Applying NFV/SDN in mitigating DDoS attacks

Zhou, Lihua; Guo, Huaqun

doi:10.1109/tencon.2017.8228200

Cited by 20 publications

(13 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The common approaches using SDN for security applications are based on inspecting packets or flow entries . In OverWatch, DDoS attack sensors and defense actuators run on data plane switches.…”

Section: Related Workmentioning

confidence: 99%

“…The common approaches using SDN for security applications are based on inspecting packets or flow entries. [10][11][12] In OverWatch, 13 DDoS attack sensors and defense actuators run on data plane switches. A DDoS attack classifier, a botnet tracker, and the libraries for defense actuators are located over the control plane.…”

Section: Related Workmentioning

confidence: 99%

“…On the other hand, being very suitable for the modern high‐bandwidth applications, SDN will increasingly replace conventional networking in the near future, and then it will rapidly become the main diffusion field for botnets. In recent years, there has been active research in SDN, NFV, and their applications for network security …”

Section: Introductionmentioning

confidence: 99%

“…In recent years, there has been active research in SDN, NFV, and their applications for network security. [7][8][9][10][11][12][13][14] In the SDN paradigm, due to the global view, DDoS attacks can be detected and defeated in early stages. However, existing approaches that build DDoS attack defense applications upon the SDN control plane are challenging to provide high defense performance.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

SDN/NFV security framework for fog‐to‐things computing infrastructure

2019

View full text Add to dashboard Cite

Summary Currently, core networking architectures are facing disruptive developments, due to emergence of paradigms such as Software‐Defined‐Networking (SDN) for control, Network Function Virtualization (NFV) for services, and so on. These are the key enabling technologies for future applications in 5G and locality‐based Internet of things (IoT)/wireless sensor network services. The proliferation of IoT devices at the Edge networks is driving the growth of all‐connected world of Internet traffic. In the Cloud‐to‐Things continuum, processing of information and data at the Edge mandates development of security best practices to arise within a fog computing environment. Service providers are transforming their business using NFV‐based services and SDN‐enabled networks. The SDN paradigm offers an easily programmable model, global view, and control for modern networks, which demand faster response to security incidents and dynamically enforce countermeasures to intrusions and cyberattacks. This article proposes an autonomic multilayer security framework called Distributed Threat Analytics and Response System (DTARS) for a converged architecture of Fog/Edge computing and SDN infrastructures, for emerging applications in IoT and 5G networks. The major detection scheme is deployed within the data plane, consisting of a coarse‐grained behavioral, anti‐spoofing, flow monitoring and fine‐grained traffic multi‐feature entropy‐based algorithms. We developed exemplary defense applications under DTARS framework, on a malware testbed imitating the real‐life DDoS/botnets such as Mirai. The experiments and analysis show that DTARS is capable of detecting attacks in real‐time with accuracy more than 95% under attack intensities up to 50 000 packets/s. The benign traffic forwarding rate remains unaffected with DTARS, while it drops down to 65% with traditional NIDS for advanced DDoS attacks. Further, DTARS achieves this performance without incurring additional latency due to data plane overhead.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

SDN/NFV security framework for fog‐to‐things computing infrastructure

2019

View full text Add to dashboard Cite

show abstract

“…Usage of network function virtualization has also been proven to assists in boosting security system against DDoS attack. The work of Zhou and Guo [25] has introduced a framework for mitigating DDoS attack by monitoring the network traffic to filter out any anomaly-based behavior. A prevention-based mechanism was carried out by Dong et al, [26] where the traffic flow is classified for the purpose of sequential probability decision making.…”

Section: Introductionmentioning

confidence: 99%

Preemptive modelling towards classifying vulnerability of DDoS attack in SDN environment

Narender¹,

Yuvaraju²

2020

IJECE

View full text Add to dashboard Cite

Software-Defined Networking (SDN) has become an essential networking concept towards escalating the networking capabilities that are highly demanded future internet system, which is immensely distributed in nature. Owing to the novel concept in the field of network, it is still shrouded with security problems. It is also found that the Distributed Denial-of-Service (DDoS) attack is one of the prominent problems in the SDN environment. After reviewing existing research solutions towards resisting DDoS attack in SDN, it is found that still there are many open-end issues. Therefore, these issues are identified and are addressed in this paper in the form of a preemptive model of security. Different from existing approaches, this model is capable of identifying any malicious activity that leads to a DDoS attack by performing a correct classification of attack strategy using a machine learning approach. The paper also discusses the applicability of best classifiers using machine learning that is effective against DDoS attack.

show abstract

Mitigation of cyber threats: Protection mechanisms in federated SDN/NFV infrastructures for 5G within FIRE+

Pérez

Celdrán

Giardina

et al. 2019

Concurrency and Computation

View full text Add to dashboard Cite

Summary Cyber attacks are becoming a very common trend in existing networks, expecting to be even more acute in future 5G networks due to greater number of connected devices, higher mobile data volume, low latency, etc. Security mechanisms to tackle cyber threats should be updated when users, possibly carrying devices with some kind of malware, move in highly dynamic mobile networks in order to continue providing the same detection and mitigation capabilities along user's path. This paper presents BotsOnFIRE, an experiment of the EU H2020 SoftFIRE project for the detection and mitigation of botnets in the SoftFIRE federated testbed for 5G within FIRE+, by combining Software‐Defined Networking (SDN) and Network Functions Virtualization (NFV) technologies. Bots' mobility is considered to trigger reconfiguration of security‐related SDN/NFV applications, when needed, so as to update security capabilities of the SoftFIRE infrastructure. The BotsOnFIRE experiment contributes to the wider 5G objective of more secure and resilient networks and services, where botnets are actually one of the most powerful cyber threats capable of orchestrating the remote execution of cyber‐attacks. Experiments confirm that BotsOnFIRE is feasible to conduct the expected detection and mitigation procedures in the SoftFIRE federated environment, being evaluated through some Key Performance Indicators.

show abstract

Applying NFV/SDN in mitigating DDoS attacks

Cited by 20 publications

References 12 publications

SDN/NFV security framework for fog‐to‐things computing infrastructure

SDN/NFV security framework for fog‐to‐things computing infrastructure

Preemptive modelling towards classifying vulnerability of DDoS attack in SDN environment

Mitigation of cyber threats: Protection mechanisms in federated SDN/NFV infrastructures for 5G within FIRE+

Contact Info

Product

Resources

About