Lightweight IPS for port scan in OpenFlow SDN networks

Abstract

Security has been one of the major concerns for the computer network community due to resource abuse and malicious flows intrusion. Before a network or a system is attacked, a port scan is typically performed to discover vulnerabilities, like open ports, which may be used to access and control them. Several studies have addressed Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) methods for detecting malicious activities, based on received flows or packet data analysis. However, those methods lead to an increase in switching latency, due to the need to analyze flows or packets before routing them. This may also increase network overhead when flows or packets are duplicated to be parsed by an external IDS. On the one hand, an IDS/IPS may be a bottleneck on the network and may not be useful. On the other hand, the new paradigm called Software Defined Networking (SDN) and the OpenFlow protocol provide some statistical information about the network that may be used for detecting malicious activities. Hence, this work presents a new port scan IPS for SDN based on the OpenFlow switch counters data. A non-intrusive and lightweight method was developed and implemented, with low network overhead, and low memory and processing power consumption. The results showed that our method is effective on detecting and preventing port scan attacks.

A proposal of port scan detection method based on Packet‐In Messages in OpenFlow networks and its evaluation

“…Once an anomalous increase in the rate is detected, the controller requests the statistics of the switch. Then, we used the method proposed in the research 4 to detect the occurrence of a port scan. Since the port scan detection process is done only when it is triggered, the frequency of detection will be considerably reduced compared to methods that performs the detection every set interval.…”

“…OpenFlow can collect traffic statistics from OF‐compatible devices, so that the communication can be handled in a switch‐by‐switch basis. This feature has been shown effective for network security measures 4,8,9 . For instance, Neu et al 4 .…”

Security Features in a Hybrid Software-Defined Network

“…In [48] authors use the existing Snort IDS for attacker information, and show that denial-of-service attacks can be monitored and mitigated by combining SDN security mechanisms, while the authors in [49] use a hybrid model of two types of machine learning (SVM and SOM) to improve the accuracy of DDoS attack detection relative to a separate machine learning approach. Neu et al [50] present an SDN solution to prevent port scan attacks. They used the statistics collected on SDN networks and updated the OpenFlow routing rules when a port scan was observed.…”

Avaliação de Linguagens de Programação do Plano de Dados em Redes Definidas por Software

“…Os controladores SDN se comunicam com os dispositivos de encaminhamento (plano de dados) através de uma API Southbound (ex: Open-Flow) para definir regras de encaminhamento, além de extrair informac ¸ões (como estatísticas e eventos) que serão enviadas para as aplicac ¸ões [Kim and Feamster 2013]. Por exemplo, um controlador pode ser utilizado por diferentes aplicac ¸ões, como depuradores [Tavares et al 2017] e sistemas de prevenc ¸ão de intrusões [Neu et al 2018]. O plano de dados, por sua vez, é responsável por realizar o encaminhamento de pacotes entre os dispositivos, abstraindo o hardware utilizado [Farhad et al 2014].…”