Malicious Switches Research Articles

Secure multi-path routing for Internet of Things based on trust evaluation.

In the realm of the Internet of Things (IoT), ensuring the security of communication links and evaluating the safety of nodes within these links remains a significant challenge. The continuous threat of anomalous links, harboring malicious switch nodes, poses risks to data transmission between edge nodes and between edge nodes and cloud data centers. To address this critical issue, we propose a novel trust evaluation based secure multi-path routing (TESM) approach for IoT. Leveraging the software-defined networking (SDN) architecture in the data transmission process between edge nodes, TESM incorporates a controller comprising a security verification module, a multi-path routing module, and an anomaly handling module. The security verification module ensures the ongoing security validation of data packets, deriving trust scores for nodes. Subsequently, the multi-path routing module employs multi-objective reinforcement learning to dynamically generate secure multiple paths based on node trust scores. The anomaly handling module is tasked with handling malicious switch nodes and anomalous paths. Our proposed solution is validated through simulation using the Ryu controller and P4 switches in an SDN environment constructed with Mininet. The results affirm that TESM excels in achieving secure data forwarding, malicious node localization, and the secure selection and updating of transmission paths. Notably, TESM introduces a minimal 12.4% additional forwarding delay and a 5.46% throughput loss compared to traditional networks, establishing itself as a lightweight yet robust IoT security defense solution.

Audit‐based correction mechanism for malicious statistics information of data plane

SummaryIn software‐defined networking (SDN), the controller relies on the information collected from the data plane for route planning, load balancing, and other functions. Statistics information is the most important kind of information among them, so the correctness of statistics information is the key to the proper operation of the network. Most of the current research on data plane focuses on policy consistency, rule redundancy, forwarding anomalies, and so on, and little attention is paid to whether the statistics information uploaded by the switches to the controller is correct. However, incorrect statistics information inevitably leads the controller to make wrong decisions. Therefore, this paper proposes an audit‐based malicious information correction mechanism to address the problem of wrong statistics information uploaded by the switches. This mechanism audits the statistics information and locates malicious switches before uploading the statistics information to the controller. It identifies and corrects the statistics information errors by combining flow path and statistics information. We have performed simulations on Nsfnet, Abilene, and Fat‐Tree, and the results show that our method can correct about 70% of the statistical information errors with less computational cost. To the best of our knowledge, this paper is the first malicious statistics information correction scheme for wildcard rules.

GwPFV: A novel packet forwarding verification mechanism based on gateways in SDN-based storage environment

Aiming at SDN-based storage environment, the integrity and availability of storage service are threatened by many attacks from data plane, such as packet tampering and dropping. While existing packet forwarding verification methods to deal with the sophisticated attacks are extremely limited due to the assumption that all or part of the switches are trusted. In this paper, for the untrusted data plane, a transparent gateway-based packet forwarding verification mechanism, named GwPFV, was designed to mitigate and trace back the attacks, specially utilizing the characteristics of TCP protocol to realize a packet obfuscation method to proactively defend attacks, a fast event-counting method to find attacks, and a path switching method involved with SDN controller to locate malicious switches. Finally, both the effectiveness and security of GwPFV are analyzed in depth. The experiments performed in an SDN-based prototype storage system reveal that it can achieve the security goal with relative low performance overhead.

ML-Based Delay Attack Detection and Isolation for Fault-Tolerant Software-Defined Industrial Networks.

Traditional security mechanisms find difficulties in dealing with intelligent assaults in cyber-physical systems (CPSs) despite modern information and communication technologies. Furthermore, resource consumption in software-defined networks (SDNs) in industrial organizations is usually on a larger scale, and the present routing algorithms fail to address this issue. In this paper, we present a real-time delay attack detection and isolation scheme for fault-tolerant software-defined industrial networks. The primary goal of the delay attack is to lower the resilience of our previously proposed scheme, SDN-resilience manager (SDN-RM). The attacker compromises the OpenFlow switch and launches an attack by delaying the link layer discovery protocol (LLDP) packets. As a result, the performance of SDN-RM is degraded and the success rate decreases significantly. In this work, we developed a machine learning (ML)-based attack detection and isolation mechanism, which extends our previous work, SDN-RM. Predicting and labeling malicious switches in an SDN-enabled network is a challenge that can be successfully addressed by integrating ML with network resilience solutions. Therefore, we propose a delay-based attack detection and isolation scheme (DA-DIS), which avoids malicious switches from entering the routes by combining an ML mechanism along with a route-handoff mechanism. DA-DIS increases network resilience by increasing success rate and network throughput.

