Future Technology: Software-Defined Network (SDN) Forensic

Quadri Waseem,Ahmed Saeed Alghamdi,Sultan S Alshamrani,Kashif Nisar,Wan Isni Sofiah Wan Din

doi:10.3390/sym13050767

Quadri Waseem, Ahmed Saeed Alghamdi + Show 3 more

Open Access

https://doi.org/10.3390/sym13050767

Copy DOI

Abstract

The software-defined networking (SDN) paradigm has recently emerged as a trend to build various protocols, develop more reliable networks, enhance the data flow controlling, and provide security in a much simpler and flexible way. SDN helps to ease management and handle asymmetric connectivity across various nodes. It solves the problems of network and cloud security and hence provides the best solution for the safety of data on the network. Therefore, we feel the urge to research more and provide the basics of SDN forensics, mention its advantages in network especially in the cloud, and present its elaborate prospects in context with Network Forensic (NF) and Cloud Forensic (CF). In this research article, we explained in detail the NF and CF with emphasis on Network security (NS) and Cloud Security (CS). The paper also provided the various security approaches and categories. Then, an overview of the software-defined networking (SDN) is mentioned. We also discussed the use of SDN in Network Forensic and Cloud Forensic. Furthermore, to aid the SDN forensic, we presented the advantages, challenges, and issues along with future research directions of SDN in network forensic and cloud forensic, and at last, we thus express and explore the need for security in forensic based on the SDN paradigm in the form of a set of suggested recommendations.

Highlights

Digital forensics [1] includes the depth investigation of attacks and the collection of traces left by the intruders after any suspicious events or malicious code is detected.The traces from the intruders act as evidence to regenerate the attack and enable the computer systems to enhance the security for future threats
The basic forensics steps are divided into five main steps which include (1) Identification phase, where it is identified whether a crime has occurred on not? This method uses the anomalies detected by intrusion detection systems (IDS) and suspicious events for identification purposes
The level of cloud security is a function of the level of confidence in all above-mentioned architectures that can be put in partnership with third parties (CSP) and how far the company has incorporated the cloud framework into its system architecture based on (SLA) [15]

Summary

Introduction

Digital forensics [1] includes the depth investigation of attacks and the collection of traces left by the intruders after any suspicious events or malicious code is detected. SDN provides digital forensics support as it allows the safe preservation of network activity traces to determine the root causes of various issues. Along with storage, it provides general support in the form of centralized control. The rest of this paper is structured as follows: Section 2 of this paper discusses the background of our research (starting from network security to network forensic and cloud security to cloud forensic). SDN, SDN Forensic in context with Network forensic and Cloud Forensic along with its strength, weakness, challenges and future research directions in the current scenario based on the current advances from academia and industry

Conclusion

Network Security