A scalable anomaly detection and mitigation architecture for legacy networks via an OpenFlow middlebox

Abstract

In this paper, we investigate the applicability of inserting an OpenFlow middlebox to enhance the remotely triggered black hole routing mechanism, to mitigate distributed denial of service (DDoS) attacks in legacy networks. Specifically, we propose a modular architecture that exploits the network programmability of software-defined networking within the context of network functions virtualization, deploying on-demand virtualized network functions (VNFs) capable to manipulate and filter malicious traffic. Leveraging on the OpenFlow control functionality, we match and handle traffic on a per-flow level, preserving connectivity to/from the victim while pushing the mitigation process upstream, towards the edge of the affected network. To that end, a multilevel anomaly detection and identification mechanism was developed, pinpointing the victim in case an attack is detected. Subsequently, a virtualized network function instructs the edge router to forward all traffic destined to the victim to an OpenFlow switch, acting as a middlebox capable to filter malicious traffic identified by an OpenFlow controller, while preserving benign flows. The proposed architecture was implemented and evaluated based on the combination of datasets containing traces of real DDoS attacks and normal background traffic from our university campus network. Our analysis illustrated a clear clustering of Internet protocol prefixes used by malicious sources; thus, we implemented a longest common prefix aggregation algorithm to enable scaling of the proposed mitigation process, overcoming constraints due to hardware limitations of OpenFlow devices. Our analysis verifies that the proposed modular and scalable schema can efficiently identify DDoS attack victims and filter malicious traffic, without exhausting system and network resources.

Towards the transversal detection of DDoS network attacks in 5G multi-tenant overlay networks

“…Also, a local control agent is introduced on the switch to enable performing localised actions ordered by the control layer. The work proposed by Giotis et al, [29] use OpenFlow middleboxes to stop malicious flows of a DDoS attack in legacy networks. This work handle traffic on a per-flow level within an NFV context.…”

Distributed, multi-level network anomaly detection for datacentre networks

“…Each of the switches is running our prototype, with end-point Switches 1-4 continually analysing gathered statistics for potential anomalies, while Switches 5-7 are only involved in the detection process if specifically invoked. From the large range of possible attacks that can be evaluated, we decided to use a subset of available anomalies that represent a wide variety of attacks and allow us to accurately measure the performance of our proposed solution: Brute Force access which contain comparable patterns to 0-day attacks, DDoS attacks which are already being thoroughly investigated in other approaches [3], and Port Scans. This wide spread set of vulnerabilities contain features with large variations between them, therefore allowing us to thoroughly test the applicability of our prototype to the different styles of anomalies.…”

“…In this paper, we propose a two-level approach for network anomaly detection [2], [3], which combines coarse-grained monitoring performance with the accuracy of fine-grained analysis, resulting in improved detection accuracy with minimal performance costs. We further enhance the architecture by enabling execution within a distributed environment.…”

Research Trends in Security and DDoS in SDN

“…It becomes easier to detect and mitigate DDoS attacks in network, as policies could be imposed easily on devices, and central traffic filtering to detect malicious flow could be imposed. One study shows how DDoS in legacy network could be resolved using OpenFlow middle boxes that is capable of blocking attack sources easily. But at the same time, it has slower processing capability compared with hardware.…”