CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure

Rafique, Wajid; He, Xin; Liu, Zifan; Sun, Yuhu; Dou, Wanchun

doi:10.1109/hpcc/smartcity/dss.2019.00080

Cited by 25 publications

(29 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Rafique et al [14] offered a plausible solution for Crossfire DDoS attack security utilizing SDN in IoT-Edge by executing a scenario. Floodlight SDN controller and Mininet have been deploying to create the CFADefense prototyping solution.…”

Section: A Sdn-based Crossfire Ddos Protection Techniquesmentioning

confidence: 99%

Towards Crossfire Distributed Denial of Service Attack Protection Using Intent-Based Moving Target Defense Over Software-Defined Networking

Hyder

Fatima

2021

IEEE Access

View full text Add to dashboard Cite

Crossfire is an indirect target area link-flooding Distributed Denial of Service (DDoS) attack determined to affect the neighbors of the real target. Currently, Crossfire DDoS attacks are acquiring impetus because of their indistinguishability and undetectability. SDN (Software Defined Networking) is a progressing technique because of its adaptability and programmability. Moving Target Defense (MTD) is an arising security strategy to counter the attacks by progressively changing the attacked plane. IBN (Intent-based Networking) is another promising methodology for providing dynamic network management. IBN-based MTD can provide efficient MTD solutions because of the concentrated control and observing capacities of the intents when translated into rules inside the SDN control plane. In this paper, a framework for the security of Crossfire DDoS attacks is proposed by making use of Intent-based Traffic modifications through Open Networking Operating System (ONOS) Rest API and Domain Name System (DNS) port redirection. In this paper, we exploited Intent-based MTD to divert the traffic from the principal host to the virtual shadow hosts to counter this attack. Traffic redirection helps in masquerading the attacker headed for shadow host and consequently getting the erroneous path towards network and hence, Crossfire attack couldn't be executed as expected. The proposed technique is simulated using Mininet and ONOS SDN controller. The outcomes showed traffic is successfully redirected at a low computational expense, therefore, Crossfire DDoS is efficiently mitigated as promising results are found.

show abstract

Section: A Sdn-based Crossfire Ddos Protection Techniquesmentioning

confidence: 99%

Towards Crossfire Distributed Denial of Service Attack Protection Using Intent-Based Moving Target Defense Over Software-Defined Networking

Hyder

Fatima

2021

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Rafique et al [74] put forward CFADefense, a mechanism for mitigating Crossfire DDoS attacks. The CFADefense architecture is implemented in three (3) modules: (i) Link Selection; (ii) Attack Detection; and (iii) Malicious Flow Interception.…”

Section: Collaboration Between Multiple Mitigation Strategiesmentioning

confidence: 99%

“…Bull et al [72] Xu et al [55] Salva-Garcia et al [40] & Molina Zarca et al [57] Rafique et al [61] Bawany and Shamsi [31] Yang et al [60] Rafique et al [74] Nair et al [65] Galeano-Brajones et al [68] Ravi and Shalinie [64] Rate limiting Sharma et al [69] Traceback Chen et al [45] Request prioritization Sarwar et al [71] Flow filtering MTD Sahay et al [73] Honeypots MTD Luo et al [75] Hybrid SDN-Fog…”

Section: Flow Filteringmentioning

confidence: 99%

“…Xu et al [55] Krishnan et al [63] Rafique et al [61] Sarwar et al [71] Rafique et al [74] Smart Homes Bhunia and Gurusamy [25] Sharma et al [69] IoT Data Centers Bawany and Shamsi [31] Industrial IoT Yan et al [42] Ship communication systems Sahay et al [73] Generic Bull et al [72] Özçelik et al [56] Yin et al [54] Krishnan et al [70] Salva-Garcia et al [40] & Molina Zarca et al [57] Nguyen et al [58] Rathore et al [59] Yang et al [60] Houda et al [66] Luo et al [75] Chen et al [45] Nair et al [65] Galeano-Brajones et al [68] Ravi and Shalinie [64] The techniques that rely on the analysis of network flow statistics to detect anomalous actions are efficient in containing volumetric attacks, which are based on high traffic rates [80]. Concerning this, there are solutions based on the following strategies: rate limiting, cosine similarity, traceback, and flow prioritization, as outlined in Table 5.…”

