Measuring the efficiency of SDN mitigations against attacks on computer infrastructures

Koning, Ralph; Graaff, B. de; Polevoy, Gleb; Meijer, Robert; Laat, Cees de; Grosso, Paola

doi:10.1016/j.future.2018.08.011

Cited by 13 publications

(5 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, an operator that measures the properties of the DDoS attacks that it handles (e.g., Mirai-based DDoS attacks [17] or incidents similar to the 2015 DDoS attack on the DNS root [18]) can include the metadata of these datasets in network descriptions along with a usage license. The advantage is that it becomes much easier for other operators to find such datasets and the licenses to use the data [19]. This enables them to collaboratively combine and learn from each other's measurements, which improves their collective incident response capabilities.…”

Section: Enabling Cross-network Operator Incident Analysismentioning

confidence: 99%

“…Ultimately, we envision that a responsible Internet enables the real-time sharing of measurements across network operators, allowing them to collaboratively fend off security incidents as they occur (e.g., by dynamically moving scrubbing functionality to a specific part of their network using Network Function Virtualization (NFV) [19]) or even proactively before they can cause real harm. Network operators could share the actual measurements in various ways, such as directly from their own servers or through a shared platform in which multiple operators upload their measurements (e.g., DDoS fingerprints [20,21]).…”

Section: Enabling Cross-network Operator Incident Analysismentioning

confidence: 99%

“…The decision where to place a network function [51] will play a big role in how network operators perform in a responsible Internet. The ability for operators to take autonomous decisions in response to security incidents [19] will require further investigation.…”

Section: Ncp-rq5: How Can Open Networking Take Advantage Of the Additmentioning

confidence: 99%

See 2 more Smart Citations

A Responsible Internet to Increase Trust in the Digital World

et al. 2020

View full text Add to dashboard Cite

Policy makers in regions such as Europe are increasingly concerned about the trustworthiness and sovereignty of the foundations of their digital economy, because it often depends on systems operated or manufactured elsewhere. To help curb this problem, we propose the novel notion of a responsible Internet, which provides higher degrees of trust and sovereignty for critical service providers (e.g., power grids) and all kinds of other users by improving the transparency, accountability, and controllability of the Internet at the network-level. A responsible Internet accomplishes this through two new distributed and decentralized systems. The first is the Network Inspection Plane (NIP), which enables users to request measurement-based descriptions of the chains of network operators (e.g., ISPs and DNS and cloud providers) that handle their data flows or could potentially handle them, including the relationships between them and the properties of these operators. The second is the Network Control Plane (NCP), which allows users to specify how they expect the Internet infrastructure to handle their data (e.g., in terms of the security attributes that they expect chains of network operators to have) based on the insights they gained from the NIP. We discuss research directions and starting points to realize a responsible Internet by combining three currently largely disjoint research areas: large-scale measurements (for the NIP), open source-based programmable networks (for the NCP), and policy making (POL) based on the NIP and driving the NCP. We believe that a responsible Internet is the next stage in the evolution of the Internet and that the concept is useful for clean slate Internet systems as well.

show abstract

Section: Enabling Cross-network Operator Incident Analysismentioning

confidence: 99%

Section: Enabling Cross-network Operator Incident Analysismentioning

confidence: 99%

See 1 more Smart Citation

A Responsible Internet to Increase Trust in the Digital World

et al. 2020

View full text Add to dashboard Cite

show abstract

“…The attack does not reach the target host. Some examples are Ingress/Egress 6 filters on routers, packet filtering on routers [14], and automatic learning to detect anomalies.…”

Section: B Defensive Mechanismsmentioning

confidence: 99%

Intrusion Detection System based on the SDN Network, Bloom Filter and Machine Learning

Traoré¹,

Tiemoman²

2019

IJACSA

View full text Add to dashboard Cite

The scale and frequency of sophisticated attacks through denial of distributed service (DDoS) are still growing. The urgency is required because with the new emerging paradigms of the Internet of Things (IoT) and Cloud Computing, billions of unsecured connected objects will be available. This document deals with the detection, and correction of DDoS attacks based on real-time behavioral analysis of traffic. This method is based on Software Defined Network (SDN) technologies, Bloom filter and automatic behaviour learning. Indeed, distributed denial of service attacks (DDoS) are difficult to detect in real time. In particular, it concerns the distinction between legitimate and illegitimate packages. Our approach outlines a supervised classification method based on Machine Learning that identifies malicious and normal packets. Thus, we design and implement Defined (IDS) with a great precision. The results of the evaluation suggest that our proposal is timely and detects several abnormal DDoS-based cyber-attack behaviours.

show abstract

“…We implement SARNET on top of VNET which provides an experimental platform for secure networking research [3,5].…”

Section: Multi-domain Sarnetmentioning

confidence: 99%

Trust-based collaborative defences in multi network alliances

Koning

Deljoo

Meijer³

et al. 2019

2019 3rd Cyber Security in Networking Conference (CSNet)

View full text Add to dashboard Cite

Collaborative defences against, for example, Distributed Denial of Service attacks require trust between the collaborators. Even in a trusted alliance of collaborators, some members are more trusted than others with the execution of a specific task. This paper shows that trust can be used as a criterion in collaborative defences against attacks on computer infrastructures. We evaluate the implementation of a trust based defence in an overlay network and compare its' performance to other collaborative defences in the same environment. Results show that the trust-based defence has comparable results to the other collaborative defences after the trust values converge to reflect the behaviour of the nodes.

show abstract

Measuring the efficiency of SDN mitigations against attacks on computer infrastructures

Cited by 13 publications

References 19 publications

A Responsible Internet to Increase Trust in the Digital World

A Responsible Internet to Increase Trust in the Digital World

Intrusion Detection System based on the SDN Network, Bloom Filter and Machine Learning

Trust-based collaborative defences in multi network alliances

Contact Info

Product

Resources

About