Attack-aware Security Function Management

Although Software-defined networking (SDN) is a promising architecture that simplifies network management and control, it also faces security problems that may affect the whole network. Hence, protecting strategies, such as intrusion detection and prevention system (IDPS), are in need in the SDN context. The potential of machine learning-based solutions can become the motivation of cut-edge deep learning-based intrusion detection system that can leverage the centralized control and view of the controller to secure the underlying infrastructure. However, performing additional IDPS functions in the controller, which needs to process enormous traffic amounts, can overload this component, and slow down the network. This paper introduces an approach of Big Data analysis for intrusion detection system in SDN, named BIDSDN to enhance the classification perfor-mance with a massive amount of network traffic data. Specifically, we leverage Apache Spark to deploy the distributed deep learning – based detector to reduce the processing time on complex algorithms. The experiments conducted on CICIDS2018 dataset with distributed cluster prove the efficacy in tackling the Big Data-related issues in the large-scale network like SDN.

Distributed Denial-of-Service (DDoS) attack has been a “nightmare” for cloud. A countermeasure is to establish an Intrusion Detection and Prevention System (IDPS) for cloud. Nevertheless, current IDPSes fail to achieve the detection and prevention in a flexible and lightweight way. In this paper, we propose a novel scheme of IDPS for overcoming the above problem, termed as Auto-scaling IDPS (AsIDPS). AsIDPS is based on Software-Defined Networking (SDN) and Docker container technologies. It first detects abnormal traffic based on the flow statistics collected in SDN switches in real-time. By the SDN controller, the abnormal traffic will be directed to the created Docker containers with Snort running on them for further detection and clean-up. Particularly, the Docker containers can be automatically scaled out or scaled down on demand. The Snort will also deliver an alert to the SDN controller if it detects attack traffic so as to perform a countermeasure if necessary. Benefitting from the flexible network management offered by SDN and the lightweight Docker container, AsIDPS is able to build a flexible and lightweight defense against DDoS attack in cloud. Based on our prototype implementation, we validate the effectiveness of AsIDPS in defending DDoS attack, and also verify its flexibility and lightweight.

Service Function Chaining (SFC) serves the traffic of a specific service along an ordered set of Service Functions (SFs). SFC uses Software Defined Networking (SDN) and Network Function Virtualization (NFV) technologies to reach the deployment and removal of SFC in an appropriate time with minimal costs. However, during the life time of deployed SFCs, the SFs are exposed to the risk of overloading, which results in an end-to-end packets drop and high delay at the application level. This paper presents the concept of a Scalable SFC Orchestrator capable of deploying SF Chains following the ETSI NFV architectural model, as well as orchestrating the runtime phase by rerouting the traffic to a different path in case of overload of certain SF instances. Moreover, a selection algorithm is presented to build the updated paths after scaling. The Scalable Orchestration feature is implemented and added as a main feature to an SFC Orchestrator. Furthermore, it is integrated into a current NFV architecture and evaluated in an NFV environment making use of the Fraunhofer FOKUS Open Baton toolkit in an OpenStack and Open Daylight based environment.

The discovery process of OPC Unified Architecture (OPC-UA) is well defined but lacks flexibility when implemented in large networks. While the standard provides concepts for local and global discovery services, the core assumption is that all clients and servers are aware of the discovery server(s) in the network. This dependency is a barrier for Plug-and-Play installations and is overcome by self announces via the multicast Domain Name System (mDNS), however, this scales badly with an increasing number of network nodes and deployed servers. We propose a discovery approach based on Software-Defined Networking (SDN) and Network Function Virtualization (NFV), that installs a plug-and-play mechanism for global OPC-UA discovery in modern virtualized networks.