SDN Framework for Mitigating Time-Based Delay Attack

Due to recent cyberattacks on the Cyber-Physical Systems, the traditional security schemes face difficulties in dealing with such attacks as the attackers nowadays have adopted many intelligent mechanisms involving advanced information and communication technologies to launch attacks. This recent type of attack provides a significant impact on the resiliency of the software-defined networks. In this paper, we present a real-time delay attack on fault-resilient software-defined networks. The main objective of the time delay attack is to reduce the resiliency in the SDN-RM by adding a delay in the LLDP packets in the OpenFlow Switch. This addition of delay causes degradation in the network performance resulting in a low success rate in the SDN-RM mechanisms. In this paper, we present a machine learning-based detection system for detecting the attacks. The integration of machine learning techniques with network resilience solutions can effectively address the issue of predicting and classifying the LLDP packets that are delayed at a particular switch. Another issue is the detection of the malicious switch at the controller side which results in the improvement of the resiliency in SDN-RM. We propose a machine learning solution to detect the anomalies that are present in the topology and can be detected at the controller side. We use machine learning models such as k-nearest neighbors, support vector machines (SVM), Random Forest, and decision trees to detect the poisonous switches. The delay-based time attack detection system (DTA-DS) helps the controller to take a reactive decision to improve resilience by detecting poisonous network switches. With the help of the preventive approach, we achieve high-fault resiliency in fault resilient-based software-defined networks.

Modeling of Random Selfish Behavior Attack Using Single-Sided Laplacian Distribution and Performance Evaluation for High Security Communications in Mobile Ad-hoc Networks

Background: The performance of Mobile Ad-hoc Networks gets severely degraded due to various attacks including the Selfish Behaviour attack. The detection of malicious nodes and avoidance of such nodes for data forwarding is important to enhance the MANET’s performance. Methods: A probabilistic model based on Single-Sided Laplacian distribution for the random ON/OFF switching time of this attack is proposed. The model is used to make appropriate decisions regarding the assignment of trust levels to suspicious nodes. The proposed protocol, based on this trust along with Confidence values of nodes, referred to as OLSRT-C protocol is used to select the optimum path for data forwarding. Simulations are carried out using Network Simulator NS-2.35. Results: The random behavior of the Selfish Behaviour attack is analyzed by considering all the possible random parameters. The random deployment of mobile nodes, number of malicious nodes, number of times the malicious nodes switch and timing instances at which these nodes change their states are considered. From the results, it is observed that the OLSRT-C protocol gives stable performance for Packet Delivery Ratio and Routing Overheads whereas, for OLSR protocol, the Packet Delivery Ratio gradually reduces and Routing Overheads increase, for the percentage of malicious nodes increases from 10% to 50%. For OLSRT-C protocol, Average Energy Consumption per node increases marginally compared to the OLSR protocol. Conclusion: The proposed OLSRT-C protocol successfully mitigates the randomized Selfish Behaviour attack with a marginal increase in the Average Energy Consumption per node. The Protocol Efficacy for OLSRT-C protocol is much higher compared to the OLSR protocol.

Multipath resilient routing for endogenous secure software defined networks

SDN improves the flexibility and programmability of the network. However, malicious attacks caused by potential vulnerabilities and backdoors can easily lead to data and rule tampering in the network. To address this problem, this paper proposes an endogenous secure SDN network framework based on multipath resilient routing (MRR). MRR includes multipath comparing forwarding, multipath weighted forwarding, and multipath random forwarding. The framework ensures the correctness of flow rules and data content by dynamically comparing the consistency of multi-heterogeneous path data within a certain period, and multipath can also achieve load balance by weighted forwarding. In the MRR framework, we also present an intermediate information feedback mechanism based on encryption authentication and give a mathematical model to evaluate it. This mechanism can accurately identify and dynamically repair malicious switches. Simulation evaluation and prototype system test show that this framework can achieve high accuracy of flow transmission and high availability of system. At the same time, multipath comparing forwarding will bring some performance costs such as delay, bandwidth, and jitter at initial and attacking time. However, when the appropriate forwarding mode and reasonable period T are selected, the proportion of delay introduced by comparing and ruling can be less than 10%, and the average bandwidth of mixed forwarding is almost the same as traditional multipaths', such as we can guarantee 25% multipath comparing forwarding when the bandwidth requirement is 250 M in prototype system.

