Abstract
With the rapid development of data-driven and bandwidth-intensive applications in the Software Defined Networking (SDN) northbound interface, big data stream is dynamically generated with high growth rates in SDN-based data center networks. However, a significant issue faced in big data stream communication is how to verify its authenticity in an untrusted environment. The big data stream traffic has the characteristics of security sensitivity, data size randomness, and latency sensitivity, putting high strain on the SDN-based communication system during larger spoofing events in it. In addition, the SDN controller may be overloaded under big data stream verification conditions on account of the fast increase of bandwidth-intensive applications and quick response requirements. To solve these problems, we propose a two-phase adaptive authenticated model (TAAM) by introducing source address validation implementation- (SAVI-) based IP source address verification. The model realizes real-time data stream address validation and dynamically reduces the redundant verification process. A traffic adaptive SAVI that utilizes a robust localization method followed by the Sequential Probability Ratio Test (SPRT) has been proposed to ensure differentiated executions of the big data stream packets forwarding and the spoofing packets discarding. The TAAM model could filter out the unmatched packets with better packet forwarding efficiency and fundamental security characteristics. The experimental results demonstrate that spoofing attacks under big data streams can be directly mitigated by it. Compared with the latest methods, TAAM can achieve desirable network performance in terms of transmission quality, security guarantee, and response time. It drops 97% of the spoofing attack packets while consuming only 9% of the controller CPU utilization on average.
Highlights
With the rapid development of data-driven and bandwidth-intensive applications in the Software Defined Networking (SDN) northbound interface, big data stream is dynamically generated with high growth rates in SDN-based data center networks
We propose a two-phase adaptive authenticated model (TAAM) by introducing source address validation implementation- (SAVI-) based IP source address verification. e model realizes real-time data stream address validation and dynamically reduces the redundant verification process
A traffic adaptive SAVI that utilizes a robust localization method followed by the Sequential Probability Ratio Test (SPRT) has been proposed to ensure differentiated executions of the big data stream packets forwarding and the spoofing packets discarding. e TAAM model could filter out the unmatched packets with better packet forwarding efficiency and fundamental security characteristics. e experimental results demonstrate that spoofing attacks under big data streams can be directly mitigated by it
Summary
TAAM is a controller-based model for big data stream SAVI management, which provided an architectural design of a security mechanism. We implemented a simulated SDN-based data center network to prove TAAM’s feasibility and effectiveness. We use Open vSwitch and Floodlight as the core switches in data center networks and SDN controller, respectively. Mininet 2.3.07 is applied for the topology and links simulation for SDN-based data center networks, which supports OpenFlow v1.3 standard. To evaluate the performance of SPRT-based source address validation algorithm, we compared it with six other classic machine learning algorithms including XGBoost in D-SAVI [23]. SPRT-based big data stream classification algorithm to realize differentiated verifications, with no additional machine learning model training time, does not take up real-time controller memory space. Aiming at choosing the upper and lower thresholds, respectively, as shown in Figure 11, we further tested the
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.