OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

Abstract

Distributed Denial of Service (DDoS) attacks are one of the biggest concerns for security professionals. Traditional middle-box based DDoS attack defense is lack of network-wide monitoring flexibility. With the development of software-defined networking (SDN), it becomes prevalent to exploit centralized controllers to defend against DDoS attacks. However, current solutions suffer with serious southbound communication overhead and detection delay. In this paper, we propose a cross-plane DDoS attack defense framework in SDN, called OverWatch, which exploits collaborative intelligence between data plane and control plane with high defense efficiency. Attack detection and reaction are two key procedures of the proposed framework. We develop a collaborative DDoS attack detection mechanism, which consists of a coarse-grained flow monitoring algorithm on the data plane and a finegrained machine learning based attack classification algorithm on the control plane. We propose a novel defense strategy offloading mechanism to dynamically deploy defense applications across the controller and switches, by which rapid attack reaction and accurate botnet location can be achieved. We conduct extensive experiments on a real-world SDN network. Experimental results validate the efficiency of our proposed OverWatch framework with high detection accuracy and real-time DDoS attack reaction, as well as reduced communication overhead on SDN southbound interface.

A new framework to alleviate DDoS vulnerabilities in cloud computing

“…The third stage is a recovery stage in which the methods are to implement in the victim server to serve its user or to recover from the attacks. Several methods including migration [23] and backup resources [24] are suggested by a few researchers. But at this stage, implementation of any method leads to an overhead of reserved resources and costs to the victim server.…”

SDN/NFV security framework for fog‐to‐things computing infrastructure

“…Reference improvement overwatch 13 Though their defense actuators are deployed in the data plane, their forwarding latency has higher latency compared to our datapath, due to optimization with DPDK and kernel memory mapped Netfilter model. Their primary attack classifier algorithm runs on the control plane only and hence prone to control plane saturation and overload.…”

“…On the other hand, being very suitable for the modern high‐bandwidth applications, SDN will increasingly replace conventional networking in the near future, and then it will rapidly become the main diffusion field for botnets. In recent years, there has been active research in SDN, NFV, and their applications for network security …”

“…In recent years, there has been active research in SDN, NFV, and their applications for network security. [7][8][9][10][11][12][13][14] In the SDN paradigm, due to the global view, DDoS attacks can be detected and defeated in early stages. However, existing approaches that build DDoS attack defense applications upon the SDN control plane are challenging to provide high defense performance.…”

NFVMon: Enabling Multioperator Flow Monitoring in 5G Mobile Edge Computing

“…An et al [24] propose a new scheme based on the analysis of the network status in the edge by gathering metrics to extract characteristics and security information of the fog computing infrastructure using Semisupervised Extreme Learning Machines (SS-ELM) algorithm. Hang et al [25] proposed a solution called Overwatch that provided a solution to Distributed Denial of Services (DDoS) attacks. Authors developed a collaborative DDoS attack detection mechanism, which consists in a flow monitoring algorithm on the data plane processing the coarse-grained flows and a fine-grained machine learning classification algorithm on the control plane.…”