Security Enhancement in Software Defined Networking (SDN): A Threat Model

Software Defined Networking (SDN) has emerged as a technology which can replace the prevalent vendor based proprietary CLI networking devices. SDN has introduced applications based network control and provided various opportunities and challenges for research and innovation in these networks. Despite many advantages and opportunities in SDN, security is a matter of concern for developers who want to invest in SDN. In this paper we are analyzing the SDN security issues with their countermeasures. We have generalized four use cases threat model that should cover security requirements of SDN. These use cases are: (I) protect controllers from applications, (II) inter-controller protection, (III) protecting data plane or switches from controller, (IV) protecting controllers from malicious switches. We found that these SDN components are inter-related if one is secure another one is already secure. We also compared the SDN and traditional network security in terms of these four use cases and provide the insights for protection mechanism and security enhancements. A framework for the development of a SDN security application has been presented based on ryu controller. We believe that our threat model will help various researchers and developers to understand current security requirements and provide a ready reference to tackle vulnerabilities and threats in this area. Finally, we identify some open research problems and future research directions with a proposed security architecture.

Network-Wide Forwarding Anomaly Detection and Localization in Software Defined Networks

A crucial requirement for Software Defined Network (SDN) is that data plane forwarding behaviors should always agree with control plane policies. Such requirement cannot be met when there are <i>forwarding anomalies</i>, where packets deviate from the paths specified by the controller. Most anomaly detection methods for SDN install dedicated rules to collect statistics of each flow, and check whether the statistics conform to the &#x201C;flow conservation principle&#x201D;. We find these methods have a limited detection scope: they look at one flow each time, thus can only check a small number of flows simultaneously. In addition, dedicated rules for statistics collection can impose a large overhead on flow tables of SDN switches. To this end, this paper presents FOCES, a network-wide forwarding anomaly detection and localization method in SDN. Different from previous methods, FOCES applies a new kind of flow conservation principle at network wide, and can check forwarding behaviors of <i>all</i> flows in the network simultaneously, without installing any dedicated rules. Finally, FOCES applies a voting-based method to localize malicious switches when anomalies are detected. Experiments with four network topologies show that FOCES can achieve a detection precision higher than 90&#x0025;, when the packet loss rate is no larger than 10&#x0025;, and a localization accuracy of around 80&#x0025; when the packet loss rate is no larger than 5&#x0025;.

Anomaly detection and trust authority in artificial intelligence and cloud computing

The rapid development of smart Internet of Things (IoT) and its multimedia applications with conventional cloud and edge computing platforms are driving a new trend that shifts the functions of centralized networks. These centralized cloud and edge computing networks are encountering various new routing and security challenges. These networks are vulnerable due to different malicious activities and security attacks. The malicious activities lead to link failure and wrong forwarding decisions and or divert the paths. To detect the malicious activities in these networks, we need an efficient detection system for malicious switches in Software Defined Networks (SDN) data plan and leads to data traffic diversion and degrades the network performance. Another aspect is the trust of edge devices and always need to trustworthy devices to forward the IoT devices data to SDN networks. In this paper, we proposed a Software-Defined Network-based Anomaly Detection System (SDN-ADS) for edge computing-based system architecture for IoT networks. Afterwards, we proposed an anomaly detection system to detect the device's behaviour for SDN and edge computing networks. Also, we proposed a Trusted Authority for Edge Computing (TA-Edge) to ensure the trust of edge devices for data forwarding. The edge device is acting as a certificate authority for the specified trusted domain. To overcome the edge devices overhead, in this proposed TA-Edge model, the edge node, only one time, verifies the certificate and when the trust is established, all communication can be done through local certificates. The simulation results show the better performance of proposed systems in terms of different performance parameters.

Traffic-based Malicious Switch Detection in SDN

In Software Defined Networking (SDN) architecture, the control plane is separated from the data plane. On one hand, OpenFlow switches can only store and forward packets, which leaves all decisions to be made by the controller. On the other hand, the controller has a global view over the SDN. But if any switch is captured by an adversary, it may mislead the controller to make inaccurate decisions which may have terrible influences on the overall networks. In this paper, we elaborate on these problems and propose methods to detect malicious OpenFlow switches. We set a threshold value of the traffic-flows across an OpenFlow switch. If the switch’s current traffic-flows exceed the threshold value, the controller has reasons to believe that this switch is suspicious and may monitor it intensively. Another scheme is to add a third-party server to accept users’ report to warn the controller. In SDN, the controller cannot communicate with users directly, and sometimes users need to feed back their experience to the controller to help improve the SDN. In this case, it is necessary to set a third-party server in SDN to act as a middle role. These two schemes help to detect malicious switches. The controller can analyze the flow table of the suspicious switch and identify whether it is really malicious before isolating it.