Software Defined Networking Security Research Articles

On the Security of a Smart City SDN-Based Network

Our research work focuses on the security techniques applied on a software-defined network (SDN), designed for a smart city. Information security is essential for the good functionality of the applications used in a smart city. Information should be correct and complete otherwise the ‘life’ of the city can be compromised by various cyberattacks targeting, for example, the public transportation system, the traffic information on highways or location services for emergency crews and many others. Securing all devices connected to the SDN, including end-user devices, wireless sensors, smart home equipment is essential because various cyberattacks may be launched and the smart city may be disturbed. This paper presents a risk analysis, the ways to choose the security solutions according to the smart city security policy and our proposal for the SDN security system. We compare different security techniques and present some recommended solutions.

On the fine-grained fingerprinting threat to software-defined networks

Software-defined networking (SDN) is an emerging networking technology, which has attracted wide attention from academia and industry, playing a key role in enabling techniques of the 5th generation wireless systems (5G). The fundamental characteristic of SDN is that it decouples the control plane from the data plane, which can provide flexibility and programmability for 5G. Unfortunately, the separation of the two planes becomes a potential attack surface as well, which enables adversaries to fingerprint and attack the SDNs. Existing work showed the possibility of fingerprinting an SDN with time-based features. However, they are coarse-grained. This paper proposes a fine-grained fingerprinting approach that reveals the much more severe threats to SDN security and explores the mitigation strategies. By analyzing network packets, the approach can dig out sensitive and control-related information, i.e., match fields of SDN flow rules. The match fields of flow rules can be used to infer the type of an SDN controller and the security policy of an SDN network. With sensitive configuration information, adversaries can launch more targeted and destructive attacks against an SDN. We implement our approach in both simulated and physical environments with different kinds of SDN controllers to verify the effectiveness of our concept. Experimental results demonstrate the feasibility to obtain fine-grained and highly sensitive information in SDN, and hence reveal the high risk of information disclosure in SDN and severe threats of attacks against SDN. To mitigate the fine-grained fingerprinting threat we have revealed, we explore a lightweight countermeasure trying to hide the sensitive time-based features of SDN networks. Implementation and evaluation demonstrate that our countermeasure can play a role in mitigating the risk of SDN control information leakage with only minor overheads.

A Novel SDN Architecture for IoT Security

Describes the term Internet of Things (IoT) security architecture based on Software Defined Networking (SDN). In this context, building on SDN works with or without infrastructure. This is called the SDN domain. This work describes the mechanics of the proposed architecture and reduces the chances of using SDN to achieve more effective and flexible network security. It outlined the issues associated with current SDN security applications and introduced a new IoT system plan. This document has discussed the management of Internet access for specific networks and monitoring of global traffic. Finally, it describes the choice of architecture for SDN using OpenFlow and discusses the resulting results.

A Systemic and Secure SDN Framework for NoC-Based Many-Cores

Recent exploration of Software-Defined Networking (SDN) for Many-Core Systems-on-Chip (MCSoCs) showed higher management flexibility and reduced physical complexity compared to other runtime communication management. In SDN, there is a software SDN Controller (control layer) that configures generic routers (data layer). The adoption of SDN makes the path establishment programmable and straightforward, according to different network policies, such as low power, QoS, fault-tolerance. It is also possible to change the path establishment policies at runtime without the need to redesign the NoC. Current works focus on proposing SDN architectures, lacking a systemic framework that describes the steps required to implement SDN into a Many-core environment. Security is an observed gap in SDN designs. A malicious task could configure SDN routers and take control of the NoC. The contribution of this work is to present a systemic and secure SDN framework (SDN-SS), detailing the steps required to support SDN in MCSoCs. This work also describes the iteration between the hardware, operating system, and user's tasks. The SDN-SS manages a Multiple-Physical NoC, with one packet-switching subnet and a set of circuit-switching subnets. The originality of SDN-SS includes (i) a step-by-step framework description addressing the phases required to support a secure SDN management; (ii) a secure SDN router configuration protocol; (iii) a protocol to change the subnet at runtime. Experimental results show the framework's capability to avoid DoS and Spoofing attacks while presents a low SDN router configuration overhead, corresponding up to 2% of a related work delay and a small impact over the user's task communication.

