Cyberpulse: A Machine Learning Based Link Flooding Attack Mitigation System for Software Defined Networks

Abstract

Software-defined networking (SDN) offers a novel paradigm for effective network management by decoupling the control plane from the data plane thereby allowing a high level of manageability and programmability. However, the notion of a centralized controller becomes a bottleneck by opening up a host of vulnerabilities to various types of attacks. One of the most harmful, stealthy, and easy to launch attacks against networked systems is the link flooding attack (LFA). In this paper, we demonstrate the vulnerability of the SDN control layer to LFA and how the attack strategy differs when targeting traditional networks which primarily involves attacking the links directly. In LFA, the attacker employs bots to surreptitiously send low rate legitimate traffic on the control channel which ultimately results in disconnecting control plane from the data plane. Mitigating LFA on the control channel remains a challenge in the network security paradigm with the use of network traffic filtering only. To address this challenge, we propose CyberPulse, a novel effective countermeasure, underpinning a machine learning-based classifier to alleviate LFA in SDN. CyberPulse performs network surveillance by classifying network traffic using deep learning techniques and is implemented as an extension module in the Floodlight controller. CyberPulse was evaluated for its accuracy, false positive rate, and effectiveness as compared to competing approaches on realistic networks generated using Mininet. The results show that CyberPulse can classify malicious flows with high accuracy and mitigate them effectively. INDEX TERMS Link flooding attacks, SDN security, OpenFlow, deep learning.

InSDN: A Novel SDN Intrusion Dataset

“…As a result, the normal delivery of packets will be interrupted. • Link Flooding Attack (LFA) [63], [64]…”

A Spatiotemporal-Oriented Deep Ensemble Learning Model to Defend Link Flooding Attacks in IoT Network

“…In tradition, detecting LFA can be classified into two types mentioned above. There are two studies that use deep learning methods to detect LFA [ 11 , 12 ]. There are normal traffic and anomalous traffic when the attack happens, so this category of deep learning method classifies two types of traffic by artificial neural networks.…”

“…On the other hand, in [ 9 , 10 ] the authors attempt to monitor the traceroute packets, which are launched by the attacker to acquire the topology and attacks on target links. The second LFA defending step is to mitigate LFA by rerouting traffic [ 1 , 10 ] or blocking malicious traffic [ 4 , 5 , 8 , 11 , 12 , 13 ] in order to deter the attack, to relieve the harm, and to recover the attacked network to a normal status. The traffic rerouting methods reroute flows that originally travel through the target links to relieve their congestions.…”

“…To overcome the changing attack characteristics of LFA, numerous artificial intelligence (AI) methodologies [ 11 , 12 , 14 , 15 , 16 , 17 , 18 , 19 , 20 , 21 , 22 , 23 , 24 , 25 ] are introduced to defend against LFA through end-to-end functionality (Input: network status; Output: defending action) without any manual intervention [ 26 , 27 , 28 , 29 , 30 ]. The AI-based methodologies, therefore, reduce the inefficient labor cost, subjective judgment, and self-learning regarding the changing attack characteristics of LFA in a timely manner.…”

Open source software security vulnerability detection based on dynamic behavior features

“…Open source software has also brought amazing changes to the software industry with its openness and flexibility. However, with the open source software developing rapidly, it also brings us huge security problems [1–4]. From the beginning of 2015 to the beginning of 2017, the 360 security team selected 2228 open source projects from GitHub, Source forge and other open source communities for testing.…”