Software Defined Networking Security Research Articles

Recent Advancements in Intrusion Detection in Software Defined Network Security

In recent years, Software Defined Networking (SDN) has enabled total control over the network's data flow. SDN acts as a centralised point of administration for data and traffic management. Due to the fact that SDN is an open source software, it is more vulnerable to security concerns. Security policies must also be adhered to, since this would expose the controller to the greatest attacks. DDOS and DOS assaults are more prevalent in SDN controllers. DDOS is a damaging assault that disrupts the usual flow of communication and initiates an overflow of flooded packets, thereby shutting down the system. Machine Learning approaches assist in identifying the network's hidden and unexpected patterns, hence aiding in the analysis of the network's flow. All classified and unclassified approaches can assist in detecting hostile flows depending on specific factors such as packet flow, time length, precision, and accuracy rate. To identify DDOS assaults, researchers employed Bayesian Networks, Wavelets, Support Vector Machines, and KNN. According to the review, KNN offers superior results due to its increased accuracy and reduced false positive rate for detection. We explore the various strategies used in DDoS detection and examine new improvements in intrusion detection in software defined networks in this article.

Ensemble Deep Learning Models for Mitigating DDoS Attack in Software-Defined Network

Software-defined network (SDN) is an enabling technology that meets the demand of dynamic, adaptable, and manageable networking architecture for the future. In contrast to the traditional networks that are based on a distributed control plane, the control plane of SDN is based on a centralized architecture. As a result, SDNs are susceptible to critical cyber attacks that exploit the single point of failure. A distributed denial of service (DDoS) attack is one of the most crucial and risky attacks, targeting the SDN controller and disrupting its services. Several researchers have proposed signature-based DDoS mitigation and detection techniques that rely on manually configuring the policies. As the massive traffic from heterogeneous networks increases, conventional solutions are ineffective due to the lack of automation and human interference. This necessitates producing a detection solution, more effective than traditional ones, to ensure SDN security, resiliency, and availability. This paper addresses this problem by proposing a deep learning (DL)-based ensemble solution for efficient DDoS attack detection in SDN. Four hybrid models are presented by adopting three ensemble techniques and different DL architectures, namely convolutional neural network, long short-term memory, and gated recurrent unit, to improve the SDN traffic classification. The experimentation was conducted on the benchmark flow-based dataset CICIDS2017. High detection accuracy (99.77%) with a small number of flow-based features was achieved by our ensemble model, as our experimental results will demonstrate. The proposed solution was evaluated by several standard assessment matrices and by comparing against other state-of-the-art algorithms from the network security literature.

A Review on Distributed Denial of Service Detection in Software Defined Network

Network security has become considerably essential because of the expansion of the internet of things (IoT) devices. One of the greatest hazards of today's networks is distributed denial of service (DDoS) attacks, which could destroy critical network services. Recently numerous IoT devices are unsuspectingly attacked by DDoS. To securely manage IoT equipment, researchers have introduced software-defined networks (SDN). This paper aims to analyze and discuss machine learning-based systems for SDN security networks from DDoS attacks. The results have indicated that the algorithms for machine learning can be used to detect DDoS attacks in SDN efficiently. From machine learning approaches, it can be explored that the best way to detect DDoS attacks is based on utilizing deep learning procedures. Moreover, analyze the methods that combine it with other machine learning techniques. The most benefits that can be achieved from using deep learning methods are the ability to do both feature extraction along with data classification; the ability to extract specific information from partial data. Nevertheless, it is appropriate to recognize the low-rate attack, and it can get more computation resources than other machine learning where it can use a graphics processing unit (GPU) rather than a central processing unit (CPU) for carrying out the matrix operations, making the processes computationally effective and fast.

ASSURING THE SDN SECURITY BY MODELLING AND COMPARING SDN PROPOSED TOPOLOGIES USING PETRI NETS

The soaring number of applications for autonomous systems in different aspects like air, sea, and space is creating the need for new methodologies and architectures’ technologies to consolidate the verification of system-level and system-of-systems level. The implementation of cybersecurity standards and software is critical to supporting infrastructure. This article discusses some security issues regarding autonomous systems' computer networks. It proposes the usage of Software-Defined Networks (SDN) technologies as a solution, after providing better security in SDN environment through the usage of the HYDRA framework and the usage of multiple controllers in specific topologies to ensure the security of SDN in precise and to ensure the security of the autonomous systems' computer networks in general as well. We propose a framework that contains 3 different types of controllers' topologies and each topology can use 4 algorithms, HYDRA, VPN, Double RSA, and least but not last comes blockchain technology which is the core of our security.