A comprehensive survey of service function chain provisioning approaches in SDN and NFV architecture

This paper presents an overview of the technologies and the methodologies used in Network Intrusion Detection and Prevention Systems (NIDPS). Intrusion Detection and Prevention System (IDPS) technologies are differentiated by types of events that IDPSs can recognize, by types of devices that IDPSs monitor and by activity. NIDPSs monitor and analyze the streams of network packets in order to detect security incidents. The main methodology used by NIDPSs is protocol analysis. Protocol analysis requires good knowledge of the theory of the main protocols, their definition, how each protocol works.Keywords: Intrusion Detection and Prevention System, Protocol Analysis, Sensor, Signature, State(ProQuest: ... denotes formulae omitted.)1 IntroductionIncreasing size and complexity of the Internet and Intranet networks have led to increasing number of vulnerabilities that could be exploited. Thus, the internal and external attacks on the information systems are increasing at an alarming rate. Also, these are becoming more severe and sophisticated. The attackers find ingenious ways to bypass the security controls and to compromise the security and the well functioning of the information systems. They are motivated by financial, political, and military objectives. In this context, defending wide area networks from malicious traffic, unauthorized access to systems involves many problems.In security information systems Network Intrusion Detection and Prevention Systems (NIDPS) are important tools to detect possible incidents and also, to attempt to stop them in real time. Due to changing attacks, intrusion detection methodologies and technologies continuously evolve, adding new detection capabilities, to avoid detection. They must adapt to new forms of malware, to the public networks, increased traffic.2 Concepts of Intrusion DetectionAn intrusion is a successful action to gain access to an information system, to compromise it or to make it unavailable. This is possible due to the presence of vulnerability in the target system that can be exploited by a motivated intruder.Intrusion Detection and Prevention is the process of monitoring the information systems by sensors or agents and analyzing the collected information to detect and to attempt to stop the attacks in real time, identifying vulnerabilities, the violation of security policies or standard security practices.An Intrusion Detection and Prevention System (IDPS) is a tool that monitors information systems, collects, analyzes information, and initiates responses when an intrusion is detected.Intrusion Detection Systems (IDSs) mainly work as defensive mechanisms. They only alert the system administrators that an incident has occurred. Intrusion Prevention Systems (IPSs) can take some actions to attempt to stop the attack, such as breaking the connection or modifying the firewall rules to deny access to the intruder. The response of the classic IDS can be slow if the system administrator is busy while the response of the IPS is automatic. An architecture that uses together IPS and IDS technologies is the best solution for defense in depth.Conceptually, a generic IDPS consists of modular components. It mainly has the following components: monitoring system, storage, analyzer, and responder.* Monitoring system - monitors and logs the events in a computer system or network;* Storage - stores information, called audit record, about suspicious activities or intrusions; also, the security policies used in analysis are stored;* Analyzer - uses different analysis methodologies to detect the incidents;* Responder - the response mechanism of incidents.The IDPSs could be classified as:* By detection methodology [12], [18]:- misuse-based detection- anomaly-based detection- stateful protocol analysis* By activity [12]:- network-based- wireless-based- network behavior analysis- host-based* By behavior on detection:- passive- active* By collection and analysis frequency:- continuous- periodicThe detection methodologies describe the characteristics of the analyzer. …

Network Slicing (NS) technique is comprehensively reshaping the next-generation communication networks (e.g. 5G, 6G). Software-Defined Networking (SDN) and Network Functions Virtualization (NFV) predominantly control the flow of service functions on NS to incorporate versatile applications as per user demands. In the virtualized-Software Defined Networking vSDN environment, a chain of well-defined virtual network functions (VNFs) are installed on Service Function Chains (SFCs) by multiple Internet Service Providers (ISPs) concurrently. Generation, allocation, re-allocation, release and destroying associative VNFs on SFC is an extremely difficult task while keeping high selection accuracy. Towards solving this fundamental issue, in this work, we have proposed a multi-layered SFC formation for adaptive VNF allocation on dynamic slices. We have formulated an ILP to address the VNF-EAP (VNF-Embedding and Allocation Problem) over real network topology (AT&T Topology). Leveraging machine learning techniques we have shown an intelligent VNF selection mechanism to optimize resource utilization. The performance evaluation shows remarkable efficiency on ML-driven dynamic VNF selections over static allocations on SFCs by halving resource usage. Further, we have also studied a VNF typecasting technique for service backup on outage slices in the field of disaster management activities.

