Security-focused Networks of the Future

Introduction: Distributed denial-of-service (DDoS) has become a common attack type in cyber security. Apart from the conventional DDoS attacks, software-defined networks also face some other typical DDoS attacks, such as flow-table attack or controller attack. One of the most recent solutions to detect a DDoS attack is using machine learning algorithms to classify the traffic. Purpose: Analysis of applying machine learning algorithms in order to prevent DDoS attacks in software-defined network. Results: A comparison of six algorithms (random forest, decision tree, naive Bayes, support vector machine, multilayer perceptron, k-nearest neighbors) with accuracy and process time as the criteria has shown that a decision tree and naïve Bayes are the most suitable algorithms for DDoS attack detection. As compared to other algorithms, they have higher accuracy, faster processing time and lower resource consumption. The main features that identify malicious traffic compared to normal one are the number of bytes in a flow, time flow, Ethernet source address, and Ethernet destination address. A flow-table attack can be detected easier than a bandwidth attack, as all the six algorithms can predict this type with a high accuracy. Practical relevance: Important features which play a supporting role in correct data classification facilitate the development of a DDoS protection system with a smaller dataset, focusing only on the necessary data. The algorithms more suitable for machine learning can help us to detect DDoS attacks in software-defined networks more accurately.

Various real-time, latency-sensitive, and high-speed mobile applications are evolving as 5G applications. These applications are realized using Multi-access Edge Computing (MEC) and Network Function Virtualization (NFV) technologies in the 5G system. MEC platform, MEC service, and MEC application are the main components of an MEC Framework. NFV Orchestrator, Virtualized Infrastructure Manager (VIM), and virtualization technologies such as Virtual Machines (VM) and Containers are the main pillars of the NFV technology. In this paper, we study the impact of the virtualization technologies in the deployment of the MEC framework and its components while. We also study the impact of virtualization technologies on NFV and MEC KPIs such as onboarding time, instantiation time, MEC service and application response times. The experiments and its analysis show that containers perform better than VM to instantiate/terminate MEC components in the NFV framework. The observed MEC service KPIs show that the edge application’s performance will be improved to meet the QoE of the applications irrespective of the virtualization technology used. These results can be used as a reference while deploying the MEC components based on their granular functionalities.

Background & Objective: Detecting and mitigating Distributed Denial of Service (DDoS) attacks is a serious problem. In addition, new features and network deployments such as Software- Defined Networking (SDN) may open the door for new threats that did not previously exist. : Recent publications and patent are reviewed to find new techniques developed for integrating different mechanisms to secure networks against DDoS. Methods: This work presents a simple model for integrating different mechanisms to secure both SDN and legacy network in a hybrid cloud environment, it is called FocusON. It aims at mitigating DDoS attacks of a victim network. In addition, separating network monitoring from its control aims at mitigating DDoS attacks of a victim network. Traffic pattern analysis is apart from attack detection mechanism that gives a conceptual representation of a specific kind of DDoS attacks. DDoS detection is a completely automated process. Once called, for the reaction, the active response will be taken against the real IP source of the attacker. : The communication time overhead was tested in order to evaluate the remote server response time in case of deploying our proposed model mechanisms and without our proposed model. : Here we introduce a response mechanism that consists of an analysis of event logs, traffic patterns, and IP traceback. The proposed model categorizes the underlying network according to the location into a victim network and the source of attack (public cloud). Results & Conclusion:: The proposed model implemented in a hybrid cloud environment using the network of SDN and legacy network. The experimental setup was built using our network lab connected to the Amazon public cloud.

