Counteracting UDP Flooding Attacks in SDN

The flexibility and programmability offered by Software Defined Networking (SDN) emerge as an approach to resolve some of the main challenges that the Internet of Things (IoT) deployments expose. In the present article, we explore the application of SDN components onto IoT deployments, together with the decoupling of typical gateway functions in two realms; the physical one and the virtual at the edge. This disengagement is a novel approach necessary since the computation resources on the physical part of the infrastructure are limited. Thus, the more resource-consuming processes are transferred to the edge of the network, in the virtual counterpart of the gateway. Additionally, within this infrastructure, different network applications can be running at the top of the SDN controller, in the control plane, for example, QoS policies application, management of network parameters, etc. Providing a holistic view of the IoT deployment. Between its advantages, this work focus on the ease of creation of an IoT infrastructure with the gateway and SDN architecture, and the behaviour of the IoT system. For validation, a small setup scenario and a use case is created where heterogeneous IoT sensors communicate with the physical part of the gateway, implemented with a Raspberry Pis and this, with its virtual part at the edge of the network, so finally sent the data to an IoT platform (FIWARE-ORION) at the core network managed by a virtual Switch (OpenVSwitch) and a RYU-based SDN controller.

Purpose The purpose of the study concludes detecting address resolution protocol (ARP) Spoofing attack in software-defined network (SDN) architecture meanwhile using different machine learning models to evaluate their effectiveness. Design/methodology/approach This research originates from building a SDN topology and researching into its changes under ARP Spoofing attack. Based on that, the authors propose four features which show obvious abnormalities in network under attack stage. The data collected from SDN controller is used to build a data set, which is then put into different machine learning models, which are: Artificial Neuron network (ANN), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), CNN-LSTM and Gated Recurrent Unit (GRU). Findings After applying this proposal in simulation and experimental environments, they achieve impressive performance metrics. In simulation environment, the GRU model stands out with the highest accuracy of 98.94%. In real environments, the CNN-LSTM model leads with a recall of 98.38% and an F1-Score of 98.57%, while the LSTM model has the highest precision (98.8%). The GRU model also performs strongly in real scenarios with a high accuracy of 97.65%. ANN, despite its reliability, struggles with lower recall and F1-Score across both environments. Originality/value This analysis emphasizes the importance of the proposed features when applied to different models and their high potential to conduct in practical environment.

Software defined networks (SDN) remain a hot research field as it provides controllable networking operations. The SDN controller can be treated as the operating system of the SDN model and it holds the responsibility of performing different networking applications. Despite the benefits of SDN, security remains a challenging problem. At the same time, distributed denial of services (DDoS) is a typical attack on SDN owing to centralized architecture, especially at the control layer of the SDN. This article develops a new Cat Swarm Optimization with Fuzzy Rule Base Classification (CSO-FRBCC) model for cybersecurity in SDN. The presented CSO-FRBCC model intends to effectually categorize the occurrence of DDoS attacks in SDN. To achieve this, the CSO-FRBCC model primarily pre-processes the input data to transform it to a uniform format. Besides, the CSO-FRBCC model employs FRBCC classifier for the recognition and classification of intrusions. Moreover, the parameter optimization of the FRBCC classification model is adjusted by the use of cat swarm optimization (CSO) algorithm which results in improved performance. A comprehensive set of simulations were carried out on benchmark dataset and the results highlighted the enhanced outcomes of the CSO-FRBCC model over the other recent approaches.

The demand for real-time data in a modern battlefield is increasing exponentially. As a result, current military network paradigms and architectures are struggling to cope with increasing capacity demands at the tactical edge. Unfortunately, rescaling existing network architectures will not be a permanent solution to the problem. Therefore, in this paper, we propose a 3- tiered Software Defined Networking (SDN) architecture consisting of heterogeneous Dense Networks (DenseNets), which is a highly condensed deployment of relatively small, lowpowered femtocells, at the tactical edge. The proposed 3-tiered SDN architecture abstracts the Land Tactical Network (LTN) as the Physical Layer, the Battlefield Tactical Network (BTN) as the Control Layer, and the Joint Task Force Headquarters (JTFHQ) as the Management Layer. The simulation and results confirm the architecture’s capability for providing interoperability between heterogeneous communications equipment and supporting high capacity demands within limited and unreliable networking infrastructure in battlefield environments.

