EarlyDrop: A Trade-off Driven DDoS Defense Mechanism for Software-Defined Infrastructures

Bauer, Robert; Heseding, Hauke; Flittner, Matthias

doi:10.1109/lcn.2017.71

Cited by 2 publications

(5 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…What sets them apart is how they extract information from the flow inputs to detect DDoS attacks and how they act on the network to mitigate these attacks. Among these works, some have been providing solutions that identify anomalies in the network in order to detect different types of DDoS attacks 58,61,84,88,90,92,107,109,128,139,146,147,150,152,154,155 . Such solutions often use statistical analysis, machine learning algorithms, or trust in external applications such as Bro Security Monitor 98 .…”

Section: Solutions Focused On the Control Planementioning

confidence: 99%

“…In Wang et al., 83 after the SDN controller determines that Link Flooding Attacks (LFA) must be launched, the mitigation begins, and the Woodpecker (external tool) takes action. Bauer et al 88 . propose the use of an external monitoring VNF, denoted EarlyDrop, that can be used as a transparent service function within a service chain.…”

Section: Solutions Focused On the Control Planementioning

confidence: 99%

“…87,110,135 Huang et al 94 provide a security gateway that analyzes the traffic received by the switches. In Bauer et al, 88 a monitoring Virtual Network Function (VNF) is designed to be used as a transparent service function within a service chain. In Orosz et al, 122 the solution is located in the center of the network to monitor all malicious flows, in order to mitigate the attacks promptly.…”

Section: Deployment Locationmentioning

confidence: 99%

“…58 In Wang et al, 83 after the SDN controller determines that Link Flooding Attacks (LFA) must be launched, the mitigation begins, and the Woodpecker (external tool) takes action. Bauer et al 88 propose the use of an external monitoring VNF, denoted EarlyDrop, that can be used as a transparent service function within a service chain. SDNFV-based DDoS defense architecture 154 is a solution that virtualizes network functions for reducing the load of an SDN controller and the system cost in the event of DDoS attacks.…”

Section: Cooperation Degreementioning

confidence: 99%

“…Among these works, some have been providing solutions that identify anomalies in the network in order to detect different types of DDoS attacks. 58,61,84,88,90,92,107,109,128,139,146,147,150,152,154,155 Such solutions often use statistical analysis, machine learning algorithms, or trust in external applications such as Bro Security Monitor. 98 In this context, Braga et al 49 provide a solution that uses Self-Organization Maps (SOM) to classify network traffic flows as normal and abnormal, based on flow statistics as parameters for the calculation of SOM.…”

Section: Activity Levelmentioning

confidence: 99%

See 4 more Smart Citations

A systematic review on distributed denial of service attack defense mechanisms in programmable networks

Dalmazo¹,

Marques

Costa

et al. 2021

Int J Network Mgmt

View full text Add to dashboard Cite

Summary Design flaws and vulnerabilities inherent to network protocols, devices, and services make Distributed Denial of Service (DDoS) a persisting threat in the cyberspace, despite decades of research efforts in the area. The historical vertical integration of traditional IP networks limited the solution space, forcing researchers to tweak network protocols while maintaining global compatibility and proper service to legitimate flows. The advent of Software‐Defined Networking (SDN) and advances in Programmable Data Planes (PDP) changed the state of affairs and brought novel possibilities to deal with such attacks. In summary, the ability of bringing together network intelligence to a control plane, and offloading flow processing tasks to the forwarding plane, opened up interesting opportunities for network security researchers unlike ever. In this article, we dive into recent research that relies on SDN and PDP to detect, mitigate, and prevent DDoS attacks. Our literature review takes into account the SDN layered view as defined in RFC7426 and focuses on the data, control, and application planes. We follow a systematic methodology to capture related articles and organize them into a taxonomy of DDoS defense mechanisms focusing on three facets: activity level, deployment location, and cooperation degree. From the analysis of existing work, we also highlight key research gaps that may foster future research in the field.

show abstract

Section: Solutions Focused On the Control Planementioning

confidence: 99%

Section: Solutions Focused On the Control Planementioning

confidence: 99%