A DDoS Vulnerability Analysis System against Distributed SDN Controllers in a Cloud Computing Environment

The integration of cloud computing with Software Defined Networking (SDN) addresses several challenges of a typical cloud infrastructure such as complex inter-networking, data collection, fast response, etc. Though SDN-based cloud opens new opportunities, the SDN controller may itself become vulnerable to several attacks. The unique features of SDN are used by the attackers to implement the severe Distributed Denial of Service (DDoS) attacks. Several approaches are available in literature to defend against the traditional DDoS flooding attacks in SDN-cloud. To elude the detection systems, attackers try to employ the cultivated attack strategies. Such sophisticated DDoS attack strategies are implemented by generating low-rate attack traffic. The most common type of Low-Rate DDoS (LR-DDoS) attack is the Shrew attack. The existing approaches are not capable to detect, mitigate, and traceback such attacks. Thus, this work discusses a new mechanism which not only detects and mitigates the shrew attack but traces back the location of the attack sources as well. The attack is detected using the information entropy variations, and the attack sources are traced-back using the deterministic packet marking scheme. The experiments are performed in a real SDN-cloud scenario, and the experimental results show that the approach requires 1 packet and 8.27 packets on an average to locate the bots and attackers respectively. The approach detects and traces back the attack sources in between 14.45 ms to 10.02 s and provides 97.6% accuracy.

Software-defined networking (SDN) has revolutionized traditional network management by decoupling the control and data planes, offering enhanced flexibility, programmability, and efficiency. However, this centralized architecture makes SDN vulnerable to Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, which severely impact network performance and reliability. Through overloading critical network components, especially the SDN controller, these attacks reduce network availability and result in significant service interruptions. This review offers a thorough summary of mitigation strategies designed to combat DoS and DDoS attacks in SDN systems. These attacks overwhelm network resources, disrupt services, and compromise the availability of critical components such as the SDN controller. Additionally, it explores the key challenges facing SDN in defending against DoS and DDoS attacks, such as the need for real-time detection, the impact of network scale, and the complexities of adaptive responses. As such, addressing DoS and DDoS attacks has become a critical research area for ensuring the security and robustness of SDN-based networks. It categorizes existing approaches based on detection methods, response strategies, and deployment models, providing a detailed analysis of their strengths and limitations. Furthermore, it discusses problems such as scalability, concurrent detection, and adaptability that hinder the effectiveness of current solutions. Emerging trends, including integrating artificial intelligence, blockchain, and collaborative frameworks, are highlighted as promising directions for future research. This aim is to give researchers, network admins, and cyber-security practitioners an insight into the state of the art as well as a basis on which to build for future SDN security advancements. This survey aims to serve as a comprehensive resource for researchers and practitioners seeking to imporve SDN's resilience against DoS and DDoS attacks.

Software-defined networking (SDN) is a new way of transforming networks. It works on the principle of separating the infrastructure plane from the control plane. In the control plane, the centralized SDN controller acts as a brain of the network. Selecting the best SDN controller for the network is one of the most crucial tasks. In this paper, the experimental comparison between the two most powerful and popularly known SDN controllers on which many other SDN controllers are laid down their foundations i.e. OpenDayLight (ODL) and open networking operating system (ONOS) is performed. The experimentation is carried out on the Mininet emulation tool. Real-time packets are captured and analyzed using Wireshark. The results of the comparison concluded that the performance of the ODL controller is better than the ONOS in terms of burst rate, throughput, Round Trip Time (RTT) and bandwidth.

Background & Objective: Detecting and mitigating Distributed Denial of Service (DDoS) attacks is a serious problem. In addition, new features and network deployments such as Software- Defined Networking (SDN) may open the door for new threats that did not previously exist. : Recent publications and patent are reviewed to find new techniques developed for integrating different mechanisms to secure networks against DDoS. Methods: This work presents a simple model for integrating different mechanisms to secure both SDN and legacy network in a hybrid cloud environment, it is called FocusON. It aims at mitigating DDoS attacks of a victim network. In addition, separating network monitoring from its control aims at mitigating DDoS attacks of a victim network. Traffic pattern analysis is apart from attack detection mechanism that gives a conceptual representation of a specific kind of DDoS attacks. DDoS detection is a completely automated process. Once called, for the reaction, the active response will be taken against the real IP source of the attacker. : The communication time overhead was tested in order to evaluate the remote server response time in case of deploying our proposed model mechanisms and without our proposed model. : Here we introduce a response mechanism that consists of an analysis of event logs, traffic patterns, and IP traceback. The proposed model categorizes the underlying network according to the location into a victim network and the source of attack (public cloud). Results & Conclusion:: The proposed model implemented in a hybrid cloud environment using the network of SDN and legacy network. The experimental setup was built using our network lab connected to the Amazon public cloud.

