Improving Scanner Data Collection in P4-based SDN

Cai, Yun-Zhan; Lai, Chih-Hao; Wang, Yuting; Tsai, Meng-Hsun

doi:10.23919/apnoms50412.2020.9237047

Cited by 6 publications

(5 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Inside the loop, the hash computation, judgment, and setting are performed in O(1) (lines 5-20). The final judgment on the flag is O(1) (lines [22][23][24]. Therefore, the time complexity of Algorithm 1 is O(k).…”

Section: Add To a Slotmentioning

confidence: 99%

“…Three servers are set up to implement load balancing in the experiment, and the topology is simulated in Mininet [21]. The software switch uses behavioral model version 2 (bmv2) [22,23], which can be compiled for P4. We use curl [24] to establish normal client connections and hping3 [25] for the attackers to perform SYN flooding attacks.…”

Section: Simulation Environmentmentioning

confidence: 99%

See 1 more Smart Citation

Detection and Mitigation of SYN Flooding Attacks through SYN/ACK Packets and Black/White Lists

Yang

Lee

et al. 2023

Sensors

Self Cite

View full text Add to dashboard Cite

Software-defined networking (SDN) is a new network architecture that provides programmable networks, more efficient network management, and centralized control than traditional networks. The TCP SYN flooding attack is one of the most aggressive network attacks that can seriously degrade network performance. This paper proposes detection and mitigation modules against SYN flooding attacks in SDN. We combine those modules, which have evolved from the cuckoo hashing method and innovative whitelist, to get better performance compared to current methods Our approach reduces the traffic through the switch and improves detection accuracy, also the required register size is reduced by half for the same accuracy.

show abstract

Section: Add To a Slotmentioning

confidence: 99%

Section: Simulation Environmentmentioning

confidence: 99%

Detection and Mitigation of SYN Flooding Attacks through SYN/ACK Packets and Black/White Lists

Yang

Lee

et al. 2023

Sensors

Self Cite

View full text Add to dashboard Cite

show abstract

“…To strike a balance between the discriminatory power of data and storage utilization, we proposed the 0R method in the previous work. 13 If a packet is a request, the sender then occupies the slot in 0R just like the sampling method. However, the switch will release the slot when the slot value is reduced to zero after receiving responses.…”

Section: -Replacementmentioning

confidence: 99%

“…In this paper, we design a method named E‐Replacement (ER), which is an enhanced version of 0‐Replacement (0R) we proposed in our previous work 13 . Same as 0‐Replacement, ER is designed for detecting port scanning over the TCP protocol.…”

Section: Introductionmentioning

confidence: 99%

“…In this paper, we design a method named E-Replacement (ER), which is an enhanced version of 0-Replacement (0R) we proposed in our previous work. 13 Same as 0-Replacement, ER is designed for detecting port scanning over the TCP protocol. Protocols other than TCP such as UDP are not discussed in this paper since most remote access services like telnet or ssh are based on TCP nowadays.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

E‐Replacement: Efficient scanner data collection method in P4‐based software‐defined networks

et al. 2021

View full text Add to dashboard Cite

Internet of things (IoT) botnets such as Mirai are rampant in the past years. Port scanning is a well-known behavior of botnets for searching targets in networks. To detect port scanning, a detector requires network statistics with high discriminatory power. In P4-based software-defined network (SDN), switches take charge of recording characteristics about scanning behaviors, and controllers pull the statistics from the switches periodically for anomaly detection. Given storage resources in switches are limited, we proposed a scanner data collection method, 0-Replacement, in P4-based SDN to efficiently collect scanner data and improve the detection rate. 0-Replacement, however, does not consider performance degradation caused by the hash collision. In this paper, we combine the conception of Hashpipe with 0-Replacement and propose a new scanner data collection method named E-Replacement. By leveraging the conception of Hashpipe, E-Replacement can mitigate the performance degradation caused by the hash collision. Through simulations, weshow that E-Replacement improves the detection rate by up to 6.73% and 210.82% compared to 0-Replacement and the traditional sample and hold method, respectively. Besides, E-Replacement improves the precision by around 528.2% compared to the count-min sketch and k-ary sketch methods. The memory usage in E-Replacement is the same as 0-Replacement. In simulations, E-Replacement can detect around 93.4% of scanners in a class B network with only 4.02-Mb SRAM. After implementing E-Replacement on a software P4 switch, BMv2, we observe the extra forwarding latency for E-Replacement is not greater than a millisecond.

show abstract

A survey on data plane programming with P4: Fundamentals, advances, and applied research

Hauser

Häberle

Merling

et al. 2023

Journal of Network and Computer Applications

View full text Add to dashboard Cite

Improving Scanner Data Collection in P4-based SDN

Cited by 6 publications

References 14 publications

Detection and Mitigation of SYN Flooding Attacks through SYN/ACK Packets and Black/White Lists

Detection and Mitigation of SYN Flooding Attacks through SYN/ACK Packets and Black/White Lists

E‐Replacement: Efficient scanner data collection method in P4‐based software‐defined networks

A survey on data plane programming with P4: Fundamentals, advances, and applied research

Contact Info

Product

Resources

About