List of Titles

Security in software-defined networking : threats and countermeasures

- Shu, Zhaogang, Wan, Jiafu, Li, Di, Lin, Jiaxiang, Vasilakos, Athanasios, Imran, Muhammad

Authors: Shu, Zhaogang , Wan, Jiafu , Li, Di , Lin, Jiaxiang , Vasilakos, Athanasios , Imran, Muhammad
Date: 2016
Type: Text , Journal article
Relation: Mobile Networks and Applications Vol. 21, no. 5 (2016), p. 764-776
Full Text: false
Reviewed:
Description: In recent years, Software-Defined Networking (SDN) has been a focus of research. As a promising network architecture, SDN will possibly replace traditional networking, as it brings promising opportunities for network management in terms of simplicity, programmability, and elasticity. While many efforts are currently being made to standardize this emerging paradigm, careful attention needs to be also paid to security at this early design stage. This paper focuses on the security aspects of SDN. We begin by discussing characteristics and standards of SDN. On the basis of these, we discuss the security features as a whole and then analyze the security threats and countermeasures in detail from three aspects, based on which part of the SDN paradigm they target, i.e., the data forwarding layer, the control layer and the application layer. Countermeasure techniques that could be used to prevent, mitigate, or recover from some of such attacks are also described, while the threats encountered when developing these defensive mechanisms are highlighted. © 2016, Springer Science+Business Media New York.

Quick View

Defending SDN against packet injection attacks using deep learning

- Phu, Anh, Li, Bo, Ullah, Faheem, Ul Huque, Tanvir, Naha, Ranesh, Babar, Muhammad, Nguyen, Hung

Authors: Phu, Anh , Li, Bo , Ullah, Faheem , Ul Huque, Tanvir , Naha, Ranesh , Babar, Muhammad , Nguyen, Hung
Date: 2023
Type: Text , Journal article
Relation: Computer Networks Vol. 234, no. (2023), p.
Full Text:
Reviewed:
Description: The (logically) centralized architecture of software-defined networks makes them an easy target for packet injection attacks. In these attacks, the attacker injects malicious packets into the SDN network to affect the services and performance of the SDN controller and overflows the capacity of the SDN switches. Such attacks have been shown to ultimately stop the network functioning in real-time, leading to network breakdowns. There have been significant works on detecting and defending against similar DoS attacks in non-SDN networks, but detection and protection techniques for SDN against packet injection attacks are still in their infancy. Furthermore, many of the proposed solutions have been shown to be easily bypassed by simple modifications to the attacking packets or by altering the attacking profile. In this paper, we develop novel Graph Convolutional Neural Network models and algorithms for grouping network nodes/users into security classes by learning from network data. We start with two simple classes — nodes that engage in suspicious packet injection attacks and nodes that are not. From these classes, we then partition the network into separate segments with different security policies using distributed Ryu controllers in an SDN network. We show in experiments on an emulated SDN that our detection solution outperforms alternative approaches with above 99% detection accuracy for various types (both old and new) of injection attacks. More importantly, our mitigation solution maintains continuous functions of non-compromised nodes while isolating compromised/suspicious nodes in real-time. All code and data are publicly available for the reproducibility of our results. © 2023 The Author(s)

Complementing IoT services through software defined networking and edge computing : a comprehensive survey

- Rafique, Wajid, Qi, Lianyong, Yaqoob, Ibrar, Imran, Muhammad, Rasool, Raojan, Dou, Wanchun

