NetFuse: Short-circuiting traffic surges in the cloud

Abstract

Modern cloud and data center platforms suffer failures and performance degradation from large traffic surges caused by both external (e.g., DDoS attacks) or internal (e.g., workload changes, operator errors, routing misconfigurations) factors. If not mitigated, traffic overload could have significant financial and availability implications for cloud providers. In this paper, we propose NetFuse, a mechanism to protect against traffic overload in OpenFlow-based data center networks. NetFuse is (1) scalable because it uses passively-collected OpenFlow control messages to detect active network flows; (2) accurate because it uses multi-dimensional flow aggregation to determine the right criteria to combine network flows that lead to overloading behavior; and (3) effective in limiting the damage of surges while not affecting the normal traffic because it uses a toxin-antitoxinlike mechanism to adaptively shape the rate of the flow based on application feedback. Experimental results on a real OpenFlow testbed show that NetFuse is effective in identifying and isolating misbehaving traffic with a small false positive rate (< 9%).

Resilience support in software-defined networking: A survey

“…Security threats can also compromise the integrity of configuration messages sent by the control plane to the data plane by modifying or introducing errors in their content [65]. A simple solution for this challenge is to use encryption protocols, such as TLS.…”

A Hybrid Approach Combining Rule-Based and Anomaly-Based Detection Against DDoS Attacks

“…On the other hand, a flow is said to be attack alert if fails all the three parameters' tests or two parameters' test (at least including parameter B p ). The reason attack alert always includes parameter B p is that an increase on CPU utilization of the victim is an indication of DDoS attacks [13].…”

“…Active query, like DNS amplification, usually introduces significant overhead to the interface loading of the victim. Query frequency is in proportion to current network utilization [13]. The network utilization information includes memory utilization and interface loading (CPU utilization), which will be examined in the following.…”

“…We may categorize them into four main approaches: traceback-based [1][2][3][4][5], rule-based [6][7][8][9][10][11][12][13][14][15][16], protocolbased [17][18][19][20][21][22][23][24][25][26][27] and anomaly-based [28][29][30]. Traceback-based methods make the victim to identify the attack source as well as attack paths once the attack has been encountered.…”

Bringing Energy Aware Routing Closer to Reality with SDN Hybrid Networks

“…Methods have been proposed to detect them in legacy networks, see for example [15], [16]. Netfuse [17] has been proposed in SDN-based data centers to mitigate the effect of traffic variations.…”