Software Defined Networking Security Research Articles

A Secure and Intelligent Software-Defined Networking Framework for Future Smart Cities to Prevent DDoS Attack

Smart cities have experienced significant growth in recent years, transforming people’s lives into a more futuristic version. The smart city initiative includes a diverse collection of specifications, encompassing a large number of users whose requirements vary significantly and heterogeneously. Each device in smart cities generates a significant amount of data, which places a load on the gateways. Smart cities face a major challenge due to the enormous amount of data they generate. Through software-defined networking (SDN), network information paths are optimized, ensuring that traffic flow is evenly distributed across all network nodes. A considerable number of IoT devices with limited resources are susceptible to various security threats, such as device hijacking, ransomware, man-in-the-middle (MiM) attacks, and distributed denial-of-service (DDoS) attacks. These threats can pose a severe challenge to network security. Additionally, DDoS attacks have disrupted web businesses, resulting in the loss of valuable data. To counter DDoS attacks in a smart city, several options exist, yet many challenges remain. This research presents a secure and intelligent system to combat DDoS attacks on smart cities. SDN security controllers and machine learning models with optimization are employed in this study to reduce the impact of common DDoS attacks on smart cities. This work utilizes an SDN based on security controllers and a detection mechanism rooted in a machine learning model with optimization to mitigate various types of prevalent DDoS attacks within smart cities. Employing binary classification, XGBoost achieved an accuracy of 99.99%, precision of 97%, recall of 99%, an F1 score of 98%, and a false-positive rate of 0.05. In multiclass classification, the average accuracy is 99.29%, precision is 97.7%, recall is 96.69%, and the F1 score is 97.51%. These results highlight the superiority of this approach over other existing machine learning techniques.

Hypertext transfer protocol performance analysis in traditional and software defined networks during Slowloris attack

<p>The extensive use of the internet has resulted in novel technologies and protocol improvisation. Hypertext transfer protocol/1.1 (HTTP/1.1) is widely adapted on the internet. However, HTTP/2 is found to be more efficient over transport control protocol (TCP). The HTTP/2 protocol can withstand the payload overhead when compared to HTTP/1.1 by multiplexing multiple requests. However, both the protocols are highly susceptible to application-level denial of service (DoS) attacks. In this research, a slow-rate DoS attack called Slowloris is detected over Apache2 servers enabled with both versions of HTTP in traditional networks and software defined networks (SDN). Server metrics such as server connection time to the webpage, latency in receiving a response from the server, page load time, response-response gap, and inter-packet arrival time at the server are monitored to analyze attack activity. A Monte Carlo simulation is used to estimate threshold values for server connection time and latency for attack detection. This work is implemented in a lab environment using virtual machines, Ryu controller, zodiac FX OpenFlow switch and Apache2 servers. This study also highlights SDN's security benefits over traditional networks.</p>

Security and Privacy Issues in Software-Defined Networking (SDN): A Systematic Literature Review

Software-defined network (SDNs) have fundamentally changed network infrastructure by decoupling the data plane and the control plane. This architectural shift rejuvenates the network layer by granting the re-programmability and centralized management of networks which brings about exciting challenges. Although an SDN seems to be a secured network when compared to conventional networks, it is still vulnerable and faces rigorous deployment challenges. Moreover, the bifurcation of data and control planes also opens up new security problems. This systematic literature review (SLR) has formalized the problem by identifying the potential attack scenarios and highlighting the possible vulnerabilities. Eighty-six articles have been selected carefully to formulize the SLR. In this SLR, we have identified major security attacks on SDN planes, including the application plane, control plane, and data plane. Moreover, this research also identifies the approaches used by industry experts and researchers to develop security solutions for SDN planes. In this research, we have introduced an attack taxonomy and proposed a collaborative security model after comprehensively identifying security attacks on SDN planes. Lastly, research gaps, challenges, and future directions are discussed for the deployment of secure SDNs.