Exploring current solutions against DDoS attacks in SDN environment

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

Cyber attacks are a major concern for network administrators as the occurrences of such events are continuously increasing on the Internet. Software-defined networks (SDN) enable many management applications, but they may also become targets for attackers. Due to the separation of the data plane and the control plane, the controller appears as a new element in SDN networks, allowing centralized control of the network, becoming a strategic target in carrying out an attack. According to reports generated by security labs, the frequency of the distributed denial of service (DDoS) attacks has seen an increase in recent years, characterizing a major threat to the SDN. However, few research papers address the prevention of DDoS attacks on SDN. Therefore, this work presents a Systematic Mapping of Literature, aiming at identifying, classifying, and thus disseminating current research studies that propose techniques and methods for preventing DDoS attacks in SDN. When answering these questions, it was determined that the SDN controller was vulnerable to possible DDoS attacks. No prevention methods were found in the literature for the first phase of the attack (when attackers try to deceive users and infect the host). Therefore, the security of software-defined networks still needs improvement over DDoS attacks, despite the evident risk of an attack targeting the SDN controller.

Software defined networks (SDN) remain a hot research field as it provides controllable networking operations. The SDN controller can be treated as the operating system of the SDN model and it holds the responsibility of performing different networking applications. Despite the benefits of SDN, security remains a challenging problem. At the same time, distributed denial of services (DDoS) is a typical attack on SDN owing to centralized architecture, especially at the control layer of the SDN. This article develops a new Cat Swarm Optimization with Fuzzy Rule Base Classification (CSO-FRBCC) model for cybersecurity in SDN. The presented CSO-FRBCC model intends to effectually categorize the occurrence of DDoS attacks in SDN. To achieve this, the CSO-FRBCC model primarily pre-processes the input data to transform it to a uniform format. Besides, the CSO-FRBCC model employs FRBCC classifier for the recognition and classification of intrusions. Moreover, the parameter optimization of the FRBCC classification model is adjusted by the use of cat swarm optimization (CSO) algorithm which results in improved performance. A comprehensive set of simulations were carried out on benchmark dataset and the results highlighted the enhanced outcomes of the CSO-FRBCC model over the other recent approaches.

This article describes how novel functionalities will take advantage of the cloud networking and will gradually replace the existing infrastructure of mobile networks with a virtualized one. Two technologies, namely software defined networking (SDN) and network function virtualization (NFV), offer their important benefits and a combination of them is an answer to the demands raised, such as central office re-architected as a data center (CORD). Open network operating system (ONOS) and POX are SDN controllers and offer an option to combine SDN and NFV addressing many ongoing problems in the field of mobile networks. In this paper, technologies and both controllers are compared and contrasted. Indicative cases of topologies are simulated and help evaluating both controllers. According to the experimental findings, ONOS is one of the most important controllers for practical, theoretical, research and educational purposes, while POX is a useful and simpler controller for other educative applications.

The nature of computer network flash crowd traffic, which is generated by legitimate users accessing servers or other network resources are similar to the traffic generated by Distributed Denial of Service (DDoS) like attacks. With advancement in spoof packet generation tools, attacker may generate Multi-source Multi-destination Multi-protocol (MMM) traffic; characteristics of such traffic are very similar to on-going genuine/ flash crowd traffic in the network. In the case of Software Defined Network (SDN), attacker’s target is controller plane. Controller plane in SDN is a centralized processing unit of the underlying network, which manages several data planes. Controller plane frames the policies and pushes forwarding rules to the data planes. Data planes just maintain the forwarding rules. Thus by overloading the SDN controller, functionality of complete computer network will be hampered. In this paper, we have proposed Media Access Control (MAC) address based Model to Differentiate Flash crowd and Malicious traffic in SDN (MDFMS). Novelty of the proposed model is to detect, locate and mitigate the source of Traditional DDoS (T-DDoS) and MMMDDoS traffic. MDFSM has been implemented on separate machine to avoid any additional computing load on SDN controller. It also preserves the original design of the SDN architecture. Proposed model has been evaluated under various scenarios and encouraging results have been obtained to differentiate T-DDoS and MMM-DDoS from benign flash crowd traffic.

The Software Defined Networking (SDN) is an innovative network architecture that offers flexible and programable networks through a centralized controller. However, If the controller fails the whole system becomes paralyzed. The Distributed Denial of Service (DDoS) attack is one of the main threats to the SDN controller, as it exhausts the resources of the SDN controller which disturbs the whole network and affects the performance of the network. In this regard, we propose a Support Vector Machine (SVM) based machine learning classifier to detect the DDoS attacks on SDN controller. Once the attack is detected by the classifier, mitigation module is invoked to block the attack flows. The objective is to detect DDoS attacks with high accuracy and mitigate them in a short period of time. We evaluate our proposed solutions on two different publicly available datasets. i.e., KDD and KDD’99

