IDSMatch: A Novel Deployment Method for IDS Chains in SDNs

Software-defined networking is a new paradigm that overcomes problems associated with traditional network architecture by separating the control logic from data plane devices. It also enhances performance by providing a highly-programmable interface that adapts to dynamic changes in network policies. As software-defined networking controllers are prone to single-point failures, providing security is one of the biggest challenges in this framework. This paper intends to provide an intrusion detection mechanism in both the control plane and data plane to secure the controller and forwarding devices respectively. In the control plane, we imposed a flow-based intrusion detection system that inspects every new incoming flow towards the controller. In the data plane, we assigned a signature-based intrusion detection system to inspect traffic between Open Flow switches using port mirroring to analyse and detect malicious activity. Our flow-based system works with the help of trained, multi-layer machine learning-based classifier, while our signature-based system works with rule-based classifiers using the Snort intrusion detection system. The ensemble feature selection technique we adopted in the flow-based system helps to identify the prominent features and hasten the classification process. Our proposed work ensures a high level of security in the Software-defined networking environment by working simultaneously in both control plane and data plane.

Cloud and parallel computing are fundamental components in the processing of large data sets. Deployments of distributed computers require network infrastructure that is fast, efficient, and secure. Software Defined Networking (SDN) separates the forwarding of network data by switches (data plane) from the setting and managing of network policies (control plane). While this separation provides flexibility for setting network policies affecting the establishment of network flows in the data plane, it provides little to no fault tolerance for failures, either benign or caused by corrupted/malicious applications. Such failures can cause network flows to be incorrectly routed through the network or stop such flows altogether. Without protection against faults, cloud network providers using SDN run the risk of inefficient allocation of network resources or even data loss. Furthermore, the asynchronous nature existing protocols for SDN does not provide a mechanism for consistency in network policy updates across multiple switches.In addition, cloud and parallel applications require an efficient means for accessing local system data (input data sets, temporary storage locations, etc.). While in many cases it may be possible for a process to access this data by making calls directly to a file system (FS) kernel driver, this is not always possible (e.g. when using experimental distributed FSs where the needed libraries for accessing the FS only exist in user space).This dissertation provides a design for fault tolerance of SDN and infrastructure for advancing the performance of user space FSs. It is divided into three main parts. The first part describes a fault tolerant, distributed SDN control plane framework. The second part expands upon the fault tolerant approach to SDN control plane by providing a practical means for dynamic control plane membership as well as providing a simple mechanism for controller authentication through threshold signatures. The third part describes an efficient framework for user space FS access.This research makes three contributions. First, the design, specification, implementation, and evaluation of a method for fault tolerant SDN control plane that is inter-operable with existing control plane applications involving minimal instrumentation of the data plane runtime. Second, the design, specification, implementation and evaluation of a mechanism for dynamic SDN control plane membership that all ensure consistency of network policy updates and minimizes switch overhead through the use of distributed key generation and threshold signatures. Third, the design, specification, implementation, and evaluation of a user space FS access framework that is correct to the Portable Operating System Interface (POSIX) specification with significantly better performance over existing user space access methods, while requiring no implementation changes for application programmers.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

Security elements of data communication networks such as packet filters, firewalls, intrusion detection and prevention systems are in first line of defense against cyber security threats and various attacks such as DDoS and many others. With constantly increasing demand of compute power and grow of various cloud services, complexity of traditional networks makes it more difficult to maintain security policies in fast and safe manner. To simplify management and overcome limitations of traditional networks concept of software-defined networking (SDN) was proposed. The main idea of SDN is separation of control and data planes of devices. Combined control plane into network controller brings intelligence into network and open wider possibilities for automation. Separated data plane makes it possible for devices to run in headless mode during critical situations when control plane is not functioning. SDN also simplifies managing of security policies, it helps to ensure intime deploying and minimize possibility of mistake. However, SDN architecture has some places which can be used as main point of cyber-attack. Purpose of this paper is to describe security benefits and drawbacks of software-defined network.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Distributed denial of service (DDoS) attacks challenge software-defined networks (SDN), primarily due to vulnerabilities present in the separation between the control and data planes. The control plane maintains continuous communication with the data plane switches to direct traffic according to forwarding policies. Although the literature presents various solutions to detect DDoS attacks, most of them concentrate on the control plane. The controller facilitates automated network management, making it easier to integrate and administer applications. On the other hand, the development of security solutions on the control plane imposes an additional load on the controller’s duties. As an alternative to this problem, the research community proposed security solutions adapted to work on the data plane. However, due to the complexity of acting in this layer, the proposed solutions are restricted to statistical analysis of the network flow. This work proposes DataPlane-ML, a machine learning (ML) solution that acts on the data plane to detect DDoS attacks. To realize the use of ML techniques at the data plane, DataPlane-ML makes use of white box switches enhanced with P4 constructs to handle input flow and ML libraries to run ML models. This strategy allows the use of ML techniques on the data plane to provide more elaborated solutions that operate close to the input flow, reducing the impact on the SDN controller. The proposed DataPlane-ML was evaluated using the KNN, SVM and RF algorithms to detect DDoS attacks on real network traces. The experimental results show that DataPlane-ML is ≈23% faster than statistical-based solutions while providing better accuracy and similar CPU usage.