Authors: Rafique, Wajid , Qi, Lianyong , Yaqoob, Ibrar , Imran, Muhammad , Rasool, Raojan , Dou, Wanchun
Date: 2020
Type: Text , Journal article
Relation: IEEE Communications Surveys and Tutorials Vol. 22, no. 3 (2020), p. 1761-1804
Full Text: false
Reviewed:
Description: Millions of sensors continuously produce and transmit data to control real-world infrastructures using complex networks in the Internet of Things (IoT). However, IoT devices are limited in computational power, including storage, processing, and communication resources, to effectively perform compute-intensive tasks locally. Edge computing resolves the resource limitation problems by bringing computation closer to the edge of IoT devices. Providing distributed edge nodes across the network reduces the stress of centralized computation and overcomes latency challenges in the IoT. Therefore, edge computing presents low-cost solutions for compute-intensive tasks. Software-Defined Networking (SDN) enables effective network management by presenting a global perspective of the network. While SDN was not explicitly developed for IoT challenges, it can, however, provide impetus to solve the complexity issues and help in efficient IoT service orchestration. The current IoT paradigm of massive data generation, complex infrastructures, security vulnerabilities, and requirements from the newly developed technologies make IoT realization a challenging issue. In this research, we provide an extensive survey on SDN and the edge computing ecosystem to solve the challenge of complex IoT management. We present the latest research on Software-Defined Internet of Things orchestration using Edge (SDIoT-Edge) and highlight key requirements and standardization efforts in integrating these diverse architectures. An extensive discussion on different case studies using SDIoT-Edge computing is presented to envision the underlying concept. Furthermore, we classify state-of-the-art research in the SDIoT-Edge ecosystem based on multiple performance parameters. We comprehensively present security and privacy vulnerabilities in the SDIoT-Edge computing and provide detailed taxonomies of multiple attack possibilities in this paradigm. We highlight the lessons learned based on our findings at the end of each section. Finally, we discuss critical insights toward current research issues, challenges, and further research directions to efficiently provide IoT services in the SDIoT-Edge paradigm. © 1998-2012 IEEE.

Quick View

Flow-aware elephant flow detection for software-defined networks

- Hamdan, Mosab, Mohammed, Bushra, Humayun, Usman, Abdelaziz, Ahmed, Khan, Suleman, Ali, Muhammad, Imran, Muhammad, Marsono, Muhammad

Authors: Hamdan, Mosab , Mohammed, Bushra , Humayun, Usman , Abdelaziz, Ahmed , Khan, Suleman , Ali, Muhammad , Imran, Muhammad , Marsono, Muhammad
Date: 2020
Type: Text , Journal article
Relation: IEEE Access Vol. 8, no. (2020), p. 72585-72597
Full Text:
Reviewed:
Description: Software-defined networking (SDN) separates the network control plane from the packet forwarding plane, which provides comprehensive network-state visibility for better network management and resilience. Traffic classification, particularly for elephant flow detection, can lead to improved flow control and resource provisioning in SDN networks. Existing elephant flow detection techniques use pre-set thresholds that cannot scale with the changes in the traffic concept and distribution. This paper proposes a flow-aware elephant flow detection applied to SDN. The proposed technique employs two classifiers, each respectively on SDN switches and controller, to achieve accurate elephant flow detection efficiently. Moreover, this technique allows sharing the elephant flow classification tasks between the controller and switches. Hence, most mice flows can be filtered in the switches, thus avoiding the need to send large numbers of classification requests and signaling messages to the controller. Experimental findings reveal that the proposed technique outperforms contemporary methods in terms of the running time, accuracy, F-measure, and recall. © 2013 IEEE.

A comprehensive survey of security threats and their mitigation techniques for next‐generation SDN controllers

- Han, Tao, Jan, Syed, Tan, Zhiyuan, Usman, Muhammad, Jan, Mian, Khan, Rahim, Xu, Yongzhao

Authors: Han, Tao , Jan, Syed , Tan, Zhiyuan , Usman, Muhammad , Jan, Mian , Khan, Rahim , Xu, Yongzhao
Date: 2020
Type: Text , Journal article
Relation: Concurrency and computation Vol. 32, no. 16 (2020), p. n/a
Full Text: false
Reviewed:
Description: Summary Software Defined Network (SDN) and Network Virtualization (NV) are emerged paradigms that simplified the control and management of the next generation networks, most importantly, Internet of Things (IoT), Cloud Computing, and Cyber‐Physical Systems. The Internet of Things (IoT) includes a diverse range of a vast collection of heterogeneous devices that require interoperable communication, scalable platforms, and security provisioning. Security provisioning to an SDN‐based IoT network poses a real security challenge leading to various serious security threats due to the connection of various heterogeneous devices having a wide range of access protocols. Furthermore, the logical centralized controlled intelligence of the SDN architecture represents a plethora of security challenges due to its single point of failure. It may throw the entire network into chaos and thus expose it to various known and unknown security threats and attacks. Security of SDN controlled IoT environment is still in infancy and thus remains the prime research agenda for both the industry and academia. This paper comprehensively reviews the current state‐of‐the‐art security threats, vulnerabilities, and issues at the control plane. Moreover, this paper contributes by presenting a detailed classification of various security attacks on the control layer. A comprehensive state‐of‐the‐art review of the latest mitigation techniques for various security breaches is also presented. Finally, this paper presents future research directions and challenges for further investigation down the line.

Showing items 1 - 5 of 5