Network softwarization technologies, such as software defined networking (SDN), network virtualization (NV), and network function virtualization (NFV), emerge and have been greatly promoted by their supporters. This softwarization scheme contributes to isolating network control from data panel, and allocating virtualized physical network resources flexibly. However, physical switches and links, supporting the softwarization scheme, may be attacked by malicious attackers. Even if these switches and links are softwarized and virtualized successfully, the problem of mapping various virtual network requests, known as virtual network embedding, is difficult to solve directly. Each customized VN request must be allocated and implemented in the appropriate manner. To deal with these issues, we research the virtual network mapping for secure SDN-enabled networks. Firstly, a hierarchical virtualization architecture for SDN- enabled networks is presented. Then, the security model for different malicious attacks is presented. Thirdly, we propose the novel and secure virtual network mapping framework, labeled as \textit{NoViSec}, for supporting SDN-enabled networks. Preliminary experiment results are plotted and discussed so as to validate the effectiveness of our secure \textit{NoViSec} framework.

Complex services composed of middleboxes are mainly used to meet the requirements of advanced services such as security services, monitoring systems, and personalized enterprise services. However, forwarding a traffic across middleboxes is a tedious and error-prone task. Service function chaining (SFC) presents different solutions to steer the traffic among intermediate service functions. However statically managing, deploying, and configuring an SFC remains a challenging task. Dynamic SFC has recently gained significant interest from big networking operators motivated by the emerging technologies of Software Defined Networking (SDN) and Network Function Virtualization (NFV). In this paper, we present a new SDN based architecture and a novel header for traffic steering for dynamic SFC. Our results show that the header we describe in this paper does not increase the packet size nor the overhead.

Virtual Private LAN Services (VPLS) is an Ethernet based VPN (Virtual Private Network) service which provides protocol independent and high speed multipoint-to-multipoint connectivity. In this article, we discuss the possibility to use emerging networks concepts such as Software Defined Networking (SDN) and Network Function Virtualization (NFV) to improve the performance, flexibility and adaptability of VPLS networks. SDN and NFV based VPLS (SoftVPLS) architectures offer new features such as centralized control, network programmability and abstraction to improve the performance, flexibility and automation of traffic, security and network management functions for future VPLS networks.

Software-defined networking (SDN) and network function virtualization (NFV) together form a promising paradigm that enables the slicing of heterogeneous network resources for agile and efficient service customization. Among other techniques, virtual network function (VNF) mapping and scheduling are crucial to the deployment of SDN/NFV-enabled network services. In this paper, to enhance the performance of service provisioning, dynamic VNF mapping and scheduling are jointly investigated. Specifically, to achieve load balancing with QoS guarantee, we first formulate the VNF mapping and scheduling problem as a mixed integer linear programming (MILP). We then propose a two-stage online algorithm to address the NP-hardness of the MILP. In particular, when new service arrives, we map and schedule the VNFs on a service function chain (SFC) by greedily minimizing the waiting time of VNFs. If the delay requirement cannot be satisfied after the first stage, a delay-aware rescheduling scheme is triggered, in which selected existing VNFs are remapped and rescheduled. The proposed dynamic approach achieves flexible function placement and increases service acceptance ratio. Simulation results are provided to validate the effectiveness of the proposed algorithm.