Solutions to Vulnerabilities and Threats in Software Defined Networking (SDN)

Abstract In today’s advancing world, there is an increase in the size and requirements of networks which can be a burden since moving around with switches is quite chaotic. SDN helps switches to be programmed and implemented independently. SDN is a way of providing programmability for network application development by separating the control plane from the data plane. Security of Software Defined Networking (SDN) is an open subject. Separating the control plane from the data plane opens up a number of security challenges such as a man-in-the-middle attack (MITM), a service denial (DoS), overload saturation attacks, etc. In this paper, we have focused on the overview of software defined network (SDN), it’s challenges, it’s issues, and their solutions. First, we have discussed about the architecture of SDN, followed by elaborating the threats and at the last, proposing some solutions to improvise the security.

Link Discovery Attacks in Software-Defined Networks: Topology Poisoning and Impact Analysis

Software Defined Networking (SDN) has become a popular technology that offers advantages of programmable and flexible network management over the legacy practice. The centralized SDN controller is an important enabler of these benefits. One of the most crucial tasks of the SDN controller is link discovery as it provides topology of the network essential for the controller to direct or create rule forwarding and routing mechanisms. Much research on SDN security has been studied but only recently that security of OpenFlow link discovery protocols and topology poisoning have been addressed. Existing work includes link fabrication attacks via compromised hosts and defense systems with authentication. This paper discusses SDN link discovery process and its vulnerability to link discovery attacks including new attacks via compromised switches. We present a simple but effective defense mechanism using active ports that can detect both host-based and switch-based link discovery attacks. Finally, the paper presents an analytical and empirical analysis of the impacts of topology attacks on routing. The paper discusses attack details, proposed methods and results of these analyses.

A Survey on Intrusion Detection System for Software Defined Networks (SDN)

Presently, the advances of the internet towards a wide-spread growth and the static nature of traditional networks has limited capacity to cope with organizational business needs. The new network architecture software defined networking (SDN) appeared to address these challenges and provides distinctive features. However, these programmable and centralized approaches of SDN face new security challenges which demand innovative security mechanisms like intrusion detection systems (IDS's). The IDS of SDN are designed currently with a machine learning approach; however, a deep learning approach is also being explored to achieve better efficiency and accuracy. In this article, an overview of the SDN with its security concern and IDS as a security solution is explained. A survey of existing security solutions designed to secure the SDN, and a comparative study of various IDS approaches based on a deep learning model and machine learning methods are discussed in the article. Finally, we describe future directions for SDN security.

Network attacks classification using Long Short-term memory based neural networks in Software-Defined Networks

Abstract SDN (Software-Defined Network) is a network in which the control plane functionality is separated from the packet forwarding layer. The paper is devoted to the study of the SDN security. A comparison of neural networks with various parameters on existing dataset is presented. CSE-CIC-IDS2018 dataset [12] provided by Canadian Institute for Cybersecurity (CIC) on AWS (Amazon Web Services) was chosen. It contains of the most relevant types of network attacks. Results show that a simple neural network, such as a multi-layer perceptron, can be used to provide basic protection against most attacks. To provide more reliable protection, complex neural networks should be used. The presented LSTM-based model showed a very good result of intrusion detection.

Enabling Digital Grid for Industrial Revolution: Self-Healing Cyber Resilient Platform

Driving digital grid development to provide sustainable, reliable and secure network systems requires deploying a variety of applications against any potential cyber attacks. Therefore, there is an urgent demand to accelerate the development of an intelligent Software-Defined Networking (SDN) platform that can address the tremendous challenges of data protection for digital resiliency. Modern grid technology tends to adopt distributed SDN controllers for further slicing power grid domain and protect the boundaries of electric data at network edges. To facilitate these techniques, this article proposes an intelligent secure SDN controller for supporting digital grid resiliency, considering management coordination capability, self-healing features and recovery of network traffic forwarding during service interruptions. A set of advanced features are employed in grid controllers to configure the network elements in response to possible disasters or link failures. In addition, various SDN topology scenarios are introduced for efficient coordination and configurations of network domains. Finally, to justify the potential advantages of an intelligent secure SDN system, a case study is presented to evaluate the requirements of secure digital modern grid networks and pave the path toward the next phase of industry revolution.

Common Vulnerability Scoring System for SDN Environment

The identification of component vulnerability is an important criterion for securing the networks and it is an open issue for Software Defined Network (SDN). The First.org provides an open tool namely Common Vulnerability Scoring system for identification of component vulnerability, but there is no distinctive correspondence between CVSS and SDN. With this paper, we try to identify such correspondence so that it will help network researchers to determine the network vulnerability and improve the SDN security soon. This paper also includes a comparison between the last three CVSS versions. For this comparison, one can understand what are the new features CVSS incorporating for identifying new vulnerabilities in the emerging environment.

