SDN/NFV-Based Security Service Function Tree for Cloud

Luo, Jing-Lun; Shu, Yu; Peng, Sui

doi:10.1109/access.2020.2974569

Cited by 15 publications

(4 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Several works focus on the detection and prevention of specific types of attacks through the use of SFC [8]. In [9], the combination of multiple SFCs into a Security Service Function Tree (SecSFT) is proposed to optimize resource allocation for virtual security functions. The authors in [10] present a security SFC path selection scheme utilizing deep reinforcement learning.…”

Section: Related Workmentioning

confidence: 99%

IDSMatch: A Novel Deployment Method for IDS Chains in SDNs

Niknami,

2024

Network

View full text Add to dashboard Cite

With the surge in cyber attacks, there is a pressing need for more robust network intrusion detection systems (IDSs). These IDSs perform at their best when they can monitor all the traffic coursing through the network, especially within a software-defined network (SDN). In an SDN configuration, the control plane and data plane operate independently, facilitating dynamic control over network flows. Typically, an IDS application resides in the control plane, or a centrally located network IDS transmits security reports to the controller. However, the controller, equipped with various control applications, may encounter challenges when analyzing substantial data, especially in the face of high traffic volumes. To enhance the processing power, detection rates, and alleviate the controller’s burden, deploying multiple instances of IDS across the data plane is recommended. While deploying IDS on individual switches within the data plane undoubtedly enhances detection rates, the associated costs of installing one at each switch raise concerns. To address this challenge, this paper proposes the deployment of IDS chains across the data plane to boost detection rates while preventing controller overload. The controller directs incoming traffic through alternative paths, incorporating IDS chains; however, potential delays from retransmitting traffic through an IDS chain could extend the journey to the destination. To address these delays and optimize flow distribution, our study proposes a method to balance flow assignments to specific IDS chains with minimal delay. Our approach is validated through comprehensive testing and evaluation using a test bed and trace-based simulation, demonstrating its effectiveness in reducing delays and hop counts across various traffic scenarios.

show abstract

Section: Related Workmentioning

confidence: 99%

IDSMatch: A Novel Deployment Method for IDS Chains in SDNs

Niknami,

2024

Network

View full text Add to dashboard Cite

show abstract

“…Hantouti et al [17] discussed the concept of partial symmetry and proposed a novel SFC framework with an abstraction layer that can dynamically create partially or fully symmetric SFCs in multiple domains. Luo et al [18] merged multiple SFCs into a security service function tree to reduce the requirement for resources during virtual security function assignment. Wang et al [19] extended the network service header protocol and proposed a partially ordered multipath linking mechanism based on partially ordered SFC for low latency and partially ordered services.…”

Section: Related Workmentioning

confidence: 99%

Dynamic Security SFC Branching Path Selection Using Deep Reinforcement Learning

Deng,

Li,

Zhou

2023

Intelligent Automation &Amp; Soft Computing

View full text Add to dashboard Cite

Security service function chaining (SFC) based on software-defined networking (SDN) and network function virtualization (NFV) technology allows traffic to be forwarded sequentially among different security service functions to achieve a combination of security functions. Security SFC can be deployed according to requirements, but the current SFC is not flexible enough and lacks an effective feedback mechanism. The SFC is not traffic aware and the changes of traffic may cause the previously deployed security SFC to be invalid. How to establish a closed-loop mechanism to enhance the adaptive capability of the security SFC to malicious traffic has become an important issue. Our contribution is threefold. First, we propose a secure SFC path selection framework. The framework can accept the feedback results of traffic and security service functions in SFC, and dynamically select the optimal path for SFC based on the feedback results. It also realizes the automatic deployment of paths, forming a complete closed loop. Second, we expand the protocol of SFC to realize the security SFC with branching path, which improve flexibility of security SFC. Third, we propose a deep reinforcement learning-based dynamic path selection method for security SFC. It infers the optimal branching path by analyzing feedback from the security SFC. We have experimented with Distributed Denial of Service (DDoS) attack detection modules as security service functions. Experimental results show that our proposed method can dynamically select the optimal branching path for a security SFC based on traffic features and the state of the SFC. And it improves the accuracy of the overall malicious traffic detection of the security SFC and significantly reduces the latency and overall load of the SFC.

show abstract

Section: Related Workmentioning

confidence: 99%

IDSMatch: A Novel Deployment Method for IDS Chains in SDNs

Niknami,

2023

Preprint

View full text Add to dashboard Cite

With a software-defined network (SDN), the control plane is separated from the data plane, allowing the control of network flows to be easy and dynamic at the same time. While the controller, which is equipped with various control applications, is capable of analyzing a large amount of data, it may become overburdened when it is faced with a large volume of traffic. The intrusion detection system (IDS) is an example of control applications that can be used to detect intrusions. It is recommended to deploy instances of the IDS across the data plane. This will improve the processing power and detection rate and as a result reduce the load on the controller at the same time. While there is no doubt that an IDS would be beneficial for improving detection rates, installing one at each switch in the data plane would be costly. To address this issue, this paper proposes the deployment of IDS chains across the data plane. The controller directs incoming traffic via alternative paths, including the IDS chain, which increases the detection rate while avoiding overloading. In order to improve transmission efficiency, our study proposes a method of balancing the distribution of flows and assigning them to specific IDS chains. This approach minimizes the cost of flow grouping through the use of a new incoming traffic grouping technique. Our method is tested and evaluated through the use of a test bed and trace-based simulation, and has been proven to effectively reduce delays and hop counts across various traffic scenarios.

show abstract

SDN/NFV-Based Security Service Function Tree for Cloud

Cited by 15 publications

References 13 publications

IDSMatch: A Novel Deployment Method for IDS Chains in SDNs

IDSMatch: A Novel Deployment Method for IDS Chains in SDNs

Dynamic Security SFC Branching Path Selection Using Deep Reinforcement Learning

IDSMatch: A Novel Deployment Method for IDS Chains in SDNs

Contact Info

Product

Resources

About