An SDN-Enabled Proactive Defense Framework for DDoS Mitigation in IoT Networks

Zhou, Yuyang; Cheng, Guang; Yu, Shui

doi:10.1109/tifs.2021.3127009

Cited by 38 publications

(8 citation statements)

References 49 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this group we can find techniques that randomize IP addresses [8,9], ports [10], routes through which the network traffic flows [11] or the header of network packets [12,13]. There are also proposals that combine several shuffling-based MTD techniques [14,15]. Authors in [16] combine IP randomization, packet payload randomization and TCP port scan response adaptation to mitigate reconnaissance attacks.…”

Section: Moving Target Defense Techniquesmentioning

confidence: 99%

Low delay network attributes randomization to proactively mitigate reconnaissance attacks in industrial control systems

et al. 2023

View full text Add to dashboard Cite

Industrial Control Systems are used in a wide variety of industrial facilities, including critical infrastructures, becoming the main target of multiple security attacks. A malicious and successful attack against these infrastructures could cause serious economic and environmental consequences, including the loss of human lives. Static networks configurations and topologies, which characterize Industrial Control Systems, represent an advantage for attackers, allowing them to scan for vulnerable devices or services before carrying out the attack. Identifying active devices and services is often the first step for many attacks. This paper presents a proactive network reconnaissance defense mechanism based on the temporal randomization of network IP addresses, MAC addresses and port numbers. The obtained information distortion minimizes the knowledge acquired by the attackers, hindering any attack that relies on network addressing. The temporal randomization of network attributes is performed in an adaptive way, minimizing the overhead introduced in the network and avoiding any error and latency in communications. The implementation as well as the tests have been carried out in a laboratory with real industrial equipment, demonstrating the effectiveness of the presented solution.

show abstract

Section: Moving Target Defense Techniquesmentioning

confidence: 99%

Low delay network attributes randomization to proactively mitigate reconnaissance attacks in industrial control systems

et al. 2023

View full text Add to dashboard Cite

show abstract

“…The MTD strategy is modeled as a signaling game. Zhou et al [14] also proposed a signaling game for defending DDoS attacks in a cost-effective way. Game theory is also used by Zhou et al [15] and the MTD approach is modeled as a trilateral game.…”

Section: Related Workmentioning

confidence: 99%

SCEMA: An SDN-Oriented Cost-Effective Edge-Based MTD Approach

Javadpour

Ja’fari

Taleb

et al. 2023

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Protecting large-scale networks, especially Software-Defined Networks (SDNs), against distributed attacks in a costeffective manner plays a prominent role in cybersecurity. One of the pervasive approaches to plug security holes and prevent vulnerabilities from being exploited is Moving Target Defense (MTD), which can be efficiently implemented in SDN as it needs comprehensive and proactive network monitoring. The critical key in MTD is to shuffle the least number of hosts with an acceptable security impact and keep the shuffling frequency low. In this paper, we have proposed an SDN-oriented Cost-effective Edge-based MTD Approach (SCEMA) to mitigate Distributed Denial of Service (DDoS) attacks at a lower cost by shuffling an optimized set of hosts that have the highest number of connections to the critical servers. These connections are named edges from a graph-theoretical point of view. We have proposed a three-layer mathematical model for the network that can easily calculate the attack cost. We have also designed a system based on SCEMA and simulated it in Mininet. The results show that SCEMA has lower complexity than the previous related MTD field with acceptable performance.

show abstract

“…The authors in [88]- [90] consider using SDN architecture to reduce energy consumption in smart cities and industries. In [91] the authors, establish hybrid proactive defense mechanisms combining moving target defense techniques with cyber deception to spread camouflage information to confuse attackers. Based on these mechanisms, they introduce a defender-led signaling game model to formalize defense scenarios and depict the interactions between the defender and the attacker.…”

Section: E Other Issues In Privacy and Security Of Sdn-iotmentioning

confidence: 99%

Privacy-Preserving and Security in SDN-Based IoT: A Survey

et al. 2023

View full text Add to dashboard Cite

In recent years, the use of Software Defined Networking (SDN) has increased due to various network management requirements. Using SDN in computer network applications has brought several benefits to users, including lower operational costs, better hardware management, flexibility, and centralized network deployment. On the other hand, the Internet of Things (IoT) is another rapidly growing technology. Distributed and dynamic infrastructures are two critical characteristics of IoT. These characteristics lead to some challenges while using SDN in IoT in terms of security and privacy. In this paper, we address security and privacy issues and solutions for SDN-based IoT systems. We analyze the techniques used for defense in previous works to achieve an acceptable level of security and privacy protection in SDN-based IoT systems. In the data plane, SDN-based IoT papers have considered hashing and encryption techniques, in the control plane, certificate authority and access control have been analyzed, and in the application plane, attack detection, and authentication have been discussed. We also provide a statistical analysis of the existing work. This analysis shows that researchers have focused on certain areas more than others in recent years. The final analysis also highlights issues that previous researchers have ignored.

show abstract

An SDN-Enabled Proactive Defense Framework for DDoS Mitigation in IoT Networks

Cited by 38 publications

References 49 publications

Low delay network attributes randomization to proactively mitigate reconnaissance attacks in industrial control systems

Low delay network attributes randomization to proactively mitigate reconnaissance attacks in industrial control systems

SCEMA: An SDN-Oriented Cost-Effective Edge-Based MTD Approach

Privacy-Preserving and Security in SDN-Based IoT: A Survey

Contact Info

Product

Resources

About