Data-driven software defined network attack detection : State-of-the-art and perspectives

SDN (Software Defined Network) has emerged as a revolutionary technology in network, a substantial amount of researches have been dedicated to security of SDNs to support their various applications. The paper firstly analyzes State-of-the-Art of SDN security from data perspectives. Then some typical network attack detection (NAD) methods are surveyed, including machine learning based methods and statistical methods. After that, a novel tensor based network attack detection method named tensor principal component analysis (TPCA) is proposed to detect attacks. After surveying the last data-driven SDN frameworks, a tensor based big data-driven SDN attack detection framework is proposed for SDN security. In the end, a case study is illustrated to verify the effectiveness of the proposed framework.

DDoS attack detection scheme based on entropy and PSO-BP neural network in SDN

SDN (Software Defined Network) has many security problems, and DDoS attack is undoubtedly the most serious harm to SDN architecture network. How to accurately and effectively detect DDoS attacks has always been a difficult point and focus of SDN security research. Based on the characteristics of SDN, a DDoS attack detection method combining generalized entropy and PSO-BP neural network is proposed. The traffic is pre-detected by the generalized entropy method deployed on the switch, and the detection result is divided into normal and abnormal. Locate the switch that issued the abnormal alarm. The controller uses the PSO-BP neural network to detect whether a DDoS attack occurs by further extracting the flow features of the abnormal switch. Experiments show that compared with other methods, the detection accurate rate is guaranteed while the CPU load of the controller is reduced, and the detection capability is better.

A survey: Typical security issues of software-defined networking

Software-Defined Networking (SDN) has been a hot topic for future network development, which implements the different layers of control plane and data plane respectively. Despite providing high openness and programmability, the three-layer two-interface architecture of SDN changes the traditional network and increases the network attack nodes, which results in new security issues. In this paper, we firstly introduced the background, architecture and working process of SDN. Secondly, we summarized and analyzed the typical security issues from north to south: application layer, northbound interface, control layer, southbound interface and data layer. Another contribution is to review and analyze the existing solutions and latest research progress of each layer, mainly including: authorized authentication module, application isolation, DoS/DDoS defense, multi-controller deployment and flow rule consistency detection. Finally, a conclusion about the future works of SDN security and an idealized global security architecture is proposed.

Using INSPECTOR Device to Stop Packet Injection Attack in SDN

The software-defined network (SDNs) architecture can easily be attacked by a malicious user in order to prevent an acceptable level of service. Therefore, SDN security is a hot research topic to improve the SDN architecture and to protect the service level of the SDN components. In this letter, the INSPECTOR is a hardware device added to the SDN architecture to protect a compromised controller from a packet injection attack by verifying the authentication of Packet-In Messages accessing network resources. With simulations, we show that the INSPECTOR device efficiently stops the attack and enhances the controller performance under malicious attack.

DDoS attack detection scheme based on entropy and PSO-BP neural network in SDN

SDN (Software Defined Network) has many security problems, and DDoS attack is undoubtedly the most serious harm to SDN architecture network. How to accurately and effectively detect DDoS attacks has always been a difficult point and focus of SDN security research. Based on the characteristics of SDN, a DDoS attack detection method combining generalized entropy and PSO-BP neural network is proposed. The traffic is pre-detected by the generalized entropy method deployed on the switch, and the detection result is divided into normal and abnormal. Locate the switch that issued the abnormal alarm. The controller uses the PSO-BP neural network to detect whether a DDoS attack occurs by further extracting the flow features of the abnormal switch. Experiments show that compared with other methods, the detection accurate rate is guaranteed while the CPU load of the controller is reduced, and the detection capability is better.

