Practical extensions to countermeasure DoS attacks in software defined networking

Software defined networks (SDN) remain a hot research field as it provides controllable networking operations. The SDN controller can be treated as the operating system of the SDN model and it holds the responsibility of performing different networking applications. Despite the benefits of SDN, security remains a challenging problem. At the same time, distributed denial of services (DDoS) is a typical attack on SDN owing to centralized architecture, especially at the control layer of the SDN. This article develops a new Cat Swarm Optimization with Fuzzy Rule Base Classification (CSO-FRBCC) model for cybersecurity in SDN. The presented CSO-FRBCC model intends to effectually categorize the occurrence of DDoS attacks in SDN. To achieve this, the CSO-FRBCC model primarily pre-processes the input data to transform it to a uniform format. Besides, the CSO-FRBCC model employs FRBCC classifier for the recognition and classification of intrusions. Moreover, the parameter optimization of the FRBCC classification model is adjusted by the use of cat swarm optimization (CSO) algorithm which results in improved performance. A comprehensive set of simulations were carried out on benchmark dataset and the results highlighted the enhanced outcomes of the CSO-FRBCC model over the other recent approaches.

Introduction: Distributed denial-of-service (DDoS) has become a common attack type in cyber security. Apart from the conventional DDoS attacks, software-defined networks also face some other typical DDoS attacks, such as flow-table attack or controller attack. One of the most recent solutions to detect a DDoS attack is using machine learning algorithms to classify the traffic. Purpose: Analysis of applying machine learning algorithms in order to prevent DDoS attacks in software-defined network. Results: A comparison of six algorithms (random forest, decision tree, naive Bayes, support vector machine, multilayer perceptron, k-nearest neighbors) with accuracy and process time as the criteria has shown that a decision tree and naïve Bayes are the most suitable algorithms for DDoS attack detection. As compared to other algorithms, they have higher accuracy, faster processing time and lower resource consumption. The main features that identify malicious traffic compared to normal one are the number of bytes in a flow, time flow, Ethernet source address, and Ethernet destination address. A flow-table attack can be detected easier than a bandwidth attack, as all the six algorithms can predict this type with a high accuracy. Practical relevance: Important features which play a supporting role in correct data classification facilitate the development of a DDoS protection system with a smaller dataset, focusing only on the necessary data. The algorithms more suitable for machine learning can help us to detect DDoS attacks in software-defined networks more accurately.

Software Defined Networking (SDN) is disruptive networking technology which adopts a centralised framework to facilitate fine-grained network management. However security in SDN is still in its infancy and there is need for significant work to deal with different attacks in SDN. In this paper we discuss some of the possible attacks on SDN switches and propose techniques for detecting the attacks on switches. We have developed a Switch Security Application (SSA)for SDN Controller which makes use of trusted computing technology and some additional components for detecting attacks on the switches. In particular TPM attestation is used to ensure that switches are in trusted state during boot time before configuring the flow rules on the switches. The additional components are used for storing and validating messages related to the flow rule configuration of the switches. The stored information is used for generating a trusted report on the expected flow rules in the switches and using this information for validating the flow rules that are actually enforced in the switches. If there is any variation to flow rules that are enforced in the switches compared to the expected flow rules by the SSA, then, the switch is considered to be under attack and an alert is raised to the SDN Administrator. The administrator can isolate the switch from network or make use of trusted report for restoring the flow rules in the switches. We will also present a prototype implementation of our technique.

Toward an optimal solution against Denial of Service attacks in Software Defined Networks

DoS/DDoS attacks in Software Defined Networks: Current situation, challenges and future directions

In this paper we discuss distributed denial of service attacks on software defined networks, software defined networking is a network architecture approach that enables the network to be intelligently and centrally controlled using software applications. These days the usage of internet is increased because high availability of internet and low cost devices. At the same time lot of security challenges are faced by network monitors and administrators to tackle the frequent network access by the users. The main idea of SDN is to separate the control plane and the data plane, as a result all the devices in the data plane becomes forwarding devices and all the decision making activities transferred to the centralized system called controller. Openflow is the standardized and most important protocol among many SDN protocols. In this article given the overview of distributed denial of service attacks and prevention mechanisms to these malicious attacks.