Detecting flooding DDoS attacks in software defined networks using supervised learning techniques

Software Defined Networks (SDN) have been utilized in applications of the Internet of Things (IoT), termed as software-defined IoT network, because of the popularity and capability of mobile devices being used for networking in relatively large areas. In a software-defined IoT system, the sensing data are asynchronously harvested by the mobile sensing nodes, and are also asynchronously uploaded to the gateways of a software-defined network. Thus, all the sensing data are asynchronously transmitted from the gateways to the data servers in the pattern of multipoints-to-point (M2P) data transmissions. Even if the sensing data are generated from the same sensing event, the controller of SDN has no knowledge about this relationship. Thus, such asynchronous M2P data transmissions from the same sensing event at the gateways will generate many redundant requests to their controller by OpenFlow protocol of SDN. In this paper, we investigate the redundant requests caused by the asynchronous M2P data transmissions in the software-defined IoT network. We model the relationship between the sensing events and the uploading gateways by utilizing their spatial locations and the distribution of mobile sensor nodes. To reduce the loads on the controller for the asynchronous M2P data transmissions, we propose an One-Request Scheme for Software-Defined IoT Networks (ORSIN), to batch the updating the forwarding rules of the multiple data transmissions from the same event by the first one request from a gateway. Our extensional simulations verify the effectiveness of our proposed approach.

Software-defined networking (SDN) is a new networking architecture having the concept of separation of control plane and data plane that leads the existing networks to be programmable, dynamically configurable and extremely flexible. This paradigm has huge benefits to organizations and large networks, however, its security is major issue and Distributed Denial of Service (DDoS) Attack has become a serious concern for the working of SDN. In this article, we have proposed a taxonomy of DDoS Defense Mechanisms in SDN Environment. We have categorized the various DDoS detection and mitigation techniques with respect to switch intelligence, Defense Deployment, Defense Activity and Network Flow Activities.

Toward an optimal solution against Denial of Service attacks in Software Defined Networks

Software Defined Networking (SDN) is disruptive networking technology which adopts a centralised framework to facilitate fine-grained network management. However security in SDN is still in its infancy and there is need for significant work to deal with different attacks in SDN. In this paper we discuss some of the possible attacks on SDN switches and propose techniques for detecting the attacks on switches. We have developed a Switch Security Application (SSA)for SDN Controller which makes use of trusted computing technology and some additional components for detecting attacks on the switches. In particular TPM attestation is used to ensure that switches are in trusted state during boot time before configuring the flow rules on the switches. The additional components are used for storing and validating messages related to the flow rule configuration of the switches. The stored information is used for generating a trusted report on the expected flow rules in the switches and using this information for validating the flow rules that are actually enforced in the switches. If there is any variation to flow rules that are enforced in the switches compared to the expected flow rules by the SSA, then, the switch is considered to be under attack and an alert is raised to the SDN Administrator. The administrator can isolate the switch from network or make use of trusted report for restoring the flow rules in the switches. We will also present a prototype implementation of our technique.

In this paper, we propose two simple and practically feasible countermeasures to address the Route Spoofing and Resource Exhaustion attacks in Software Defined Networking (SDN) scenarios. For Route Spoofing attack, we introduce a new technique called “selective blocking” which blocks an adversary node to use a genuine user's active routes, and for Resource Exhaustion attack, we propose a “periodic monitoring” technique that detect adversary nodes based on the traffic analysis statistics gathered over a period of time at SDN data plane switches. We perform the implementation of the aforementioned attacks and their proposed countermeasures. With our proposed countermeasures installed in the target SDN scenarios, the simulation results indicate 35% reduction in bandwidth consumption, 60% gain in packet delivery rate, and 50% reduction in processing delay.

Software-defined networking (SDN) is an emerging network architecture that decouples the control plane from the data plane, enabling centralized programmability and management of networks. While SDN offers benefits like flexibility, scalability, and automation, it also introduces new security vulnerabilities. This literature review analyzes the current state of research on SDN security in three key domains – Internet of Things (IoT) environments, cloud computing, and traditional enterprise networks. A systematic review methodology was followed to search, select, and review 53 relevant studies published in the past 5 years. The analysis focuses on identifying common SDN threat vectors, security solutions proposed leveraging SDN programmability and evaluating their effectiveness based on results from simulations, testbed experiments, and initial real-world implementations. Key findings of the review include lack of authentication, susceptibility to DDoS attacks, and flow rule conflicts as major security issues in SDN across domains. Dynamic traffic monitoring, access control, policy orchestration, and virtualized security functions are commonly proposed techniques to enhance SDN security. However, limitations exist in robustness testing at scale, emerging paradigms like fog computing, and quantitatively comparing SDN security with legacy networks. As SDN adoption expands, focused efforts are needed to address these research gaps through innovations in data-driven security, coordinated security policy, and emphasizing SDN controller security. This review provides valuable insights into the current state of SDN security research and informs future efforts needed in this important area