Section: Sdn Control Planementioning

confidence: 99%

“…The SDN control plane can itself become the target of DDoS attacks that are aimed at exploiting vulnerabilities in its components and make the underlying IoT applications unavailable. In this scenario, the studies carried out in [55,61,63,71,74] put forward mechanisms that are capable of mitigating DDoS attacks that target both the data plane and the SDN control plane.…”

Section: Sdn Control Planementioning

confidence: 99%

See 2 more Smart Citations

A Taxonomy of DDoS Attack Mitigation Approaches Featured by SDN Technologies in IoT Scenarios

Silva

Neto

et al. 2020

Sensors

View full text Add to dashboard Cite

The Internet of Things (IoT) has attracted much attention from the Information and Communication Technology (ICT) community in recent years. One of the main reasons for this is the availability of techniques provided by this paradigm, such as environmental monitoring employing user data and everyday objects. The facilities provided by the IoT infrastructure allow the development of a wide range of new business models and applications (e.g., smart homes, smart cities, or e-health). However, there are still concerns over the security measures which need to be addressed to ensure a suitable deployment. Distributed Denial of Service (DDoS) attacks are among the most severe virtual threats at present and occur prominently in this scenario, which can be mainly owed to their ease of execution. In light of this, several research studies have been conducted to find new strategies as well as improve existing techniques and solutions. The use of emerging technologies such as those based on the Software-Defined Networking (SDN) paradigm has proved to be a promising alternative as a means of mitigating DDoS attacks. However, the high granularity that characterizes the IoT scenarios and the wide range of techniques explored during the DDoS attacks make the task of finding and implementing new solutions quite challenging. This problem is exacerbated by the lack of benchmarks that can assist developers when designing new solutions for mitigating DDoS attacks for increasingly complex IoT scenarios. To fill this knowledge gap, in this study we carry out an in-depth investigation of the state-of-the-art and create a taxonomy that describes and characterizes existing solutions and highlights their main limitations. Our taxonomy provides a comprehensive view of the reasons for the deployment of the solutions, and the scenario in which they operate. The results of this study demonstrate the main benefits and drawbacks of each solution set when applied to specific scenarios by examining current trends and future perspectives, for example, the adoption of emerging technologies based on Cloud and Edge (or Fog) Computing.

show abstract

Developing smart city services using intent‐aware recommendation systems: A survey

Rafique

Hafid

Qadir

2023

Trans Emerging Tel Tech

Self Cite

View full text Add to dashboard Cite

Smart cities could be defined as urban areas that use Information and Communication Technology (ICT) to solve city problems in efficient and sustainable ways. Intent-aware Recommender Systems (IARS) within ICT play a crucial role in filtering useless information according to user demands and assist in decision-making in various smart city platforms. In smart cities, the user traces on IoT, RFIDs, mobiles, and smart sensors capture actual user intent of performing an activity and enhance user satisfaction by proposing optimal services. This paper presents a detailed literature survey of the field of IARS and how it can be used for developing smart city services. First, we present the evolution of IARS with the development of computing technology. Then, we present case studies, synergies, advances, and a reference implementation architecture of IARS for smart cities. We discuss requirements for developing smart city services using IARS. Furthermore, we devise a comprehensive taxonomy of applications and techniques of IARS using different performance parameters. Finally, we elaborate on current issues, challenges, and future research directions in IARS; these directions we believe will pave the way for autonomous service provisioning in smart cities.

show abstract

CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure

Cited by 25 publications

References 27 publications

Towards Crossfire Distributed Denial of Service Attack Protection Using Intent-Based Moving Target Defense Over Software-Defined Networking

Towards Crossfire Distributed Denial of Service Attack Protection Using Intent-Based Moving Target Defense Over Software-Defined Networking

A Taxonomy of DDoS Attack Mitigation Approaches Featured by SDN Technologies in IoT Scenarios

Developing smart city services using intent‐aware recommendation systems: A survey

Contact Info

Product

Resources

About