The development of Software Defined Networking (SDN) has altered the landscape of computer networking in recent years. Its scalable architecture has become a blueprint for the design of several advanced future networks. To achieve improve and efficient monitoring, control and management capabilities of the network, software defined networks differentiate or decouple the control logic from the data forwarding plane. As a result of this, logical control is solely centralized in the controller. Due to the centralized nature, SDNs are exposed to several vulnerabilities such as Spoofing, Flooding, and primarily Denial of Service (DoS) and Distributed Denial of Service (DDoS) among other attacks. In effect, the performance of SDN degrades based on these attacks. This paper presents a comprehensive review of several DoS and DDoS defense/mitigation strategies and classifies them into distinct classes with regards to the methodologies employed. Furthermore, based on the discussions raised, suggestions have been made to enhance current mitigation strategies accordingly.

Cyber attacks are a major concern for network administrators as the occurrences of such events are continuously increasing on the Internet. Software-defined networks (SDN) enable many management applications, but they may also become targets for attackers. Due to the separation of the data plane and the control plane, the controller appears as a new element in SDN networks, allowing centralized control of the network, becoming a strategic target in carrying out an attack. According to reports generated by security labs, the frequency of the distributed denial of service (DDoS) attacks has seen an increase in recent years, characterizing a major threat to the SDN. However, few research papers address the prevention of DDoS attacks on SDN. Therefore, this work presents a Systematic Mapping of Literature, aiming at identifying, classifying, and thus disseminating current research studies that propose techniques and methods for preventing DDoS attacks in SDN. When answering these questions, it was determined that the SDN controller was vulnerable to possible DDoS attacks. No prevention methods were found in the literature for the first phase of the attack (when attackers try to deceive users and infect the host). Therefore, the security of software-defined networks still needs improvement over DDoS attacks, despite the evident risk of an attack targeting the SDN controller.

USAGE : Uncertain flow graph and spatio-temporal graph convolutional network-based saturation attack detection method

Software-defined networking (SDN) is an innovative network technology. It changed the world of computer networking by providing solutions to many challenges. SDN provides programmability, easy and centralized network management, dynamic configuration, and improved security. Although SDN offers remarkable benefits but it provides centralized network management which is prone to attacks. So, intrusion detection systems (IDS) are essential to detect and prevent security attacks in SDN. Traditional IDS follow a centralized machine learning approach which causes vulnerabilities in IDS. Old-style IDS lack data privacy preservation, and solution for training data unavailability due to privacy. Federated learning (FL) is a distributed machine learning approach which provides a collaborative training approach without data sharing. In FL, training is performed on multiple nodes creating a global model without sharing the data. To address challenges and the limitations of traditional IDS, we proposed a FL based multi class classification IDS for SDN. FL delivers an efficient and scalable solution to address challenges of traditional IDS. The proposed model enhances security of SDN by not requiring the centralization of data. To test the impact and efficiency of proposed model, we used a latest and realistic cybersecurity dataset. We also compared the proposed model with state of art existing multi class classification studies. The results and their comparison with existing studies highlight the potential of proposed model to enhance network security while providing a privacypreserving learning environment for intrusion detection.

Software defined networks (SDN) are a recently developed form for controlling network management by providing centralized control unit called the Controller. This master Controller is a great power point but at the same time it is unfortunately a failure point and a serious loophole if it is targeted and dropped by attacks. One of the most serious types of attacks is the inability to access the Controller, which is known as the distributed denial of service (DDoS) attack. This research shows how DDoS attack can deplete the resources of the Controller and proposes a lightweight mechanism, which works at the Controller and detects a DDoS attack in the early stages. The proposed mechanism can not only detect the attack, but also identify attack paths and initiate a mitigation process to provide some degree of protection to network devices immediately after the attack is detected. The proposed mechanism depends on a hybrid technique that merges between the average flow initiation rate, and the flow specification of the coming traffic to the network.