This study focuses on the security of 5G mobile network major technology called Multi-Access Edge Computing (MEC) and its susceptibility to distributed denial of service (DDoS) attacks. The goal of the research is to address the effects of DDoS attacks and implement effective mitigation techniques. Several supervised Machine Learning (ML) techniques, which include Random Forest (RF), Decision Tree, Naïve Bayes, K-Nearest Neighbour, Logistics Regression, and Blending/Stack Model, are evaluated using multiple performance metrics such as accuracy, detection/recall, F1-Measure, Matthew’s correlation coefficient, Receiver Operating Characteristic, and Area Under Receiver Operating Characteristic. According to literature, ML algorithms achieve the best performance in mitigating DDoS attacks, therefore, they can be optimized to enhance their effectiveness. The research provides an overview of the existing mitigation schemes in the MEC and proposes a DDoS mitigation scheme. The findings show that hybrid models outperformed traditional ML models. Among the mitigation techniques evaluated, RF proved to be the most effective in mitigating DDoS attacks in MEC.

With the growth of network applications such as 5G and artificial intelligence, network security techniques, i.e., the techniques that detect various attacks (e.g., well-known denial-of service (DDoS) attacks) and prevent production networks (e.g., data center networks) from being attacked, become increasingly essential for network management and have gained great popularity in the networking community. Generally, these techniques are built on proprietary hardware appliances, i.e., middleboxes, or the paradigm that combines both software-defined networking (SDN) and network function virtualization (NFV) to implement security functions. However, the techniques built on middleboxes are proven to be hard-to-manage, costly, and inflexible, thereby making them an out-of-date choice in network security. For the techniques built on SDN and NFV, they virtualize and softwarize security functions on commodity servers, leading to non-trivial performance degradation. Fortunately, the recent emergence of programmable switches brings new opportunities of empowering network security techniques with the characteristics of easy-tomanage, low cost, high flexibility, and Tbps-level performance. In this survey, we focus on this promising trend in network security. More precisely, this survey first presents the preliminaries of programmable switches, which are the primary driver of next-generation network security techniques. Next, we comprehensively review existing techniques built on programmable switches, classify these techniques, and discuss their background, motivation, design, implementation, and limitations case-by-case. Finally, we summarize open issues and future research directions in this promising research topic of network security.

The discovery process of OPC Unified Architecture (OPC-UA) is well defined but lacks flexibility when implemented in large networks. While the standard provides concepts for local and global discovery services, the core assumption is that all clients and servers are aware of the discovery server(s) in the network. This dependency is a barrier for Plug-and-Play installations and is overcome by self announces via the multicast Domain Name System (mDNS), however, this scales badly with an increasing number of network nodes and deployed servers. We propose a discovery approach based on Software-Defined Networking (SDN) and Network Function Virtualization (NFV), that installs a plug-and-play mechanism for global OPC-UA discovery in modern virtualized networks.

Software-defined networking (SDN) has revolutionized traditional network management by decoupling the control and data planes, offering enhanced flexibility, programmability, and efficiency. However, this centralized architecture makes SDN vulnerable to Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, which severely impact network performance and reliability. Through overloading critical network components, especially the SDN controller, these attacks reduce network availability and result in significant service interruptions. This review offers a thorough summary of mitigation strategies designed to combat DoS and DDoS attacks in SDN systems. These attacks overwhelm network resources, disrupt services, and compromise the availability of critical components such as the SDN controller. Additionally, it explores the key challenges facing SDN in defending against DoS and DDoS attacks, such as the need for real-time detection, the impact of network scale, and the complexities of adaptive responses. As such, addressing DoS and DDoS attacks has become a critical research area for ensuring the security and robustness of SDN-based networks. It categorizes existing approaches based on detection methods, response strategies, and deployment models, providing a detailed analysis of their strengths and limitations. Furthermore, it discusses problems such as scalability, concurrent detection, and adaptability that hinder the effectiveness of current solutions. Emerging trends, including integrating artificial intelligence, blockchain, and collaborative frameworks, are highlighted as promising directions for future research. This aim is to give researchers, network admins, and cyber-security practitioners an insight into the state of the art as well as a basis on which to build for future SDN security advancements. This survey aims to serve as a comprehensive resource for researchers and practitioners seeking to imporve SDN's resilience against DoS and DDoS attacks.