Scalable and secure SDN based ethernet architecture by suppressing broadcast traffic

Ethernet is one of the widespread protocols residing in the second layer of the seven-layers Open Systems Interconnection (OSI) model. Ethernet offers various advantages which enable its widespread use in all types of network topology and becomes an essential part of computer and network architecture. Despite its features, Ethernet suffers from scalability issues where the increasing number of hosts in a single broadcast domain will significantly expand the broadcast traffic in the network. Since the emergence of software-defined networking (SDN), researchers exploited various attractive features of SDN to suppress the broadcast traffic. Although capable in addressing the scalability issue of Ethernet, the existing SDN based solutions are lacking of security mechanism, which may expose the network to various ARP based attacks. Owing to this issue, this paper proposes a floodless and secure mechanism to suppress broadcast traffic. In general, the proposed solution utilizes SDN architecture and accommodates a multistage security algorithm. The multistage security algorithm consists of three stages; each stage incorporates specific analysis to identify the packet status or behavior, and react accordingly based on its status. To demonstrate the efficiency of the proposed solution, several ARP based attack scenarios are generated and evaluated using Mininet emulator. The performance evaluation indicates that the true positive ratio for attack detection in the proposed solution is 57.14% for the first stage, 66.66% for the second stage, and in some cases may achieve 100% for the final stage.

Multi-timescale and multi-centrality layered node selection for efficient traffic monitoring in SDNs

With the assistance of global view in software-defined networks (SDNs), some switch nodes can be selected for traffic monitoring, which ensures the security of SDNs with a minimum cost. However, identifying the flow-based smallest subset of switches with the maximum coverage for node selection is always an NP-hard problem. To address this challenge, a two-stage parameter-rectifying-based selection (TSPRS) scheme is presented for efficient traffic monitoring in SDNs. In this novel scheme, a multi-timescale and multi-centrality layered virtual network (MMLVN) model is first built according to the different network structures over various time periods. By virtue of the MMLVN model, a tensor-based eigenvector multi-centrality computing (TEMC) method is employed at the first-stage selection to identify the smallest subset of switches with the maximum coverage for obtaining the subset of primary core nodes. To obtain more accurate parameters of real-time flows, a modified MMLVN model is further built by combining the results of a bandwidth cost-effective polling (BCeP) algorithm and the first-stage selection. Then, based on the modified MMLVN model, the TEMC method is reused to obtain the final optimization subset of the core nodes for efficient traffic monitoring at the second-stage selection. Extensive simulation experiments demonstrate that the proposed scheme can achieve a desirable tradeoff between the monitoring overhead and accuracy, and also reduce the communication bandwidth cost, which is superior to the existing state-of-the-art schemes.

Security analysis of SDN controller-based DHCP services and attack mitigation with DHCPguard

Software defined networking (SDN) presents opportunities for improving network management, mainly thanks to the centralized controller separated from forwarding devices. On the other hand, security in SDN is a complicated issue: SDN both inherits vulnerabilities from traditional networks through common protocols and introduces new problems due to the risks associated with softwarization. Dynamic host configuration protocol (DHCP) is an essential protocol in SDNs as well and the security risks of DHCP also menace SDNs. In this study, we have analyzed the security of the built-in DHCP services on three popular SDN controllers: POX, ONOS and Floodlight. Our results indicate that they are vulnerable to starvation attacks, and DHCP discovery message floods can also be used to launch denial-of-service attacks, slowing down networks and overloading controllers. To counter these issues, we examined state-of-the-art DHCP security methodologies and assessed their applicability to the built-in DHCP servers of SDN controllers. Considering our assessment, we have designed and implemented a DHCP security module on the POX controller, DHCPguard, utilizing DHCP snooping, rate limiting, and IP pool recovery functions. Our findings show that DHCPguard successfully blocks malicious DHCP messages, recovers the IP address pool, and alleviates the negative effects of DHCP related attacks on the network without significant overhead. DHCPguard is able to increase throughput by up to 94% and decrease CPU usage by up to 92% compared to plain POX under DHCP attack scenarios performed on simple and complex topologies.

