-
Destination-aware Adaptive Traffic Flow Rule Aggregation in Software-Defined Networks
Authors:
Trung V. Phan,
Mehrdad Hajizadeh,
Nguyen Tuan Khai,
Thomas Bauschert
Abstract:
In this paper, we propose a destination-aware adaptive traffic flow rule aggregation (DATA) mechanism for facilitating traffic flow monitoring in SDN-based networks. This method adapts the number of flow table entries in SDN switches according to the level of detail of traffic flow information that other mechanisms (e.g. for traffic engineering, traffic monitoring, intrusion detection) require. It…
▽ More
In this paper, we propose a destination-aware adaptive traffic flow rule aggregation (DATA) mechanism for facilitating traffic flow monitoring in SDN-based networks. This method adapts the number of flow table entries in SDN switches according to the level of detail of traffic flow information that other mechanisms (e.g. for traffic engineering, traffic monitoring, intrusion detection) require. It also prevents performance degradation of the SDN switches by keeping the number of flow table entries well below a critical level. This level is not preset as a hard threshold but learned during operation by using a machine-learning based algorithm. The DATA method is implemented within a RESTful application (DATA App) which monitors and analyzes the ongoing network traffic and provides instructions to the SDN controller to adapt the traffic flow matching strategies accordingly. A thorough performance evaluation of DATA is conducted in an SDN emulation environment. The results show that---compared to the default behavior of common SDN controllers---the proposed DATA approach yields significant SDN switch performance improvements while still providing detailed traffic flow information on demand.
△ Less
Submitted 7 September, 2019;
originally announced September 2019.
-
Q-DATA: Enhanced Traffic Flow Monitoring in Software-Defined Networks applying Q-learning
Authors:
Trung V. Phan,
Syed Tasnimul Islam,
Tri Gia Nguyen,
Thomas Bauschert
Abstract:
Software-Defined Networking (SDN) introduces a centralized network control and management by separating the data plane from the control plane which facilitates traffic flow monitoring, security analysis and policy formulation. However, it is challenging to choose a proper degree of traffic flow handling granularity while proactively protecting forwarding devices from getting overloaded. In this pa…
▽ More
Software-Defined Networking (SDN) introduces a centralized network control and management by separating the data plane from the control plane which facilitates traffic flow monitoring, security analysis and policy formulation. However, it is challenging to choose a proper degree of traffic flow handling granularity while proactively protecting forwarding devices from getting overloaded. In this paper, we propose a novel traffic flow matching control framework called Q-DATA that applies reinforcement learning in order to enhance the traffic flow monitoring performance in SDN based networks and prevent traffic forwarding performance degradation. We first describe and analyse an SDN-based traffic flow matching control system that applies a reinforcement learning approach based on Q-learning algorithm in order to maximize the traffic flow granularity. It also considers the forwarding performance status of the SDN switches derived from a Support Vector Machine based algorithm. Next, we outline the Q-DATA framework that incorporates the optimal traffic flow matching policy derived from the traffic flow matching control system to efficiently provide the most detailed traffic flow information that other mechanisms require. Our novel approach is realized as a REST SDN application and evaluated in an SDN environment. Through comprehensive experiments, the results show that---compared to the default behavior of common SDN controllers and to our previous DATA mechanism---the new Q-DATA framework yields a remarkable improvement in terms of traffic forwarding performance degradation protection of SDN switches while still providing the most detailed traffic flow information on demand.
△ Less
Submitted 3 September, 2019;
originally announced September 2019.
-
Q-MIND: Defeating Stealthy DoS Attacks in SDN with a Machine-learning based Defense Framework
Authors:
Trung V. Phan,
T M Rayhan Gias,
Syed Tasnimul Islam,
Truong Thu Huong,
Nguyen Huu Thanh,
Thomas Bauschert
Abstract:
Software Defined Networking (SDN) enables flexible and scalable network control and management. However, it also introduces new vulnerabilities that can be exploited by attackers. In particular, low-rate and slow or stealthy Denial-of-Service (DoS) attacks are recently attracting attention from researchers because of their detection challenges. In this paper, we propose a novel machine learning ba…
▽ More
Software Defined Networking (SDN) enables flexible and scalable network control and management. However, it also introduces new vulnerabilities that can be exploited by attackers. In particular, low-rate and slow or stealthy Denial-of-Service (DoS) attacks are recently attracting attention from researchers because of their detection challenges. In this paper, we propose a novel machine learning based defense framework named Q-MIND, to effectively detect and mitigate stealthy DoS attacks in SDN-based networks. We first analyze the adversary model of stealthy DoS attacks, the related vulnerabilities in SDN-based networks and the key characteristics of stealthy DoS attacks. Next, we describe and analyze an anomaly detection system that uses a Reinforcement Learning-based approach based on Q-Learning in order to maximize its detection performance. Finally, we outline the complete Q-MIND defense framework that incorporates the optimal policy derived from the Q-Learning agent to efficiently defeat stealthy DoS attacks in SDN-based networks. An extensive comparison of the Q-MIND framework and currently existing methods shows that significant improvements in attack detection and mitigation performance are obtained by Q-MIND.
△ Less
Submitted 3 September, 2019; v1 submitted 27 July, 2019;
originally announced July 2019.
-
Securing Heterogeneous IoT with Intelligent DDoS Attack Behavior Learning
Authors:
Nhu-Ngoc Dao,
Trung V. Phan,
Umar Sa ad,
Joongheon Kim,
Thomas Bauschert,
Sungrae Cho
Abstract:
The rapid increase of diverse Internet of things (IoT) services and devices has raised numerous challenges in terms of connectivity, computation, and security, which networks must face in order to provide satisfactory support. This has led to networks evolving into heterogeneous IoT networking infrastructures characterized by multiple access technologies and mobile edge computing (MEC) capabilitie…
▽ More
The rapid increase of diverse Internet of things (IoT) services and devices has raised numerous challenges in terms of connectivity, computation, and security, which networks must face in order to provide satisfactory support. This has led to networks evolving into heterogeneous IoT networking infrastructures characterized by multiple access technologies and mobile edge computing (MEC) capabilities. The heterogeneity of the networks, devices, and services introduces serious vulnerabilities to security attacks, especially distributed denial-of-service (DDoS) attacks, which exploit massive IoT devices to exhaust both network and victim resources. As such, this study proposes MECshield, a localized DDoS prevention framework leveraging MEC power to deploy multiple smart filters at the edge of relevant attack-source/destination networks. The cooperation among the smart filters is supervised by a central controller. The central controller localizes each smart filter by feeding appropriate training parameters into its self-organizing map (SOM) component, based on the attacking behavior. The performance of the MECshield framework is verified using three typical IoT traffic scenarios. The numerical results reveal that MECshield outperforms existing solutions.
△ Less
Submitted 7 August, 2019; v1 submitted 16 November, 2017;
originally announced November 2017.
