation, field trial.Abstract
Cloud-edge systems carrying mission-critical messaging face a control problem that is not reducible to generic DDoS filtering or elastic scaling. During a malicious flood, a legitimate flash crowd, a gateway compromise, or a network partition, the same aggregate load may require opposite actions: rejection, priority preservation, local failover, rerouting, or controlled cloud offload. This article proposes a mission-aware adaptive admission-control and resilient-routing method that jointly uses functional criticality, source trust, delivery deadline, queue state, backup-path availability, and predicted cascade impact. The controller distinguishes hostile and legitimate surges, assigns service classes, selects a feasible low-risk path, and activates local failover or cloud transfer only when resource and safety constraints are satisfied. Every intervention is bounded by a time-to-live, blast-radius limit, post-action verification, and controlled rollback condition. The method is specified as a constrained multi-objective optimization problem and implemented as a closed-loop controller suitable for SDN/NFV-enabled edge environments. A V2–V3 evaluation protocol is defined around a real messaging stack, SDN/NFV components, edge nodes, DDoS/flash-crowd/partition scenarios, and resource-fair baselines: static ACLs, fixed rate limiting, cloud autoscaling, and rule-based rerouting. Primary metrics are mission loss, deadline availability, p95/p99 latency, legitimate-traffic loss, MTTR, switching cost, and controller overhead. Because validated field measurements are not yet available, the results section is populated with clearly labelled synthetic data produced by a seeded discrete-event simulation of the reference V2 topology (30 seeds per cell); these values illustrate the expected effect structure and calibrate the proposed field trial, but are not empirical findings. The design treats excessive blocking of legitimate flows or SLA violation as a negative result, even when attack traffic is reduced. The study therefore isolates the optimization contribution of mission-aware flow control, provides a reproducible protocol for determining when its overhead is justified, and formulates a staged field-trial proposal with explicit go/no-go criteria.
Downloads
References
Yu, S., Zhou, W., Jia, W., Guo, S., Xiang, Y., & Tang, F. (2012). Discriminating DDoS attacks from flash crowds using flow correlation coefficient. IEEE Transactions on Parallel and Distributed Systems, 23(6), 1073–1080. https://doi.org/10.1109/TPDS.2011.262
David, J., & Thomas, C. (2021). Discriminating flash crowds from DDoS attacks using efficient thresholding algorithm. Journal of Parallel and Distributed Computing, 152, 79–87. https://doi.org/10.1016/j.jpdc.2021.02.019
Alves da Silva, A. A., Silva, L. S., Bezerra, E. L., Guelfi, A. E., de Armas, C., Teixeira de Azevedo, M., & Kofuji, S. T. (2022). A proposal to distinguish DDoS traffic in flash crowd environments. International Journal of Information Security and Privacy, 16(1), 1–16. https://doi.org/10.4018/IJISP.2022010104
Devi, N. N., & Singh, K. J. (2025). Detecting and differentiating the DDoS and flash events using adaptive deep learning models. Applied Soft Computing, 171, Article 112669. https://doi.org/10.1016/j.asoc.2024.112669
Qu, C., Calheiros, R. N., & Buyya, R. (2018). Auto-scaling web applications in clouds: A taxonomy and survey. ACM Computing Surveys, 51(4), Article 73. https://doi.org/10.1145/3148149
Somani, G., Gaur, M. S., Sanghi, D., Conti, M., & Buyya, R. (2017). DDoS attacks in cloud computing: Issues, taxonomy, and future directions. Computer Communications, 107, 30–48. https://doi.org/10.1016/j.comcom.2017.03.010
Bremler-Barr, A., Brosh, E., & Sides, M. (2017). DDoS attack on cloud auto-scaling mechanisms. In IEEE INFOCOM 2017—IEEE Conference on Computer Communications (pp. 1–9). IEEE. https://doi.org/10.1109/INFOCOM.2017.8057010
Cascone, C., Sanvito, D., Pollini, L., Capone, A., & Sansò, B. (2017). Fast failure detection and recovery in SDN with stateful data plane. International Journal of Network Management, 27(2), Article e1957. https://doi.org/10.1002/nem.1957
Ni, H., Guo, Z., Li, C., Dou, S., Yao, C., & Baker, T. (2022). Network coding-based resilient routing for maintaining data security and availability in software-defined networks. Journal of Network and Computer Applications, 205, Article 103372. https://doi.org/10.1016/j.jnca.2022.103372
Tahir, H., Akhtar Abid, S., Ali, A., Chaudhary, M. T., Shah, N., Nawaz, R., Al-Fuqaha, A., & Ahmad, F. (2025). Scalable and resilient routing for in-band SDNs with a distributed hash table-based approach. International Journal of Communication Systems, 38(16), Article e70248. https://doi.org/10.1002/dac.70248
Sahay, R., Blanc, G., Zhang, Z., & Debar, H. (2017). ArOMA: An SDN-based autonomic DDoS mitigation framework. Computers & Security, 70, 482–499. https://doi.org/10.1016/j.cose.2017.07.008
Musa, M., Ang, T. F., Chen, Y.-L., Bhatti, U. A., Ku, C. S., Luo, Y., Chen, J., & Por, L. Y. (2026). Distributed denial of service detection and mitigation in software-defined networking-enabled software-defined wide area networks. PLOS ONE, 21(5), Article e0346673. https://doi.org/10.1371/journal.pone.0346673
Juan Ferrer, A., Panadero, J., Marques, J. M., & Jorba, J. (2021). Admission control for ad-hoc edge cloud. Future Generation Computer Systems, 114, 548–562. https://doi.org/10.1016/j.future.2020.08.024
Bakri, S., Brik, B., & Ksentini, A. (2021). On using reinforcement learning for network slice admission control in 5G: Offline vs. online. International Journal of Communication Systems, 34(7), Article e4757. https://doi.org/10.1002/dac.4757
Wang, J., Li, J., & Liu, J. (2024). Digital twin-assisted flexible slice admission control for 5G core network: A deep reinforcement learning approach. Future Generation Computer Systems, 153, 467–476. https://doi.org/10.1016/j.future.2023.12.018
Mendis, H. V. K., Lange, S., & Heegaard, P. E. (2024). Admission control in intent-based network slices for the smart grid usecase. In 2024 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) (pp. 405–411). IEEE. https://doi.org/10.1109/SmartGridComm60555.2024.10738080
Tao, Z., Xu, W., & You, X. (2025). Digital twin-accelerated online deep reinforcement learning for admission control in sliced communication networks. IEEE Transactions on Communications, 73(4), 2490–2504. https://doi.org/10.1109/TCOMM.2024.3476430
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Юлія Хохлачова
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