An efficient mechanism to detect and mitigate an ARP spoofing attack in software-defined networks

The work focuses on software-defined network security, as it was always one of these foremost critical concerns due to the centralized nature in SDN architecture where many serious attacks in traditional networks still appear in SDN networks such as ARP spoofing attack despite many existing security algorithms, methods and systems. In this work, we proposed a new approach to secure SDN from an ARP poisoning attack. The new solution extends the controller with a new module that uses a new algorithm to detect and mitigate the ARP spoofing attacks according to three states of each host in the network. The new mechanism involves the DHCP and manual assignment of IP addresses using three classes to classify the hosts according to their situations in the network. The CHT helps to set the host in an intermediate state between verifying and banning and detect the attack according to the next step of the host. The proposed mechanism was tested successfully in a simulated environment using Mininet and POX controller. The solution was effectively able to accomplish the objective for which it was built, with a limited overhead on the network. This proposed solution neither has an extra overload in the network, nor requires any changes in the infrastructure or additional hardware to install. According to the experiment results of this solution, the average time to detect the ARP spoofing attack is about 11 ms, with minor overhead on the controller CPU.

An approach based on Yet Another Next Generation for software‐defined networking management

SummaryThe lack of a Management Plane specification in the software‐defined networking (SDN) is a fundamental problem for the integrated management of networks that follow this paradigm. Several solutions have addressed this problem, but they do not provide data models intended to support Fault, Configuration, Accounting, Performance, and Security (FCAPS) in SDN from a specialized Management Plane. In this paper, we introduce a technology‐agnostic approach that comprises mainly a collection of YANG data models and their relationships. These models characterize SDN management and handle technology heterogeneity. To evaluate our approach, we developed the proof of concept of the YANG data models in an SDN scenario involving the configuration of devices from different vendors supporting diverse technologies. The evaluation results show the efficiency of our approach regarding response time, composition time, consumption time, and network traffic.

Securing middlebox policy enforcement in SDN

Software-Defined Networking (SDN) greatly simplifies middlebox policy enforcement. Middleboxes need tag packet headers to avoid forwarding ambiguity on SDN switches. In this paper, we present a new attack, called middlebox-bypass attack, to breach SDN-based middlebox policy enforcement. Such an attack manipulates a compromised switch to locally tag attacking packets without handing them over to the attached middlebox for inspection. Existing SDN security solutions, however, cannot detect the middlebox-bypass attack under practical constraints of efficiency, robustness, and applicability. We design and implement FlowCloak, the first protocol for per-packet real-time detection and prevention of middlebox-bypass attacks. FlowCloak enables middleboxes to generate tags that are probabilistically unknown to an attacker and confines it to only random guessing. We propose a multi-tag verification technique to address the tradeoff between FlowCloak robustness and TCAM usage by tag verification rules on the egress switch. Experiment results show that dozens of verification rules can confine the attacking probability under 0.1%. We further explore implementation techniques of packet looping and field swapping that can enable a flow table pipeline on a single TCAM and mitigate packet correlation, respectively. FlowCloak imposes only a 0.01 ms packet processing delay on middleboxes and no obvious delay on the egress switch.

A critical review based on Fault Tolerance in Software Defined Networks

SDN (Software-Defined Networks) is an incipient architecture of decoupling control plane and data plane involved in dynamic management of network. SDN is being installed in production based networks which ultimately lead to the need of secure and fault tolerant SDN. In the present investigation, we are discussing about the kind of failures with label happen in SDN. A critical survey based on the recently proposed mechanisms for handling failures in SDN. Initially, we discussed with the help of tabular data involving mechanism of data plane failure. We also discussed the various mechanisms for handling misconfiguration of drift able of switches and control plane failure handling mechanisms. We also epitomize issues with both data and control plane mechanism that are discussed earlier. In the end, we are stating that there is need of build much efficient and secure mechanism for SDN networks.

DDoS Detection Using a Cloud-Edge Collaboration Method Based on Entropy-Measuring SOM and KD-Tree in SDN

Software-defined networking (SDN) emerges as an innovative network paradigm, which separates the control plane from the data plane to improve the network programmability and flexibility. It is widely applied in the Internet of Things (IoT). However, SDN is vulnerable to DDoS attacks, which can cause network disasters. In order to protect SDN security, a DDoS detection method using cloud-edge collaboration based on Entropy-Measuring Self-organizing Maps and KD-tree (EMSOM-KD) is designed for SDN. Entropy measurement is utilized to select the ideal SOM map and classify SOM neurons considering the limitation of dead and suspicious neurons. EMSOM can detect most flows directly and filter out a few doubtable flows. Then these flows are fine-grained, identified by KD-tree. Due to the limited and precious resources of the controller, parameter computation is performed in the cloud. The edge controller implements DDoS detection by EMSOM-KD. The experiments are conducted to evaluate the performance of the proposed method. The results show that EMSOM-KD has better detection accuracy; moreover, it improves the KD-tree detection efficiency.