Internet always remains the target for the cyberattacks, and attackers are getting equipped with more potent tools due to the advancement of technology to preach the security of the Internet. Industries and organizations are sponsoring many projects to avoid these kinds of problems. As a result, SDN (Software Defined Network) architecture is becoming an acceptable alternative for the traditional IP based networks which seems a better approach to defend the Internet. However, SDN is also vulnerable to many new threats because of its architectural concept. SDN might be a primary target for DoS (Denial of Service) and DDoS (Distributed Denial of Service) attacks due to centralized control and linking of data plane and control plane. In this paper, the we propose a novel technique for detection of DDoS attacks using information theory metric. We compared our approach with widely used Intrusion Detection Systems (IDSs) based on Shannon entropy and Renyi entropy, and proved that our proposed methodology has more power to detect malicious flows in SDN based networks. We have used precision, detection rate and FPR (False Positive Rate) as performance parameters for comparison, and validated the methodology using a topology implemented in Mininet network emulator.

Attack-aware Security Function Management

Operational, organizational and business challenges for network operators in the context of SDN and NFV

As a promising technique for the design of 5G wireless networks, software-defined networks (SDNs) have been proposed. However, SDNs are vulnerable to most of the attacks that traditional networks are vulnerable to. Various techniques have been developed and designed to help in the detection as well as the prevention of various attacks. An intrusion detection system (IDS) is one of the common techniques used to detect malicious activity in a network. Intrusion detection systems have strengths and weaknesses when it comes to detecting intrusions. It becomes a challenging task for IDS to process any mixture of traffic that results in packet drop and delay. In this study, we scrutinized two open-source IDS, including Snort IDS and Zeek IDS, to assess the IDS performance in terms of various parameters such as detection rate, dropping rate, and latency. The method of detection was one of the main differences between Snort and Zeek. Zeek IDS uses an anomaly-based detection method as opposed to Snort IDS, which uses a signature-based detection method. Differences between them had an impact on the way network traffic was handled. Such a thought analysis is expected to be of great value in selection and further enhancement of IDS in SDN.

Intrusion detection system (IDS) and deep packet inspection (DPI) are widely used to detect network attacks and anomalies, thereby enhancing cyber-security. Conventional traffic analyzers such as IDS have fixed locations and a limited capacity to perform DPI on large volumes of network traffic. Nowadays, software-defined networking (SDN) technology, which provides flexibility, elasticity, and programmability by decoupling the network control and data planes, makes it possible to capture entire or a certain portion of data traffic flows on SDN-capable switches and steer the captured network traffic to one of the traffic analyzers on the network. Therefore, how to sample network traffic and where to steer the sampled traffic among multiple traffic analyzers are critical problems facing cyber-security. Since there is a possibility that potentially useful information will be lost in not-captured traffic, deciding the sampling points and sampling rates of network traffic remains important. Additionally, after determining the sampling points and rates, sampled traffic must be sent to one of the multiple traffic analyzers for traffic inspection, which may incur additional network delivery overheads. We propose a less-intrusive traffic sampling mechanism for multiple traffic analyzers on an SDN-capable network using a deep deterministic policy gradient (DDPG), which is a representative deep reinforcement learning (DRL) algorithm for continuous action control. The proposed system learns sampling resource allocation policy under the uncertainty of flow distribution according to sampled traffic inspection results obtained from multiple traffic analyzers. Through extensive simulations and the SDN-based testbed experiments, we demonstrate that the proposed approach has a high probability of capturing malicious flows while maintaining a balanced load of multiple traffic analyzers and reducing flow monitoring overheads.

Software Defined Networking (SDN) is a recently proposed networking pattern that facilitates a centralized system of computer networks where a controller maintains the management of a global view of the network. One of the characteristics of SDNs is that by decoupling the control and data plane from each other, the controllability and manageability of a network is improved. In this arrangement, the connections between the controller (control plane) and the switches (data plane) are established by either an in-band or an out-of-band control mechanism. Despite all the advantages of SDNs, new challenges arise regarding the connection availability between the data and control planes. A disconnection between the two planes could result in performance degradation. To achieve reliable control traffic between data and control planes, in this work, we design and implement an in-band control protection approach that finds a set of ideal paths for control channel, where as much control traffic as possible can be protected by the proposed protection mechanism. This design enables switches to locally react to failures without involving the controller. Through simulation experiments, we show that our proposed approach significantly improves the control reliability of an in-band control network.

Artificial intelligence based load balancing in SDN: A comprehensive survey

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.