Detecting flooding DDoS attacks in software defined networks using supervised learning techniques

Distributed Denial of Service (DDoS) attack is one of the most severe threats to the current network security. As a new network architecture, Software-Defined Networking (SDN) draws notable attention from both industry and academia. The characteristics of SDN such as centralized management and flow-based traffic monitoring make it an ideal platform to defend against DDoS attacks. When designing a network intrusion detection system (NIDS) in SDN, how to obtain fine-grained flow information with minimal overhead to the SDN architecture is a problem to be solved. In this paper, we propose TPDD, a two-phase DDoS detection system to detect DDoS attacks in SDN. In the first phase, we utilize the characteristics of SDN to collect coarse-grained flow information from the core switches and locate the potential victim. Then we monitor the edge switches located close to the potential victim to obtain finer-grained traffic information in the second phase. The collection method of each phase fully considers the impact on the bandwidth between the controller and switches. Without modifying the existing flow rules, the collection module can obtain sufficient information about traffic. By using entropy-based and machine learning-based methods, the detection module can effectively detect anomalies and identify whether the potential victim marked in the first phase is the target of attacks. Experimental results show that TPDD can effectively detect DDoS attacks with little overhead.

As a new networking paradigm, Software-Defined Networking (SDN) separates data and control planes to facilitate programmable functions and improve the efficiency of packet delivery. Recent studies have shown that there exist various security threats in SDN. For example, a saturation attack may disturb the normal delivery of packets and even make the SDN system out of service by flooding the data plane, the control plane, or both. The existing research has focused on saturation attacks caused by SYN flooding. This paper presents an anomaly detection method, called SA-Detector, for dealing with a family of saturation attacks through IP spoofing, ICMP flooding, UDP flooding, and other types of TCP flooding, in addition to SYN flooding. SA-Detector builds upon the study of self-similarity characteristics of OpenFlow traffic between the control and data planes. Our work has shown that the normal and abnormal traffic flows through the OpenFlow communication channel have different statistical properties. Specifically, normal OpenFlow traffic has a low self-similarity degree whereas the occurrences of saturation attacks typically imply a higher degree of self-similarity. Therefore, SA-Detector exploits statistical results and self-similarity degrees of OpenFlow traffic, measured by Hurst exponents, for anomaly detection. We have evaluated our approach in both physical and simulation SDN environments with various time intervals, network topologies and applications, Internet protocols, and traffic generation tools. For the physical SDN environment, the average accuracy of detection is 97.68% and the average precision is 94.67%. For the simulation environment, the average accuracy is 96.54% and the average precision is 92.06%. In addition, we have compared SA-Detector with the existing saturation attack detection methods in terms of the aforementioned performance metrics and controller's CPU utilization. The experiment results indicate that SA-Detector is effective for the detection of saturation attacks in SDN.

Software-defined networking (SDN) is a new networking architecture with a centralized control mechanism. SDN has proven to be successful in improving not only the network performance, but also security. However, centralized control in the SDN architecture is associated with new security vulnerabilities. In particular, user-datagram-protocol (UDP) flooding attacks can be easily launched and cause serious packet-transmission delays, controller-performance loss, and even network shutdown. In response to applications in the Internet of Things (IoT) field, this study considers UDP flooding attacks in SDN and proposes two lightweight countermeasures. The first method sometimes sacrifices address-resolution-protocol (ARP) requests to achieve a high level of security. In the second method, although packets must sometimes be sacrificed when undergoing an attack before starting to defend, the detection of the network state can prevent normal packets from being sacrificed. When blocking a network attack, attacks from the affected port are directly blocked without affecting normal ports. The performance and security of the proposed methods were confirmed by means of extensive experiments. Compared with the situation where no defense is implemented, or similar defense methods are implemented, after simulating a UDP flooding attack, our proposed method performed better in terms of the available bandwidth, central-processing-unit (CPU) consumption, and network delay time.