Location Hijacking Attack in Software-Defined Space–Air–Ground-Integrated Vehicular Network

Internet of Vehicles (IoV) is an emerging technology in automotive field, in which vehicles can communicate with other vehicles and roadside infrastructures to improve information acquisition ability as well as obtain various services to elevate the security and comfort level. To cope with the increasingly complex vehicular network, software-defined networking (SDN) architecture with advantages of centralized management and flexible control becomes a promising solution. However, in application scenarios, the security of SDN is rarely concerned. If attackers exploit the vulnerabilities of SDN to hijack the network location of the servers or vehicles, vehicles may not be able to access the services they need timely and effectively, which will pose a great threat to the benefit of vehicle users. In light of this, we focus on location hijacking attack against SDN in vehicular network. We perform this attack on five mainstream SDN controller platforms and analyse its impacts from multiple perspectives. As far as we know, this is the first study of such attack in vehicular network. Furthermore, using the advantages of the software-defined space&#x2013;air&#x2013;ground-integrated vehicular network and the characteristics of high altitude platform (HAP), such as wide coverage and high load capacity, we put forward the attack recovery scheme based on deep <inline-formula> <tex-math notation="LaTeX">$Q$ </tex-math></inline-formula>-learning (DQL) to supplement existing defence mechanisms that always have counter attacks and endow the vehicular network with a certain resilience.

Security Enhancement in Software Defined Networking (SDN): A Threat Model

Software Defined Networking (SDN) has emerged as a technology which can replace the prevalent vendor based proprietary CLI networking devices. SDN has introduced applications based network control and provided various opportunities and challenges for research and innovation in these networks. Despite many advantages and opportunities in SDN, security is a matter of concern for developers who want to invest in SDN. In this paper we are analyzing the SDN security issues with their countermeasures. We have generalized four use cases threat model that should cover security requirements of SDN. These use cases are: (I) protect controllers from applications, (II) inter-controller protection, (III) protecting data plane or switches from controller, (IV) protecting controllers from malicious switches. We found that these SDN components are inter-related if one is secure another one is already secure. We also compared the SDN and traditional network security in terms of these four use cases and provide the insights for protection mechanism and security enhancements. A framework for the development of a SDN security application has been presented based on ryu controller. We believe that our threat model will help various researchers and developers to understand current security requirements and provide a ready reference to tackle vulnerabilities and threats in this area. Finally, we identify some open research problems and future research directions with a proposed security architecture.

Configuration and Governance of Dynamic Secure SDN

Abstract Software Defined Networks (SDN) is a networking paradigm that separates the control plane from the forwarding plane. There is little research on structuring the SDN data plane for security. The Robust Network and Segmentation Algorithm (RNS) is an algorithm based on Product Family Algebra (PFA) that implements layered defence and segmentation strategies to segment resources towards designing secure networks. In this paper, we present an additional plane in charge of the configuration and governance of SDN data planes that we call Dynamic Configuration and Governance (DCG) plane. It is intended to give agility to dynamic networks. It implements the RNS algorithm in SDN environment. Moreover, we propose and suggest three architectures that use DCG plane. Then we assess the three architectures. The assessment results identify an architecture that is suitable for dynamic networks and another for networks that are more stable regarding changes to policy and network topology.