A Comparative Study for SDN Security Based on Machine Learning

In the past decade, traditional networks have been utilized to transfer data between more than one node. The primary problem related to formal networks is their stable essence, which makes them incapable of meeting the requirements of nodes recently inserted into the network. Thus, formal networks are substituted by a Software Defined Network (SDN). The latter can be utilized to construct a structure for intensive data applications like big data. In this paper, a comparative investigation of Deep Neural Network (DNN) and Machine Learning (ML) techniques that uses various feature selection techniques is undertaken. The ML techniques employed in this approach are decision tree (DT), Naïve Bayes (NB), Support Vector Machine (SVM). The proposed approach is tested experimentally and evaluated using an available NSL–KDD dataset. This dataset includes 41 features and 148,517 samples. To evaluate the techniques, several estimation measurements are calculated. The results prove that DT is the most accurate and effective approach. Furthermore, the evaluation measurements indicate the efficacy of the presented approach compared to earlier studies.

DHCP DoS and starvation attacks on SDN controllers and their mitigation

Software Defined Networking (SDN) technology offers possibilities to improve network administration through a separate central controller for network switching devices. However, security in SDN is a critical issue and SDN faces new challenges due to shared protocols, inherits flaws from traditional networks and control flexibility. Dynamic Host Configuration Protocol (DHCP) is a crucial protocol for SDN, but DHCP itself poses a security risk to SDN. In our study we performed security analysis for DHCP attacks on RYU, OpenDaylight and Floodlight, three popular SDN controllers. Our research demonstrates that they are vulnerable to starvation attacks and denial of service attacks by flooding DHCP discovery messages, slowing down networks and overloading controllers. In order to address these problems, we looked at state-of-the-art DHCP security approaches and evaluated their performance on these SDN controllers. We proposed and implemented a DHCP security algorithm on the RYU controller based on our analysis. Our solution utilize flexibility of SDN controller to identify discovery flood packets and verify authentic hosts to mitigate effects of DHCP attacks. Furthermore, the proposed solution transfers the authentic flows to switch for reduction in controller load. We demonstrate that without significant computational load the suggested method successfully rejects malicious DHCP packets, restores the IP address pool, and mitigates the harmful network consequences of DHCP-related attacks. The proposed solution improves the throughput by 3.6 times, transferred data by 66.8%, CPU usage by 93.9% and packet loss by 95% compared to the conventional RYU controller.

A Secured Software Defined Network Architecture for Mini Net using POX Controller

SDN (software-defined networks) is a new technology that stems from numerous network security enhancements. It handles network data in a flexible manner using highly secure frameworks. The secure SDN model's purpose is to ensure data security. The proposed idea to be executed is a robust firewall protection in a mini net employing a POX controller. In order to deal with network-induced dangers, the huge network connectivity influenced environment requires additional protection. The proposed effort focuses on creating a secure SDN simulation architecture that is managed by Open Source POX Controller. Through a POX-controlled traffic management system and a Fingerprint-enabled authentication technique, the system provides multilayer security. The enhanced security is achieved by assessing network traffic as either elephant or mouse flow and selecting the appropriate security level based on data complexity. Mininet is run in a virtual cloud, where protocols and tools are tested and supported by a virtual machine (VM). The novelty is to produce a secure SDN topology was created using a python-based POX controller in the suggested technique. It also provides a low-cost solution as well as rapid development in conjunction with industrial networks.

Mitigation and Detection of DDOS attacks using Software Defined Network (SDN) and Machine Learning

Abstract: An emerging networking paradigm called Software Defined Networking (SDN) enables network control to be restricted to a logically centralized controller. This makes network visibility and management simpler on a global scale. SDN is a suitable network model for extensive deployment in real-world settings since it can be programmed using high-level programming languages. SDN is still vulnerable to a number of network attacks, the most notable of which being the DDoS (distributed denial of service) attack. A DDoS attack has the potential to render the controller, the brain of SDN, inoperable. SDN security is still in its infancy, and both business and academics have done a lot of research in this area. The SDN DDoS mitigation strategy utilizing machine learning (ML) is the main topic of this study. This work also surveys network traffic aspects for DDoS detection

Hybrid Deep Learning Approach for Automatic DoS/DDoS Attacks Detection in Software-Defined Networks

