Abnormal SDN switches detection based on chaotic analysis of network traffic

Dinh, Phuc Trinh; Lee, Taehee; Thang, Nguyen Canh; Dang, Sa Pham; Noh, Si chul; Park, Min‐Ho

doi:10.1109/apcc47188.2019.9026485

Cited by 5 publications

(3 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently, we proposed a new approach [16] to detect compromised switches using an autoregressive integrated moving consecutive times, and some of the parameters which we observed during the attack exceed their thresholds, then the detection scheme raises an alarm. Although this is quite an effective method, it has a high false-alarm rate because of setting hard thresholds, and it has high CPU usage during the attack times due to centralized training only.…”

Section: Related Workmentioning

confidence: 99%

“…Moreover, it uses various measurements that are suitable for comparison. Last, our previous work, ARIMA [16], was chosen to demonstrate the expected improvement of ECSD.…”

Section: A Solutions For Comparisonmentioning

confidence: 99%

“…Note that we implemented these solutions, from [16], [27], [38], and [41], in our testbed according to the above observations to retain their original novelties and functionalities.…”

Section: A Solutions For Comparisonmentioning

confidence: 99%

See 2 more Smart Citations

ECSD: Enhanced Compromised Switch Detection in an SDN-Based Cloud Through Multivariate Time-Series Analysis

Dinh

Park

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

Nowadays, Software-Defined Networks (SDNs) are increasingly being used in many practical settings, posing a variety of security risks, such as compromised switches. Once a switch is compromised by an attacker, the switch may be either malfunctioning or misconfigured, displaying some abnormal network behaviors, e.g., delaying, dropping, adding, or modifying the traffic. In our previous work, we proposed an efficient scheme for detecting compromised SDN switches based on chaotic analysis of network traffic using an autoregressive-integrated-moving-average model. This scheme showed good results overall; however, it still showed high false-alarm rates due to a hard-set threshold. In this paper, we propose an enhanced scheme to detect compromised SDN switches effectively and reliably. The scheme consists of two phases (online and offline), leveraging the advantages of a stochastic recurrent neural network variant of multivariate time-series-based anomaly detection. Our main idea is to capture the normal patterns of multivariate time series by learning strong representations with the key techniques, such as planar normalizing flow and stochastic variable connection, then reconstruct input data by the representations, and use the reconstruction probabilities to find anomalies. Evaluation results of our proposed scheme yield outstanding performance in comparison with our previous work and other solutions.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Moreover, it uses various measurements that are suitable for comparison. Last, our previous work, ARIMA [16], was chosen to demonstrate the expected improvement of ECSD.…”

Section: A Solutions For Comparisonmentioning

confidence: 99%