IPro: An approach for intelligent SDN monitoring

Castillo, Edwin; Rendón, Óscar Mauricio Caicedo; Ordóñez, Armando; Granville, Lisandro Zambenedetti

doi:10.1016/j.comnet.2020.107108

Cited by 17 publications

(5 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Deng et al proposed a deep Q-network-based traffic monitoring framework to capture more short-life time flows without redundancy [14]. Castillo et al proposed IPro, an RL-based traffic monitoring architecture, which focuses on solving the problem of control plane overhead and extra CPU usage of the SDN controller [3]. Phan et al proposed DeepMatch, a flow matching framework to provide a fine-grained flow measurement in SDN using deep dueling neural networks [15].…”

Section: A Traffic Inspectionmentioning

confidence: 99%

“…Deep reinforcement learning (DRL), which combines reinforcement learning (RL) with deep neural networks, has a great potential in solving automated defense decision problems under time-varying environments where there is unknown future information. In recent years, DRL has been successfully adopted for network operation and management automation, such as routing optimization and resource allocation [1,2,3]. An intrusion detection system (IDS) is a well-known mechanism to defend against attacks by inspecting network traffic and providing alerts for detected attacks.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

DIVERGENCE: Deep Reinforcement Learning-Based Adaptive Traffic Inspection and Moving Target Defense Countermeasure Framework

Kim

Yoon

Cho

et al. 2022

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Reinforcement learning (RL) is a promising approach for intelligent agents to protect a given system under highly hostile environments. RL allows the agent to adaptively make sequential defense decisions based on the perceived current state of system security aiming to achieve the maximum defense performance in terms of fast, efficient, and automated detection, threat analysis, and response to the threat. In this paper, we propose a deep reinforcement learning (DRL)-based adaptive traffic inspection and moving target defense countermeasure framework, called 'DIVERGENCE,' for building a secure networked system. The DIVERGENCE provides two main security services: (1) a DRL-based network traffic inspection mechanism to achieve scalable and intensive network traffic visibility for rapid threat detection; and (2) an address shufflingbased moving target defense (MTD) technique to defend against threats as a proactive intrusion prevention mechanism. Through extensive simulations and experiments, we demonstrate that the DIVERGENCE successfully caught malicious traffic flows while significantly reducing the vulnerability of the network through MTD.

show abstract

Section: A Traffic Inspectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

DIVERGENCE: Deep Reinforcement Learning-Based Adaptive Traffic Inspection and Moving Target Defense Countermeasure Framework

Kim

Yoon

Cho

et al. 2022

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

show abstract

“…Deng et al proposed a deep Q-network (DQN)-based traffic sampling framework as a means to sample more shortlife time mice flows that have fewer than a certain number of packets without redundancy in mobile edge computing with SDN environment [20]. Castillo et al proposed IPro, a traffic monitoring architecture using RL, which focuses on the problem of control plane overheads and extra additional CPU usage of the SDN controller [21]. Phan et al proposed DeepGuard, a fine-grained flow monitoring for anomaly detection in SDN.…”

Section: A Traffic Samplingmentioning

confidence: 99%

Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined Networks

2021

View full text Add to dashboard Cite

Intrusion detection system (IDS) and deep packet inspection (DPI) are widely used to detect network attacks and anomalies, thereby enhancing cyber-security. Conventional traffic analyzers such as IDS have fixed locations and a limited capacity to perform DPI on large volumes of network traffic. Nowadays, software-defined networking (SDN) technology, which provides flexibility, elasticity, and programmability by decoupling the network control and data planes, makes it possible to capture entire or a certain portion of data traffic flows on SDN-capable switches and steer the captured network traffic to one of the traffic analyzers on the network. Therefore, how to sample network traffic and where to steer the sampled traffic among multiple traffic analyzers are critical problems facing cyber-security. Since there is a possibility that potentially useful information will be lost in not-captured traffic, deciding the sampling points and sampling rates of network traffic remains important. Additionally, after determining the sampling points and rates, sampled traffic must be sent to one of the multiple traffic analyzers for traffic inspection, which may incur additional network delivery overheads. We propose a less-intrusive traffic sampling mechanism for multiple traffic analyzers on an SDN-capable network using a deep deterministic policy gradient (DDPG), which is a representative deep reinforcement learning (DRL) algorithm for continuous action control. The proposed system learns sampling resource allocation policy under the uncertainty of flow distribution according to sampled traffic inspection results obtained from multiple traffic analyzers. Through extensive simulations and the SDN-based testbed experiments, we demonstrate that the proposed approach has a high probability of capturing malicious flows while maintaining a balanced load of multiple traffic analyzers and reducing flow monitoring overheads.

show abstract

“…IPro (Castillo et al, 2020), a traffic monitoring architecture using RL, which focuses on the problem of control plane overheads and extra additional CPU usage of the SDN controller. IPro uses Reinforcement Learning to determine the probing interval.…”

Section: Introductionmentioning

confidence: 99%

“…As a result, these studies increase accuracy at the expense of an increase in network resources and costs, or vice versa, reducing overhead. IPro (Castillo et al, 2020) is focused on control plane overhead using RL (Reinforcement Learning). At the same time, Payless (Chowdhuryand et al, 2014) is an adaptive design that has been worked on overhead.…”

Section: Introductionmentioning

confidence: 99%

Yazılım Tanımlı Ağlarda Ölçeklenebilir ve Verimli Bir Port Tabanlı Adaptif Kaynak İzleme Yaklaşımı

ÖZER

OKUMUŞ

2022

Mehmet Akif Ersoy Üniversitesi Fen Bilimleri Enstitüsü Dergisi

View full text Add to dashboard Cite

The need for communication tools is increasing from the past to the present, therefore the tools and methods in network technologies are evolving. Depending on this development, network scale and complexity increase and the limitations of traditional network technology are surfaced. Software-defined Network (SDN) provides a variety of opportunities for the management and optimization of these challenges. Network resource monitoring is very important for providing information to network applications. This study introduces an adaptive port-level bandwidth monitoring method designed for SDN networks. The proposed approach uses a polling-based monitoring paradigm. There is a trade-off between measurement accuracy and monitoring overhead. With this adaptive method, it is aimed to decrease the overhead while maintaining an acceptable level of accuracy of the measurements and also to use network resources more efficiently. The proposed adaptive monitoring approach has 46% less overhead than the periodic polling method and 6.7% less overhead than the PayLess approach. At the same time, this approach is 5.4% more accurate than the periodic polling approach.

show abstract

IPro: An approach for intelligent SDN monitoring

Cited by 17 publications

References 40 publications

DIVERGENCE: Deep Reinforcement Learning-Based Adaptive Traffic Inspection and Moving Target Defense Countermeasure Framework

DIVERGENCE: Deep Reinforcement Learning-Based Adaptive Traffic Inspection and Moving Target Defense Countermeasure Framework

Deep Reinforcement Learning-Based Traffic Sampling for Multiple Traffic Analyzers on Software-Defined Networks

Yazılım Tanımlı Ağlarda Ölçeklenebilir ve Verimli Bir Port Tabanlı Adaptif Kaynak İzleme Yaklaşımı

Contact Info

Product

Resources

About