This paper proposes a hybrid deep learning algorithm for detecting and defending against DoS/DDoS attacks in software-defined networks (SDNs). SDNs are becoming increasingly popular due to their centralized control and flexibility, but this also makes them a target for cyberattacks. Detecting DoS/DDoS attacks in SDNs is a challenging task due to the complex nature of the network traffic. To address this problem, we developed a hybrid deep learning approach that combines three types of deep learning algorithms. Our approach achieved high accuracy rates of 99.81% and 99.88% on two different datasets, as demonstrated through both reference-based analysis and practical experiments. Our work provides a significant contribution to the field of network security, particularly in the area of SDN. The proposed algorithm has the potential to enhance the security of SDNs and prevent DoS/DDoS attacks. This is important because SDNs are becoming increasingly important in today’s network infrastructure, and protecting them from attacks is crucial to maintaining the integrity and availability of network resources. Overall, our study demonstrates the effectiveness of a hybrid deep learning approach for detecting DoS/DDoS attacks in SDNs and provides a promising direction for future research in this area.

Practical Labs for Teaching SDN Security

The rapid adoption of Software Defined Networking (SDN) in the industry has exposed certain security risks today some of which are unique to its paradigm. Security issues around the use-cases that expose these risks are fundamentally aligned with the networking and cybersecurity concepts that are taught at the graduate level in academia. In this paper, we present a number of lab activities on SDN security that are inspired from practical use-cases in SDN deployments. The goal of this effort is to help students give a shape to their thought process about the practical security implications of SDN deployments and gain valuable practical domain knowledge in securing an environment with such deployments.

DDoS ATTACK DETECTION METHODS BASED ON DEEP LEARNING IN HEALTHCARE

Software-defined network (SDN) is a new network structure, which has the characteristics of centralized management and programmable, and is widely used in the field of Internet of things. Distributed denial of service (DDoS) attack is one of the most threatening attacks in SDN network. How to effectively detect DDoS attacks has become a research hotspot in the field of SDN security management. Aiming at the above problems, this paper proposes a DDoS attack detection method based on Deep belief network (DBN) in SDN network architecture. By extracting the characteristics of OpenFlow switch flow table entries, DBN algorithm is trained to detect whether there are DDoS attacks. The experimental results show that the method is better than the other algorithms in accuracy, precision and recall.

Proposed Multi-Layer Firewall to Improve the Security of Software Defined Networks

one of the most important motivations behind the use of software-defined networking (SDN) is the desire to move from the approach of traditional networks to a more flexible and intelligent software development technology. This paper focuses on the importance of the SDN-based platform POX controller security firewall modules and its effectiveness on networks including the central administration of the SDN-based platform controller for protecting the network from possible attacks. The work is performed using the Mininet emulator with the aid of iperf bandwidth measurement tool. Result reveals that the proposed multi-layer firewall does not compromise the flexibility of the network in any way.

Real-time DDoS Detection and Mitigation in Software Defined Networks using Machine Learning Techniques

Software Defined Network (SDN) is the new era of networking technology based on a centralized controller that separates the switch hardware from its operating software. The most important challenge is the security of SDN and the most prominent attack is the Distributed Denial of Service (DDoS) attack. Some of the research work done so far detects DDoS attacks using a threshold, which is usually assumed without proper scientific reason and hence may not be always accurate. The mitigation techniques used by some researchers block the host from sending the network traffic beyond a threshold, by installing drop rules in the flow table of the switch connected to that host. Doing so will not only block the attack traffic but also the genuine ones from other applications of that host. In this paper, we propose a model that calculates the threshold limit for the type of applications sending data to a particular switch, in real-time using a machine learning (ML) model, and determines whether that application traffic is DDoS traffic. After the detection, only application type sending DDoS traffic is blocked while other genuine applications are allowed to send the network traffic without any interruption. The use of a dynamic threshold, based on the current network traffic, will help in detecting DDoS efficiently.

Blockchain-Based Educational Management and Secure Software-Defined Networking in Smart Communities

As network multimedia technology has advanced rapidly, video communication has made enormous strides and has been used in many educational industries. The use of educational video communication is a simple, effective, and convenient method of communication. A fast and energy-efficient blockchain clustering algorithm is proposed to pick the desired cluster head in software-defined networking (SDN). This research suggests using an adaptive resource allocation method and secure communication networks to improve the quality of instructional video transmission. To better educational management resources (EMR), this research suggests using a particle swarm algorithm (PSA). Using the PSA-EMR, an extended particle swarm optimization model suggests a low-complexity solution for adaptive central and distributed resource allocation in communication networks. The method improves the productivity and accuracy of the teaching team. Finally, a cost-effective digital framework for collecting and transmitting high-quality instructional content was developed to conclude the research.