The Internet of Things (IoT) is a network of sensors that helps collect data 24/7 without human intervention. However, the network may suffer from problems such as the low battery, heterogeneity, and connectivity issues due to the lack of standards. Even though these problems can cause several performance hiccups, security issues need immediate attention because hackers access vital personal and financial information and then misuse it. These security issues can allow hackers to hijack IoT devices and then use them to establish a Botnet to launch a Distributed Denial of Service (DDoS) attack. Blockchain technology can provide security to IoT devices by providing secure authentication using public keys. Similarly, Smart Contracts (SCs) can improve the performance of the IoT–blockchain network through automation. However, surveyed work shows that the blockchain and SCs do not provide foolproof security; sometimes, attackers defeat these security mechanisms and initiate DDoS attacks. Thus, developers and security software engineers must be aware of different techniques to detect DDoS attacks. In this survey paper, we highlight different techniques to detect DDoS attacks. The novelty of our work is to classify the DDoS detection techniques according to blockchain technology. As a result, researchers can enhance their systems by using blockchain-based support for detecting threats. In addition, we provide general information about the studied systems and their workings. However, we cannot neglect the recent surveys. To that end, we compare the state-of-the-art DDoS surveys based on their data collection techniques and the discussed DDoS attacks on the IoT subsystems. The study of different IoT subsystems tells us that DDoS attacks also impact other computing systems, such as SCs, networking devices, and power grids. Hence, our work briefly describes DDoS attacks and their impacts on the above subsystems and IoT. For instance, due to DDoS attacks, the targeted computing systems suffer delays which cause tremendous financial and utility losses to the subscribers. Hence, we discuss the impacts of DDoS attacks in the context of associated systems. Finally, we discuss Machine-Learning algorithms, performance metrics, and the underlying technology of IoT systems so that the readers can grasp the detection techniques and the attack vectors. Moreover, associated systems such as Software-Defined Networking (SDN) and Field-Programmable Gate Arrays (FPGA) are a source of good security enhancement for IoT Networks. Thus, we include a detailed discussion of future development encompassing all major IoT subsystems.

Software Defined Network (SDN) Technology made tremendous changes in networking field by controlling the hardware with remote software by decoupling data plane and control plane. The focus here is on the controller which is part of control plane. A controller is a central part of SDN; it is an intermediary between Data plane and Forwarding plane. It takes prime place in SDN architecture like Operating System in Computers. SDN Controller is a software which directs the packets using flow rules and also contains statistical information of network. The controller orchestrates the networking devices such as switches and routers by channelizing the packets. SDN controller has different flavor based on the commercial requirement achieved by including new pluggable module. This paper discusses some of the SDN Controller with their feature; the controllers are POX, NOX, Floodlight, ODL, Open Contrail. This paper also compares the characteristic of centralized and distributed controller by focusing on performance, bandwidth and round-trip time of Floodlight and Open Daylight (ODL) controller. The simulation is conducted using Mininet.

Software-Defined Networks (SDN) provides more control and network operation over a network infrastructure as an emerging and revolutionary paradigm in networking. Operating the many network applications and preserving the network services and functions, the SDN controller is regarded as the operating system of the SDN-based network architecture. The SDN has several security problems because of its intricate design, even with all its amazing features. Denial-of-service (DoS) attacks continuously impact users and Internet service providers (ISPs). Because of its centralized design, distributed denial of service (DDoS) attacks on SDN are frequent and may have a widespread effect on the network, particularly at the control layer. We propose to implement both MLP (Multilayer Perceptron) and CNN (Convolutional Neural Networks) based on conventional methods to detect the Denial of Services (DDoS) attack. These models have got a complex optimizer installed on them to decrease the false positive or DDoS case detection efficiency. We use the SHAP feature selection technique to improve the detection procedure. By assisting in the identification of which features are most essential to spot the incidents, the approach aids in the process of enhancing precision and flammability. Fine-tuning the hyperparameters with the help of Bayesian optimization to obtain the best model performance is another important thing that we do in our model. Two datasets, InSDN and CICDDoS-2019, are utilized to assess the effectiveness of the proposed method, 99.95% for the true positive (TP) of the CICDDoS-2019 dataset and 99.98% for the InSDN dataset, the results show that the model is highly accurate.

The complexity of handling modern apps is causing older network architectures to struggle. As a result, Software Defined Networking (SDN) has developed into a paradigm-shifting network framework that enables administrators to exercise programmable control over whole network infrastructures. This development makes it easier to configure and operate large networks, but it also adds vulnerabilities, including the possibility of Distributed Denial of Service (DDoS) assaults that could take down the SDN controller. Integrating security tools like firewalls, intrusion detection and prevention systems, and anti-DDoS solutions is crucial to reducing this danger. In the context of SDN, leveraging the analytical power of Machine Learning (ML) algorithms to analyse network traffic patterns is a key tactic for fending off DDoS attacks. Effective defence systems are supported by these ML models, which can distinguish between normal network behaviour and DDoS assault traffic with ease. Decision trees (DT), support vector machines (SVM), and artificial neural networks (ANN) are examples of supervised ML techniques that have evolved into crucial tools in this field. These algorithms are developed utilising datasets with annotations that include examples of both legitimate and malicious network traffic. Once trained, the models may be used to instantly categorise incoming traffic, making it easier to identify and contain any DDoS attacks in real-time.