Introduction: Distributed denial-of-service (DDoS) has become a common attack type in cyber security. Apart from the conventional DDoS attacks, software-defined networks also face some other typical DDoS attacks, such as flow-table attack or controller attack. One of the most recent solutions to detect a DDoS attack is using machine learning algorithms to classify the traffic. Purpose: Analysis of applying machine learning algorithms in order to prevent DDoS attacks in software-defined network. Results: A comparison of six algorithms (random forest, decision tree, naive Bayes, support vector machine, multilayer perceptron, k-nearest neighbors) with accuracy and process time as the criteria has shown that a decision tree and naïve Bayes are the most suitable algorithms for DDoS attack detection. As compared to other algorithms, they have higher accuracy, faster processing time and lower resource consumption. The main features that identify malicious traffic compared to normal one are the number of bytes in a flow, time flow, Ethernet source address, and Ethernet destination address. A flow-table attack can be detected easier than a bandwidth attack, as all the six algorithms can predict this type with a high accuracy. Practical relevance: Important features which play a supporting role in correct data classification facilitate the development of a DDoS protection system with a smaller dataset, focusing only on the necessary data. The algorithms more suitable for machine learning can help us to detect DDoS attacks in software-defined networks more accurately.

Distributed Denial of Service (DDoS) attacks represent a major concern in modern Software Defined Networking (SDN), as SDN controllers are sensitive points of failures in the whole SDN architecture. Recently, research on DDoS attacks detection in SDN has focused on investigation of how to leverage data plane programmability, enabled by P4 language, to detect attacks directly in network switches, with marginal involvement of SDN controllers. In order to effectively address cybersecurity management in SDN architectures, we investigate the potential of Artificial Intelligence and Machine Learning (ML) algorithms to perform automated DDoS Attacks Detection (DAD), specifically focusing on Transmission Control Protocol SYN flood attacks. We compare two different DAD architectures, called Standalone and Correlated DAD, where traffic features collection and attack detection are performed locally at network switches or in a single entity (e.g., in SDN controller), respectively. We combine the capability of ML and P4-enabled data planes to implement real-time DAD. Illustrative numerical results show that, for all tested ML algorithms, accuracy, precision, recall and F1-score are above 98% in most cases, and classification time is in the order of few hundreds of upmu text {s} in the worst case. Considering real-time DAD implementation, significant latency reduction is obtained when features are extracted at the data plane by using P4 language.Graphic

Cyber attacks are a major concern for network administrators as the occurrences of such events are continuously increasing on the Internet. Software-defined networks (SDN) enable many management applications, but they may also become targets for attackers. Due to the separation of the data plane and the control plane, the controller appears as a new element in SDN networks, allowing centralized control of the network, becoming a strategic target in carrying out an attack. According to reports generated by security labs, the frequency of the distributed denial of service (DDoS) attacks has seen an increase in recent years, characterizing a major threat to the SDN. However, few research papers address the prevention of DDoS attacks on SDN. Therefore, this work presents a Systematic Mapping of Literature, aiming at identifying, classifying, and thus disseminating current research studies that propose techniques and methods for preventing DDoS attacks in SDN. When answering these questions, it was determined that the SDN controller was vulnerable to possible DDoS attacks. No prevention methods were found in the literature for the first phase of the attack (when attackers try to deceive users and infect the host). Therefore, the security of software-defined networks still needs improvement over DDoS attacks, despite the evident risk of an attack targeting the SDN controller.

At present, IoT devices are increasingly being implemented in multiple organizations. At universities, IoT devices are connected via the wired or wireless to the computer network. However, connecting IoT devices to a computer network is proposed to be difficult in larger campuses computer networks: with a wide range, numerous buildings, and faculty. The issue poses a security breach and required many network administrators to monitor the network. In this paper, Software Defined Network (SDN) is implemented and tested on campus networks to build a framework for easier and manageable, more extensive networks and define IoT devices among faculty, including IoT for Smart farm from agriculture faculty. In an SDN architecture, the ability to configure, manage, secure, and optimize network resources via software affords many benefits to enterprises. This article is contextualized from the concept of the Internet of Things (IoT), its security, the interoperability of VLANs, and software-defined networks. By taking into account existing architectures and technologies, intelligent infrastructure is proposed to support all processes.