Information Security Situation in Blockchain for Secure SDN Based on Big Data in Smart Communities

In the internet of things (IoT) and big data, the global information society is entering a new phase where consumers, networks, and perception devices work together more intimately. Software-defined networks (SDN) offer lower latency and massive connectivity for intelligent devices (IoT) for the internet of things. Smart communities are one of the most important applications of the blockchain. SDN technology is used to provide residents with smart services. Situational awareness for information security offers a distinct, high-level security perspective based on security alarm occurrences. However, contemporary information security warning data has become too complicated and varied than a simple analysis is almost impossible. In addition to enhancing IoT security's monitoring, emergency response, and forecasting capabilities, this article presents an IoT-assisted information security situation awareness framework (IoT-ISSAF). SDN model has been validated through simulation as being able to accurately assess the current state of network security in blockchain.

Entropy-based distributed denial of service attack detection in software-defined networking

Software defined networking (SDN) is a new network architecture that allows for centralized network control. The separation of the data plane from the control plane, which establishes a programmable network environment, is the key breakthrough underpinning SDN. The controller facilitates the deployment of services that specify control policies and delivers these rules to the data plane using a common protocol such as OpenFlow at the control plane. Despite the many advantages of this design, SDN security remains a worry because the aforementioned chapter expands the network's attack surface. In fact, denial of service (DoS) assaults pose a significant threat to SDN settings in a variety of ways, owing to flaws in the data and control layers. This work shows how distributed denial of service (DDoS) attack detection is based on the entropy variation of the destination IP address. The study takes advantage of the OpenFlow protocol's (OFP) flexibility and an OpenFlow controller (POX) to apply the proposed method. An entropy computation to determine the distributed features of DDoS traffic is developed and it is capable of detecting a user datagram protocol (UDP) flood attack after 0.445 seconds this type of attack occurred.

Improved DDoS Detection Utilizing Deep Neural Networks and Feedforward Neural Networks as Autoencoder

Software-defined networking (SDN) is an innovative network paradigm, offering substantial control of network operation through a network’s architecture. SDN is an ideal platform for implementing projects involving distributed applications, security solutions, and decentralized network administration in a multitenant data center environment due to its programmability. As its usage rapidly expands, network security threats are becoming more frequent, leading SDN security to be of significant concern. Machine-learning (ML) techniques for intrusion detection of DDoS attacks in SDN networks utilize standard datasets and fail to cover all classification aspects, resulting in under-coverage of attack diversity. This paper proposes a hybrid technique to recognize denial-of-service (DDoS) attacks that combine deep learning and feedforward neural networks as autoencoders. Two datasets were analyzed for the training and testing model, first statically and then iteratively. The auto-encoding model is constructed by stacking the input layer and hidden layer of self-encoding models’ layer by layer, with each self-encoding model using a hidden layer. To evaluate our model, we use a three-part data split (train, test, and validate) rather than the common two-part split (train and test). The resulting proposed model achieved a higher accuracy for the static dataset, where for ISCX-IDS-2012 dataset, accuracy reached a high of 99.35% in training, 99.3% in validation and 99.99% in precision, recall, and F1-score. for the UNSW2018 dataset, the accuracy reached a high of 99.95% in training, 0.99.94% in validation, and 99.99% in precision, recall, and F1-score. In addition, the model achieved great results with a dynamic dataset (using an emulator), reaching a high of 97.68% in accuracy.