Secure Software-Defined Networking Communication Systems for Smart Cities: Current Status, Challenges, and Trends

Smart city is a transformative and progressive vision that aims to revolutionize infrastructure systems and public services in an urban area with modern information technologies. Its ultimate goal is to greatly improve the livability Quality of Service (QoS) of its citizens and to optimize the utilization of its assets and natural resources sustainably. One of the key technical attributes in smart cities is to deploy a large number of sensors to collect data to enable real-time and intelligent decisions for various city functions and citizen needs. Many of the data have strict security requirements as they are either private to citizens or sensitive to critical infrastructures. As a result, how to securely and efficiently deliver and process the dramatically increasing volume of data becomes one of the grand challenges in materializing the smart city vision. In recent years, Software-Defined Networking (SDN) has emerged as a leading communication infrastructure candidate for smart cities. While many efforts have existed to research, prototype, and even deploy SDN on a small scale for some smart city applications, there is still a lack of cohesive understanding about SDN’s impact on the secure communication need of smart cities. In this paper, we conduct a comprehensive survey of the core functionality of SDN from the perspective of secure communication infrastructure at different scales. A specific focus is put on the security threats and challenges in accordance with SDN plane-based architectures for various smart city-enabled applications. We further systematically categorize the state-of-art solutions and proposals to apply SDN to support typical smart city applications, such as transportation, health, and energy applications. Lastly, we cast a holistic view of future research trends.

Challenge-based collaborative intrusion detection in software-defined networking: an evaluation

Software-Defined Networking (SDN) is an emerging architecture that enables a computer network to be intelligently and centrally controlled via software applications. It can help manage the whole network environment in a consistent and holistic way, without the need of understanding the underlying network structure. At present, SDN may face many challenges like insider attacks, i.e., the centralized control plane would be attacked by malicious underlying devices and switches. To protect the security of SDN, effective detection approaches are indispensable. In the literature, challenge-based Collaborative Intrusion Detection Networks (CIDNs) are an effective detection framework in identifying malicious nodes. It calculates the nodes’ reputation and detects a malicious node by sending out a special message called a challenge. In this work, we devise a challenge-based CIDN in SDN and measure its performance against malicious internal nodes. Our results demonstrate that such a mechanism can be effective in SDN environments.

A Study on Various Attacks and Detection Methodologies in Software Defined Networks

The Software Defined Networks (SDN) is widely used in many industrial and enterprise networking applications due to its flexibility and gaining popularity. It offers various benefits like network virtualization, policy enforcement, greater control, and reduced operational cost. One of the challenging tasks in SDN is to secure the network against the harmful attacks. For this purpose, various attack detection mechanisms are developed in traditional works, which intends to increase the security of SDN by employing different policy enforcement and soft computing techniques. In this paper, a comprehensive survey is presented on various attacks that affect the performance of SDN and its corresponding countermeasure techniques. Typically, the performance of a network can be degraded due to the cause of attacks present on the layers. Also, it leads to reduced Quality of Service (QoS), increased network congestion, and packet drops. So, the attacks present on the layers must be detected or prevented for increasing the performance of SDN. This investigation illustrates various attacks with its causes and the most suitable techniques used for detecting those attacks for improving security. Moreover, the advantages and disadvantages of each attack detection mechanism are presented with its working procedure.

Near real-time security system applied to SDN environments in IoT networks using convolutional neural network

The Internet of Things (IoT) paradigm brings new and promising possibilities for services and products. The heterogeneity of IoT devices highlights the inefficiency of traditional networks’ structures to support their specific requirements due to their lack of flexibility. Thus, Software-defined Networking (SDN) is commonly associated with IoT since this architecture provides a more flexible and manageable network environment. As shown by recent events, IoT devices may be used for large scale Distributed Denial of Service (DDoS) attacks due to their lack of security. This kind of attack is commonly detected and mitigated at the destination-end network but, due to the massive volume of information that IoT botnets generate, this approach is becoming impracticable. We propose in this paper a near real-time SDN security system that both prevents DDoS attacks on the source-end network and protects the sources SDN controller against traffic impairment. For this, we apply and test a Convolutional Neural Network (CNN) for DDoS detection, and describe how the system could mitigate the detected attacks. The performance outcomes were performed in two test scenarios, and the results pointed out that the proposed SDN security system is promising against next-generation DDoS attacks.

On the Security of a Smart City SDN-Based Network

Our research work focuses on the security techniques applied on a software-defined network (SDN), designed for a smart city. Information security is essential for the good functionality of the applications used in a smart city. Information should be correct and complete otherwise the ‘life’ of the city can be compromised by various cyberattacks targeting, for example, the public transportation system, the traffic information on highways or location services for emergency crews and many others. Securing all devices connected to the SDN, including end-user devices, wireless sensors, smart home equipment is essential because various cyberattacks may be launched and the smart city may be disturbed. This paper presents a risk analysis, the ways to choose the security solutions according to the smart city security policy and our proposal for the SDN security system. We compare different security techniques and present some recommended solutions.