Building situational awareness for network threats in fog/edge computing: Emerging paradigms beyond the security perimeter model

Rapuzzi, Riccardo; Repetto, Matteo

doi:10.1016/j.future.2018.04.007

Cited by 61 publications

(35 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A comprehensive review of major security challenges for IoT, fog computing architecture and corresponding solutions in the IoT layered architecture is presented by Khan and Salah and Zhang et al Morabito et al proposed a lightweight gateway mechanism called “LegoIT” at the Edge/IoT networks and demonstrated security applications. Rapuzzi and Repetto articulated methods to build defense mechanisms with “situational awareness” for fog computing infrastructures. Flauzac et al proposed enabling SDN to secure the fog computing infrastructure.…”

Section: Related Workmentioning

confidence: 99%

SDN/NFV security framework for fog‐to‐things computing infrastructure

2019

View full text Add to dashboard Cite

Summary Currently, core networking architectures are facing disruptive developments, due to emergence of paradigms such as Software‐Defined‐Networking (SDN) for control, Network Function Virtualization (NFV) for services, and so on. These are the key enabling technologies for future applications in 5G and locality‐based Internet of things (IoT)/wireless sensor network services. The proliferation of IoT devices at the Edge networks is driving the growth of all‐connected world of Internet traffic. In the Cloud‐to‐Things continuum, processing of information and data at the Edge mandates development of security best practices to arise within a fog computing environment. Service providers are transforming their business using NFV‐based services and SDN‐enabled networks. The SDN paradigm offers an easily programmable model, global view, and control for modern networks, which demand faster response to security incidents and dynamically enforce countermeasures to intrusions and cyberattacks. This article proposes an autonomic multilayer security framework called Distributed Threat Analytics and Response System (DTARS) for a converged architecture of Fog/Edge computing and SDN infrastructures, for emerging applications in IoT and 5G networks. The major detection scheme is deployed within the data plane, consisting of a coarse‐grained behavioral, anti‐spoofing, flow monitoring and fine‐grained traffic multi‐feature entropy‐based algorithms. We developed exemplary defense applications under DTARS framework, on a malware testbed imitating the real‐life DDoS/botnets such as Mirai. The experiments and analysis show that DTARS is capable of detecting attacks in real‐time with accuracy more than 95% under attack intensities up to 50 000 packets/s. The benign traffic forwarding rate remains unaffected with DTARS, while it drops down to 65% with traditional NIDS for advanced DDoS attacks. Further, DTARS achieves this performance without incurring additional latency due to data plane overhead.

show abstract

Section: Related Workmentioning

confidence: 99%

SDN/NFV security framework for fog‐to‐things computing infrastructure

2019

View full text Add to dashboard Cite

show abstract

“…Third, their application in multi-and cross-cloud environments is not straightforward, since their configuration is based on internal communication mechanisms for each infrastructure. This issue will be even more severe in cyber-physical systems [2], with the integration of smart things in cloud applications, which are expected to be a consistent use case for 5G.…”

Section: Beyond the Security Perimeter Modelmentioning

confidence: 99%

Situational Awareness in Virtual Networks: The ASTRID Approach

Carrega

Repetto

Risso

et al. 2018

2018 IEEE 7th International Conference on Cloud Networking (CloudNet)

Self Cite

View full text Add to dashboard Cite

Cloud-based services often follow the same logical structure of private networks. The lack of physical boundaries and the dependence on third party's infrastructural security mechanisms often undermine the confidence in the overall security level of virtualized applications. Integrating software instances of common security middleboxes into cloud networks helps overcome most suspicions, but leads to inefficient solutions.In this paper, we describe the vision behind the ASTRID project. The novelty of our concept lies in decoupling detection algorithms from monitoring and inspection tasks, seeking better integration with virtualization frameworks. We briefly elaborate on the overall conceptual architecture and the foundation of its implementation components. Additionally, we give insights on the expected impacts and opportunities brought by this novel paradigm over the existing approaches.

show abstract

“…Virtualization and the cloud paradigm usually bring agility and cost-effectiveness in building and operating ICT services, but they pose a number of additional security concerns, when compared to current legacy deployments [1], [2].…”

Section: Introductionmentioning

confidence: 99%

“…limitations by combining fine-grained and precise information with efficient processing, elasticity with robustness, autonomy with interactivity [2]. In this respect, the transition from standalone security appliances to more cooperative models has already proven to improve the detection rate while decreasing the overhead on each terminal [6].…”

Section: Introductionmentioning

confidence: 99%

An abstraction layer for cybersecurity context

Bolla

Carrega²,

Repetto³

2019

2019 International Conference on Computing, Networking and Communications (ICNC)

Self Cite

View full text Add to dashboard Cite

The growing complexity and diversification of cyberattacks are largely reflected in the increasing sophistication of security appliances, which are often too cumbersome to be run in virtual services and IoT devices. Hence, the design of cyber-security frameworks is today looking at more cooperative models, which collect security-related data from a large set of heterogeneous sources for centralized analysis and correlation. In this paper, we outline a flexible abstraction layer for access to security context. It is conceived to program and gather data from lightweight inspection and enforcement hooks deployed in cloud applications and IoT devices. We also provide a preliminary description of its implementation, by reviewing the main software components and their role.

show abstract

Building situational awareness for network threats in fog/edge computing: Emerging paradigms beyond the security perimeter model

Cited by 61 publications

References 47 publications

SDN/NFV security framework for fog‐to‐things computing infrastructure

SDN/NFV security framework for fog‐to‐things computing infrastructure

Situational Awareness in Virtual Networks: The ASTRID Approach

An abstraction layer for cybersecurity context

Contact Info

Product

Resources

About