Network Slicing for mMTC and URLLC Using Software-Defined Networking with P4 Switches

Massive machine-type communication (mMTC) and ultra-reliable low-latency communication (URLLC) are two key services in fifth-generation (5G) mobile wireless networks. These networks have been developed with extremely high service quality requirements: scalability for mMTC and reliability with low latency for URLLC. Fifth-generation network slicing will play a key role in supporting the distinct requirements of various services. Software-defined networking (SDN), a promising technology for network softwarization, physically separates the network control plane from the data plane by centrally controlling switches with an SDN controller. However, control channel bottleneck and processing delays due to this centralized control may reduce the scalability, reliability, and security of SDN. This paper proposes an SDN framework with programming protocol–independent packet processor (P4) switches (SDNPS), and defines a packet format containing in-band network telemetry data to simultaneously support heavy Internet of Things and URLLC traffic in 5G network slices. The method both satisfies the requirements of mMTC and URLLC and alleviates the load on the SDN controller. P4 is an advanced switch interface technology that provides enhanced stateful forwarding and reveals a persistent state on the SDN data plane. To demonstrate the superiority of SDNPS, simulations are performed on conventional SDNs and SDNPS. SDNPS outperforms the other schemes in terms of average throughput, packet loss ratio, and packet delay for both the mMTC and URLLC network slices.

Minimizing Update Makespan in SDNs Without TCAM Overhead

Efficient and consistent update of the network routing rules is a challenging task that significantly affects the performance, correctness, and security of Software-Defined Networks (SDN). In this work, we consider the problem of minimizing the makespan of updating the routing rules in SDNs, while guaranteeing three crucial consistency requirements: (1) WayPoint Enforcement, (2) Loop Freedom, and (3) Conflict Freedom. This problem is known to be NP-hard, and thus we focus on designing approximate algorithms that run in polynomial time without incurring TCAM storage overhead. To compute consistent rule-update schedules, we propose two algorithms, called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TimeX</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">RMS</i> . <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TimeX</i> employs the solution of a linear program (LP) to address the makespan minimization goal systematically. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">RMS</i> is an LP-independent heuristic that provides higher scalability. We demonstrate and utilize a property of rule-updates, called reversibility, to reduce the makespan in RMS. Extensive simulations show that our algorithms reduce the makespan by 2% to 18% and attain a 4.9 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\times$ </tex-math></inline-formula> speedup compared to previous studies. Moreover, Mininet experiments reveal that the proposed algorithms can mitigate the transient congestion caused by conflicting flows.

Performance Evaluation of SDN DDoS Attack Detection and Mitigation Based Random Forest and K-Nearest Neighbors Machine Learning Algorithms

Software-defined networks (SDN) have a centralized control architecture that makes them a tempting target for cyber attackers. One of the major threats is distributed denial of service (DDoS) attacks. It aims to exhaust network resources to make its services unavailable to legitimate users. DDoS attack detection based on machine learning algorithms is considered one of the most used techniques in SDN security. In this paper, four machine learning techniques (Random Forest, K-nearest neighbors, Naive Bayes, and Logistic Regression) have been tested to detect DDoS attacks. Also, a mitigation technique has been used to eliminate the attack effect on SDN. RF and KNN were selected because of their high accuracy results. Three types of network topology have been generated to observe the effectiveness of proposed algorithms on different network architectures. The results reveal that RF performs better than KNN in a single topology, and both have close performance in other topologies.

An Optimal Framework for SDN Based on Deep Neural Network

Software-defined networking (SDN) is a new paradigm that promises to change by breaking vertical integration, decoupling network control logic from the underlying routers and switches, promoting (logical) network control centralization, and introducing network programming. However, the controller is similarly vulnerable to a “single point of failure”, an attacker can execute a distributed denial of service (DDoS) attack that invalidates the controller and compromises the network security in SDN. To address the problem of DDoS traffic detection in SDN, a novel detection approach based on information entropy and deep neural network (DNN) is proposed. This approach contains a DNN-based DDoS traffic detection module and an information-based entropy initial inspection module. The initial inspection module detects the suspicious network traffic by computing the information entropy value of the data packet's source and destination Internet Protocol (IP) addresses, and then identifies it using the DDoS detection module based on DNN. DDoS assaults were found when suspected irregular traffic was validated. Experiments reveal that the algorithm recognizes DDoS activity at a rate of more than 99%, with a much better accuracy rate. The false alarm rate (FAR) is much lower than that of the information entropy-based detection method. Simultaneously, the proposed framework can shorten the detection time and improve the resource utilization efficiency.