Software Defined Networking (SDN) and Network Function Virtualization (NFV) are transforming Data Center (DC), Telecom, and enterprise networking. The programmability offered by P4 enables SDN to be more protocol-independent and flexible. Data Centers are increasingly adopting SmartNICs (sNICs) to accelerate packet processing that can be leveraged to support packet processing pipelines and custom Network Functions (NFs). However, there are several challenges in integrating and deploying P4 based SDN control as well as host and sNIC-based programmable NFs. These include configuration and management of the data plane components (Host and sNIC P4 switches) for the SDN control plane and effective utilization of data plane resources. P4NFV addresses these concerns and provides a unified P4 switch abstraction framework to simplify the SDN control plane, reducing management complexities, and leveraging a host-local SDN Agent to improve the overall resource utilization. The SDN agent considers the network-wide, host, and sNIC specific capabilities and constraints. Based on workload and traffic characteristics, P4NFV determines the partitioning of the P4 tables and optimal placement of NFs (P4 actions) to minimize the overall delay and maximize resource utilization. P4NFV uses Mixed Integer Linear Programming (MILP) based optimization formulation and achieves up to 2. 5X increase in system capacity while minimizing the delay experienced by flows. P4NFV considers the number of packet exchanges, flow size, and state dependency to minimize the delay imposed by data transmission over PCI Express interface.

It is our great pleasure to welcome you to the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization - SDN-NFV Security'18. SDN-NFV Security'18 offers a unique opportunity by bringing together researchers from academic, industry, as well as government agencies to discuss security challenges faced by two emerging networking paradigms, Software-Defined Networking (SDN) and Network Function Virtualization (NFV). SDN-NFV Security'18 solicits the submission of original unpublished ideas in 6-page long papers and 4-page short papers that address the latest practices, experiences, and lessons learned on SDN and NFV security. The call for papers attracted submissions from Europe and the United States. SDN-NFV Security'18 accepted 3 full papers be presented in this workshop, after a rigorous review process (at least 4 reviews for each paper) and discussion phase. In addition, we have invited 8 papers (5 full papers and 3 short papers) from domain experts to be presented in the workshop.

The integration of software defined networking (SDN) and network function virtualization (NFV) is a promising approach to support flexible service deployment and provisioning. In particular, NFV enables a network service to be represented as one network service function chain, which is composed of several virtual network functions in a specific order. However, with regard to service provisioning in multidomain SDN networks, virtual network functions are deployed in several different SDN domains due to limited resource capacity of each SDN domain. It results in the network service deployment complexity increase and causes additional operating cost. On the other hand, most current network service deployment proposals are limited to static user request scenarios. How to effectively deploy network service across multiple SDN domains to satisfy dynamic service demands of end users is a challenging problem. To address the aforementioned challenge, in this paper, we study the problem of dynamic network service deployment across multiple SDN domains. Specifically, we first design a novel service deployment framework to support dynamic deployment and optimization of virtual network function in multidomain SDN networks. Then, we formulate the problem as a multiobjective optimization problem with the target of jointly minimizing resource consumption cost and operating cost. Furthermore, we transform the multiobjective optimization problem into a single objective optimization model and present an efficient heuristic service deployment approach to solve it by leveraging Dijkstra algorithm. The simulation results demonstrate that the proposed service deployment method is efficient and outperforms comparison methods in terms of service rejection ratio, resource cost, and operating cost.

Security functions are usually deployed on proprietary hardware, which makes the delivery of security service inflexible and of high cost. Emerging technologies such as software-defined networking and network function virtualization go in the direction of executing functions as software components in virtual machines or containers provisioned in standard hardware resources. They enable network to provide customized security service by deploying Security Service Chain (SSC), which refers to steering flow through multiple security functions in a particular order specified by individual user or application. However, SSC Deployment Problem (SSC-DP) needs to be solved. It is a challenging problem for various reasons, such as the heterogeneity of instances in terms of service capacity and resource demand. In this paper, we propose an SSC-based approach to deliver security service to users without worrying about physical locations of security functions. For SSC-DP, we present a three-phase method to solve it while optimizing network and security resource allocation. The presented method allows network to serve a large number of flows and minimizes the latency seen by flows. Comparative experiments on the fat-tree and Waxman topologies show that our method performs better than other heuristics under a wide range of network conditions.