SDN-based solutions for Moving Target Defense network protection

Kampanakis, Panos; Perros, Harry G.; Beyene, Tsegereda

doi:10.1109/wowmom.2014.6918979

Cited by 121 publications

(79 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The integration of both spatial and temporal mutations could effectively defeat various reconnaissance-based threat models, ranging from naive IP sharing techniques to sophisticated advanced persistent threats. Kampanakis et al [2] demonstrated how a highly programmable SDN could offer various avenues to provide obfuscations, which increases the cost of an attack by requiring the attacker to expend more resources studying the attack surface. In addition, some researchers have proposed RRM mechanisms.…”

Section: Related Workmentioning

confidence: 99%

“…Otherwise, we should set GEN = GEN +1 (GEN represents the iteration time) and return to (2). If GEN > max GEN or the current solution has been stable, we will stop the entire process.…”

Section: Generation Of An Optimal Random Routing Pathmentioning

confidence: 99%

“…Thus, how to enhance the defense capabilities of SDN by taking advantages of its own feature is one of the most important problems. Meanwhile, the programmable and flexible nature of SDN makes the implementation of MTD mechanisms more practical and customizable [2] in SDN.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Defense Mechanism of Random Routing Mutation in SDN

Liu

Zhang

Guo³

2017

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYFocused on network reconnaissance, eavesdropping, and DoS attacks caused by static routing policies, this paper designs a random routing mutation architecture based on the OpenFlow protocol, which takes advantages of the global network view and centralized control in a software-defined network. An entropy matrix of network traffic characteristics is constructed by using volume measurements and characteristic measurements of network traffic. Random routing mutation is triggered according to the result of network anomaly detection, which using a wavelet transform and principal component analysis to handle the above entropy matrix for both spatial and temporal correlations. The generation of a random routing path is specified as a 0-1 knapsack problem, which is calculated using an improved ant colony algorithm. Theoretical analysis and simulation results show that the proposed method not only increases the difficulty of network reconnaissance and eavesdropping but also reduces the impact of DoS attacks on the normal communication in an SDN network.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Otherwise, we should set GEN = GEN +1 (GEN represents the iteration time) and return to (2). If GEN > max GEN or the current solution has been stable, we will stop the entire process.…”

Section: Generation Of An Optimal Random Routing Pathmentioning

confidence: 99%

See 1 more Smart Citation

A Defense Mechanism of Random Routing Mutation in SDN

Liu

Zhang

Guo³

2017

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…Kampanakis et al [74] advocate the use of moving target defense (MTD) in order to protect network services when malicious traffic try to compromise their integrity. The authors conclude that SDN makes the implementation of MTD techniques more practical, customizable and easier to deploy.…”

Section: Securitymentioning

confidence: 99%

“…Within the first group, there are several implementations of firewalls and IDSes that can perform their functions more flexibly and with lower management cost [70]. Within the second group, research is focused on mitigating intrusions in the control plane; vulnerabilities in the TLS protocol; and protecting the control plane against malicious attacks using network-wide policies and moving target defense [74].…”

Section: Summary Of Challenges and Current Solutionsmentioning

confidence: 99%

Resilience support in software-defined networking: A survey

et al. 2015

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is an architecture for computer networking that provides a clear separation between network control functions and forwarding operations. The abstractions supported by this architecture are intended to simplify the implementation of several tasks that are critical to network operation, such as routing and network management. Computer networks have an increasingly important societal role, requiring them to be resilient to a range of challenges. Previously, research into network resilience has focused on the mitigation of several types of challenges, such as natural disasters and attacks. Capitalising on its benefits, including increased programmability and a clearer separation of concerns, significant attention has recently focused on the development of resilience mechanisms that use software-defined networking approaches. In this article, we present a survey that provides a structured overview of the resilience support that currently exists in this important area. We categorize the most recent research on this topic with respect to a number of resilience disciplines. Additionally, we discuss the lessons learned from this investigation, highlight the main challenges faced by SDNs moving forward, and outline the research trends in terms of solutions to mitigate these challenges . 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 This article presents a survey on the support for network resilience in SoftwareDefined Networking (SDN). This has been the subject of intense investigation by the academic and industrial community in the past few years, as evidenced by the number of papers included in our survey (159 references in total). Capitalizing on the benefits of SDN, including increased programmability and a clearer separation of concerns, significant attention has recently focused on the development of resilience mechanisms that use software-defined networking approaches. Thus, a wide range of solutions to classical network problems have been revisited using this architecture, but many problems continue to be challenging.Our survey investigates the resilience support that currently exists in this important area, and categorizes the most recent research on this topic with respect to a number of resilience disciplines. Additionally, we discuss the lessons learned from this investigation, highlight the main challenges faced by SDNs moving forward, and outline the research trends in terms of solutions to mitigate these challenges. The aim of the survey is to offer to the reader a structured view of network resilience in the SDN spectrum, and how resilience aspects are supported in these architectures.We believe that this subject material is closely aligned with the objectives of the journal. Please be assured that:1. This paper has not been published or accepted for publication w...

show abstract

An SDN‐based MTD model

Yang

Cheng²

2018

Concurrency and Computation

View full text Add to dashboard Cite

An SDN-based moving target defense (MTD) model maps the physical network elements to a considerably larger space than the original address space and creates different times of validity randomly to generate mapping addresses on the basis of the security level of the targets accessed, making it more difficult for attackers to find the targets. The methods used to make the MTD technique work include generating different times of validity and coefficients of difficulty for the address mapping randomly based on the security level of the targets accessed, changing the mapping destination IPv4 to IPv6 (to increase the target space by several orders of magnitude), transforming the IP, MAC addresses, and the protocol ports, and mapping the SDN network elements. All of these measures increase the difficulty of network reconnaissance, making it more difficult for attackers to obtain authentic target information. In this paper, we present the relevant technological background, discuss the design of a new security adaptive system model based on SDN, and propose a target security level identification algorithm and a network element information mapping algorithm.

show abstract

SDN-based solutions for Moving Target Defense network protection

Cited by 121 publications

References 3 publications

A Defense Mechanism of Random Routing Mutation in SDN

A Defense Mechanism of Random Routing Mutation in SDN

Resilience support in software-defined networking: A survey

An SDN‐based MTD model

Contact Info

Product

Resources

About