An adaptive approach to network resilience: Evolving challenge detection and mitigation

Abstract

It is widely agreed that computer networks need to become more resilient to a range of challenges that can seriously impact their normal operation. Challenges include malicious attacks, misconfigurations, accidental faults and operational overloads. As part of an overall strategy for network resilience, a crucial requirement is the identification of challenges in real-time, followed by the application of appropriate remedial action. In this paper, we motivate and describe a novel solution that enables the progressive multi-stage deployment of resilience strategies, based on incomplete challenge and context information.Policies are used to orchestrate the interactions between various resilience mechanisms, which incrementally identify the nature of a challenge and deploy appropriate remediation mechanisms. We demonstrate the benefits of this approach via simulation of a resource starvation attack on an Internet Service Provider infrastructure. By initially using lightweight detection and then progressively applying more heavyweight analysis, a key contribution of our work is the ability to mitigate a challenge as early as possible and rapidly detect its root cause. The approach we propose in this paper has the flexibility, reproducibility and extensibility needed to assist in the identification and remediation of various network challenges in the future.

Management patterns: SDN-enabled network resilience management

“…Despite the multitude of mechanisms and techniques available, it is often not clear how these should be combined and coordinated in complex multi-service networks. We found that the published state-of-the-art in challenge detection and classification varies in the resources that are required, the timeliness and accuracy of their operation, and the challenges they can effectively operate with [12]. For example, localised detection in fluctuations of traffic volumes can give a rapid and relatively lightweight indication of the onset of challenges, such as DDoS attacks or flash crowd events, whereas a sophisticated classification system can yield more accurate information about the challenge, e.g., the identification of malicious flows, over a longer period of time.…”

Visual Analytics Model for Intrusion Detection in Flood Attack

“…The legitimate network traffics have the regular packet sizes from regular IP addresses on regular flow rates so that the entropy values are concentrated. The burst value of entropy represents the abnormal change of network traffics that leads detection of DDoS attack whenever it occurred [3] [4].…”

Towards policy refinement for resilience management in cloud

“…As shown in previous work [5], [6], [7] it is possible to adopt the behaviour of a system without the need to re-design and develop any of the functionality, and changes can be applied without the need to bring system to halt which is crucial for critical service point of view. However, there is still need to apply basic of policy refinement principals for autonomic management in cloud computing.…”