Software Defined Network (SDN) is a new network construction. But due to its construction, SDN is vulnerable to be attacked by Distributed Denial of Service (DDoS) attack. So it is important to detect DDoS attack in SDN network. This paper presents a DDoS detection scheme based on k-means algorithm in SDN environment. The establishment of this scheme is based on the two hypotheses that the daily network works normally most of the time, and there is a significant difference between the data characteristics of normal situation and abnormal situation. At the same time, these two hypotheses are also true to the daily network condition. After demonstrating the validity of k-means clustering algorithm, the paper proposes 5 flow table features that can be used to detect DDoS attacks. Finally, the DDoS detection scheme was tested by simulation experiment. The test results showed that the method proposed by the author could effectively detect DDoS, with an average success rate of 97.78%.

Software Defined Network (SDN) is a new architecture designed to make the network infrastructure more flexible and easier to manage. It allows network administrators to configure network parameters as well as integrating new functions using programming languages easily. Thanks to the centralized control paradigm, it is easier to collect information of the entire network, which facilitates the implementation of machine learning algorithms to detect anomaly traffic as well as network attacks. Recently, with the development of machine learning and artificial intelligence, several methods have been applied to detect and mitigate Distributed Denial of Service (DDoS) attacks. However, all of activities from monitoring data, detecting and mitigating the attack consume time and resources. To reduce unnecessary redundancy, in this paper, we divide attack detection into two phases, which are anomaly detection phase with lightweight machine learning algorithm and attack detection phase when anomaly behaviors have been detected. This reduces the in-depth analysis of normal traffic and helps to improve the use of computing resources and data transmission efficiency of the network. By setting up a testbed, we have successfully run this model as well as evaluated the accuracy of the model. The results show that our model can detect attacks quickly and accurately.

DDoS (Distributed Denial of Service) attacks consist of a large number of compromised computer systems that launch joint attacks at a targeted victim, such as a server, website, or other network equipment, simultaneously. DDoS has become a widespread and severe threat to the integrity of computer networks. DDoS can lead to system paralysis, making it difficult to troubleshoot. As a key building block in the development of an integrated defense system, it is essential to detect DDoS attacks as early as possible. With the popularization of artificial intelligence, more and more researchers apply machine learning (ML) and deep learning (DL) to the detection of DDoS attacks and have achieved satisfactory accomplishments. The complexity and sophistication of DDoS attacks have kept increasing and evolving since the first DDoS attack was reported in 1996. Regarding the headways in this problem, a new type of DDoS attack, named adversarial DDoS attack, is investigated in this study. The generating adversarial DDoS traffic is carried out using a symmetric Generative Adversarial Networks (GAN) architecture called Cycle-GAN to demonstrate the severe impact of adversarial DDoS attacks. Experiment results reveal that the synthesized traffic can easily penetrate ML-based detection systems, including Random Forest, KNN (k-Nearest Neighbor), SVM (Support Vector Machine), and Naïve Bayes. These alarming results intimate the urgent need for countermeasures against adversary DDoS attacks.

The roll-out of 5G technology will nurture the realization of broadband, ultra-reliable, and zero latency services. Network Function Virtualization (NFV) and Multi-Access Edge Computing (MEC) are among the key enablers for 5G. The synergy between NFV and MEC allows migration of Virtual Network Functions (VNF) from cloud to the edge of the network thereby adding agility to the softwarized 5G networks. The overall orchestration of VNF includes, but is not limited to, processing VNF requests, selecting appropriate VNF, migrating VNF from cloud to MEC, instantiating migrated VNF at MEC, settling payment according to a VNF’s usage, maintaining VNF’s reputation, etc. The orchestration is not foolproof and raises doubts about its trustworthiness. To address all the existing issues in a unified manner, we leverage Blockchain technology as yet another enabling technology for MEC-enabled 5G. Thus, we propose a Blockchain-enhanced architecture for secure VNF orchestration such that issues like authenticity, integrity, confidentiality, reputation, payment transfer, and many more are resolved. To furnish a Proof-of-Concept (PoC), we develop a prototypical DApp (Decentralized Application) using Ethereum Blockchain and Suricata as an exemplar VNF. Further, we discuss the strong resiliency of the proposed architecture against numerous well-known attacks.