An Approach for Supervising the Security Threats using Software Defined Networks

Providing Protection For The Network Is Major Significant Subject By Continued Existence Of Systems Which Are Allied By Means Of Network In This World, Which Broadcast Information Regarding Every Part Of Circumstances In Our Life And Occupation. The Systems Which Have Fine Security To A Network Would Support Business In Addition To, It Decreases The Hazard Of Diminishing Fatality In Favor Of Data Theft And Sabotage. The Framework Of Software Defined Networking (SDN) Disjoins The Data And Control Planes. The Fundamental Set Of Connections (Network) Structural Design Is Inattentive From Applications, The State Of A Network Along With Brilliance Are Logically Integrated. It Increases Security For A Network With The Help Of Overall Visualness Of The Network Condition Wherever A Collision Could Be Straightforwardly Decided Commencing The Understandably United Control Plane. The SDN Has Some Types Of Mechanics Together With Network Virtualization, Functional Separation Along With Computerization By Practicability By Programs. Basically, SDN Equipment Mainly Paid Attention On Partition Of The Control Plane Out Of The Network Data Plane. Based On The Packets Flow Through The Network The Control Plane Generates Outcomes, While The Plane Of Data Shifts Packets From One Position To Another Position. Even So, Open Protection Difficulties, Like Man-In-The Middle Attacks, Denial Of Service (Dos) Attacks, Along With Saturation Attacks. The Design Of SDN Authorizes Networks Toward Actively Observes The Transfer Passage And Analysis The Risk To Simplifies Network Disputation, Safety Procedure Modification, And Safety Examine Inclusion. In This Paper, We Examine Safety Threats To Appliance, The Planes Of SDN That Is Data And Control Plane. The Safekeeping Designs That Protect All The Planes Are Defined And Succeeded By Different Safety Ways For Network-Wide Security In SDN. The Safety Of SDN Is Examined Conceding To Protection Proportions Of The ITU-T Recommendation, In Addition With The Costs Of Security Keys. Highlighting The Present And Upcoming Safety Difficulties In SDN And Expecting Guidelines For Safe SDN In This Paper.

Security enhancement for software defined network using game theoretical approach

Software Defined Networking (SDN) is a new approach for network programmability, which refers to the ability to control, change, and manage network behavior dynamically through software via open interfaces in contrast to relying on closed boxes and proprietary defined interfaces. It envisions the plan, deploy the critical service, performance and IT management upgrades for the utilization of 5th generation technology. The SDN framework enables centralized control of data path elements independently of the network technology used to connect these devices that can originate from different vendors. The centralized control embeds all the intelligence and maintains a network wide view of the data path elements and links that connect them. The novel approach will enhance the security for software defined network using the concept of game theory approach. The experimental results and analysis show that this approach has palpable advantages to enhance security in SDN.

Software-defined Networking-based DDoS Defense Mechanisms

Distributed Denial of Service attack (DDoS) is recognized to be one of the most catastrophic attacks against various digital communication entities. Software-defined networking (SDN) is an emerging technology for computer networks that uses open protocols for controlling switches and routers placed at the network edges by using specialized open programmable interfaces. In this article, a detailed study on DDoS threats prevalent in SDN is presented. First, SDN features are examined from the perspective of security, and then a discussion on SDN security features is done. Further, two viewpoints on protecting networks against DDoS attacks are presented. In the first view, SDN utilizes its abilities to secure conventional networks. In the second view, SDN may become a victim of the threat itself because of the centralized control mechanism. The main focus of this research work is on discovering critical security implications in SDN while reviewing the current ongoing research studies. By emphasizing the available state-of-the-art techniques, an extensive review of the advancement of SDN security is provided to the research and IT communities.

”Common Criteria” and Software Defined Network Security

«Common criteria» (ISO 15408) is a universally recognized and broadly applicable approach to information security solutions management and evaluation. «Common criteria» leans on developing a shared conceptual basis for key security solution modules including protection profiles and security targets. Conceptual basis development implies defining the following elements: security objectives and assumptions (for the environment and the object), threats and security policies, as well as functional and assurance requirements. The specifics of SDN (software defined network) security solutions is largely driven by fundamental architectural principles of SDN technology itself − primarily by the separation of control and data flows, − and by conditions imposed by Open Flow protocol application. However, proactive (threats and policies), passive (objectives and assumptions) and reactive (requirements) aspects of security management remain highly relevant for this type of security solutions. This paper discusses the Common Criteria application specifics for assessing the SDN security and practical MTUCI (Moscow Technical University of Communications and Informatics) experience in the development of the protection profile. A new class of network attacks on SDN switches and controllers can involve either data or control components. In addition to traditional vulnerabilities, centralization of management functions paves way for new security threats by isolating controller activity and administrative message exchange. Therefore, identifying and analyzing threats, policies and requirements specific to SDN control module security becomes an emerging priority.

A Petri Net-based Method to Verify the Security of the SDN

Due to the widespread research on Software Defined Networks (SDNs), the network security has been duly noted. But most of those efforts ponder over SDN security from the protocol perspective. To the best of our knowledge, none of the attempts has paid attention to the security analysis and modeling of state and communication in the SDN. Therefore, this paper provides a different approach to security analysis. Our objective is to analyze the security via the transformation state of communication model. Additionally, we present the security analysis method based on token to explore the potential threatens. Finally, we analyze the SDN via the combination of the number of token and time series based on Petri Net, and give the results. Our results are very bright in using such models to analyze such security objectives.