Resource/accuracy tradeoffs in software-defined measurement

Moshref, Masoud; Yu, Minlan; Govindan, Ramesh

doi:10.1145/2491185.2491196

Cited by 77 publications

(54 citation statements)

References 18 publications

(24 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This enables the SDN controller to obtain the entire network information and to make defense strategies in holistic views [8-11, 15, 18, 21]. In the field of network monitoring, many researches focus on how to reduce monitoring overhead while ensuring accuracy [11,14,[22][23][24]. Among them, Braga et al in [8] proposes using Support Vector Machine (SVM) to detect DDoS attacks on the SDN controller.…”

Section: Sdn-based Defensementioning

confidence: 99%

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

Han

Yang

Sun

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks are one of the biggest concerns for security professionals. Traditional middle-box based DDoS attack defense is lack of network-wide monitoring flexibility. With the development of software-defined networking (SDN), it becomes prevalent to exploit centralized controllers to defend against DDoS attacks. However, current solutions suffer with serious southbound communication overhead and detection delay. In this paper, we propose a cross-plane DDoS attack defense framework in SDN, called OverWatch, which exploits collaborative intelligence between data plane and control plane with high defense efficiency. Attack detection and reaction are two key procedures of the proposed framework. We develop a collaborative DDoS attack detection mechanism, which consists of a coarse-grained flow monitoring algorithm on the data plane and a finegrained machine learning based attack classification algorithm on the control plane. We propose a novel defense strategy offloading mechanism to dynamically deploy defense applications across the controller and switches, by which rapid attack reaction and accurate botnet location can be achieved. We conduct extensive experiments on a real-world SDN network. Experimental results validate the efficiency of our proposed OverWatch framework with high detection accuracy and real-time DDoS attack reaction, as well as reduced communication overhead on SDN southbound interface.

show abstract

Section: Sdn-based Defensementioning

confidence: 99%

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

Han

Yang

Sun

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Even though pulling statistics frequently from data plane help controller maintain up-todate global vision of network states, it brings extra overhead to be handled by the controller owing to processing information. Therefore, this is process is a trade-off between measurement accuracy, timeliness and signaling overhead and thereby resulting in control plane scalability issue for controller [100]. The PayLess [88] framework provides different flow aggregation levels by a RESTful API for flow statistics collection.…”

Section: Research Challengesmentioning

confidence: 99%

Quality of Service (QoS) in Software Defined Networking (SDN): A survey

Karakuş

Durresi

2017

Journal of Network and Computer Applications

336

139

View full text Add to dashboard Cite

Supporting end-to-end Quality of Service (QoS) in existing network architectures is an ongoing problem. Although researchers from both academia and industry have proposed many solutions to solve the QoS limitations of the current networking, many of them either failed or were not implemented. Software Defined Networking (SDN) paradigm has emerged in response to limitations of traditional networking architectures. Its main advantages are the centralized global network view, programmability, and separation of the data plane and control plane. These features have got attention of researchers to improve the QoS provisioning of today's various network applications. In this survey paper, we aim at making a picture of QoS-motivated literature in OpenFlow-enabled SDN networks by comprehensively surveying relevant research studies. We organize the related studies according to the categories that are the most prominent ways in which QoS can benefit from the concept of SDN: Multimedia flows routing mechanisms, inter-domain routing mechanisms, resource reservation mechanisms, queue management and scheduling mechanisms, Quality of Experience (QoE)-aware mechanisms, network monitoring mechanisms, and other QoS-centric mechanisms such as virtualization-based QoS provisioning and QoS policy management etc. In addition, we discuss QoS capabilities of OpenFlow protocol by reviewing its versions along with some well-known, open-source, and community-driven controller projects. Furthermore, we outline the potential challenges and open problems that need to be addressed further for better and complete QoS abilities in SDN/OpenFlow networks and lessons we have learned during preparation of this survey paper.

show abstract

“…But this method also not provide any dynamic rule for case of heavy traffic and failed to fingerprint the anomalies in that case. Other closely related work in [15] also mention the tradeoff between overhead and accuracy. Our work mainly build on top of [4].…”

Section: Related Workmentioning

confidence: 99%

Detecting Anomalies Efficiently in SDN Using Adaptive Mechanism

Garg

2015

2015 Fifth International Conference on Advanced Computing &Amp; Communication Technologies

View full text Add to dashboard Cite

Monitoring and measurement of network traffic flows in SDN is key requirement for maintaining the integrity of our data in network. It plays a vital role in management task of SDN controller for controlling the traffic. Anomaly detection considered as one of the important issues while monitoring the traffic. More efficiently we detect the anomalies, easier it will be for us, to manage the traffic. However we have to consider the workload, response time and overhead on network while applying the network monitoring policies, so that our network perform with similar efficiency. To reduce the overhead, it is required to perform analysis on certain portion of traffic instead of analyzing each and every packet in the network. This paper presents an adaptive mechanism for dynamically updating the policies for aggregation of flow entries and anomaly detection, so that monitoring overhead can be reduced and anomalies can be detected with greater accuracy. In previous work, rules for expansion and contraction of aggregation policies according to adaptive behavior are defined. This paper represents a work towards reducing the complexity of dynamic algorithm for updating policies of flow counting rules for anomaly detection.

show abstract

Resource/accuracy tradeoffs in software-defined measurement

Cited by 77 publications

References 18 publications

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

Quality of Service (QoS) in Software Defined Networking (SDN): A survey

Detecting Anomalies Efficiently in SDN Using Adaptive Mechanism

Contact Info

Product

Resources

About