5G ecosystems will benefit significantly from Multi-access Edge Computing (MEC) and Network Function Virtualization (NFV). While NFV allows for dynamical deployment of virtualized network functions, MEC allows applications to be deployed close to mobile users, thus reducing latency. When used together, NFV and MEC bring flexibility and enhanced performance to meet the user’s demand. However, to increase service availability and maximize the convenience of MEC users, an MEC framework has to interface with multiple NFV orchestrators to utilize running network functions in an efficient manner. We introduce in this demonstration APMEC, a framework addressing the above two challenges. Via a combination of an interactive GUI, KPI views and a live-demo setup, we will showcase the advanced features of the framework.

openLEON: An end-to-end emulation platform from the edge data center to the mobile user

Distributed Denial of Service (DDoS) attacks represent a major threat to network security.. In response, this paper examines the potential of countering DDoS attacks through the integration of Software-Defined Networking (SDN). SDN separates the network control logic from the underlying routers and switches, which facilitates the communication between software components. Moreover, the synergy of SDN with Machine Learning (ML) and Deep Learning (DL) technologies provide a promising approach for effective threat mitigation. This systematic review explores the evolving landscape of information security defense frameworks within the context of Internet of Things (IoTs) security. Over the past five years, numerous articles have contributed to the understanding of SDN based DDoS defense architecture. This review encompasses various aspects, including the design of SDN based DDoS frameworks, implementation steps, data analysis methods, DDoS data sources, and application scenarios of defense frameworks. Performance and characteristics of different defense technologies are analyzed, addressing common challenges in the research field. This study provides a valuable reference for researchers to develop efficient and reliable DDoS defense frameworks in SDN mode

The fifth generation (5G) and beyond wireless networks are envisioned to provide an integrated communication and computing platform that will enable multipurpose and intelligent networks driven by a growing demand for both traditional end users and industry verticals. This evolution will be realized by innovations in both core and access capabilities, mainly from virtualization technologies and ultra-dense networks, e.g., software-defined networking (SDN), network slicing, network function virtualization (NFV), multi-access edge computing (MEC), terahertz (THz) communications, etc. However, those technologies require increased complexity of resource management and large configurations of network slices. In this new milieu, with the help of artificial intelligence (AI), network operators will strive to enable AI-empowered network management by automating radio and computing resource management and orchestration processes in a data-driven manner. In this regard, most of the previous AI-empowered network management approaches adopt a traditional centralized training paradigm where diverse training data generated at network functions over distributed base stations associated with MEC servers are transferred to a central training server. On the other hand, to exploit distributed and parallel processing capabilities of distributed network entities in a fast and secure manner, federated learning (FL) has emerged as a distributed AI approach that can enable many AI-empowered network management approaches by allowing for AI training at distributed network entities without the need for data transmission to a centralized server. This article comprehensively surveys the field of FL-empowered mobile network management for 5G and beyond networks from access to the core. Specifically, we begin with an introduction to the state-of-the-art of FL by exploring and analyzing recent advances in FL in general. Then, we provide an extensive survey of AI-empowered network management, including background on 5G network functions, mobile traffic prediction, and core/access network management regarding standardization and research activities. We then present an extensive survey of FL-empowered network management by highlighting how FL is adopted in AI-empowered network management. Important lessons learned from this review of AI and FL-empowered network management are also provided. Finally, we complement this survey by discussing open issues and possible directions for future research in this important emerging area.