SHIELD: A novel NFV-based cybersecurity framework

Gardikis, Georgios; Tzoulas, K.; Tripolitis, K.; Bartzas, Alexandros; Costicoglou, Socrates; Lioy, Antonio; Gastón, Bernat; Fernández, Carolina Rúa; Davila, C.; Λίτκε, Αντώνιος; Papadakis, Nikolaos; Papadopoulos, Dimitris N.; Pastor, Antonio; Núñez, Jerónimo; Jacquin, Ludovic; Attak, Hamza; Davri, N.; Xilouris, George; Kafetzakis, M.; Katsianis, Dimitris; Neokosmidis, Ioannis; Terranova, Manuel; Giustozzi, C.; Batista, Tiago; Preto, Ricardo; Trouva, Eleni; Angelopoulos, Y.; Kourtis, Anastasios

doi:10.1109/netsoft.2017.8004228

Cited by 23 publications

(13 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Thus, there are a number of on-demand protection services and marketplaces available, which are not only offering protection services, but also offer alternatives regarding the deployment and management aspects of such services [4] [6]. However, it is not a trivial task for end-users to select one of them.…”

Section: Introductionmentioning

confidence: 99%

“…However, it is important to note none of those solutions mentioned above directly tackle the recommendation of protection services (e.g., cloud-based services [20] or Network Functions Virtualization (NFV) solutions [6]) to mitigate and protect against cyber attacks. Therefore, although past work investigated recommendation tools for the prediction of cyber attacks [7], there is a lack of solutions that establish an efficient path between victims and PSPs to deliver optimal solutions dealing with the rising number of cyber attacks efficiently.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

MENTOR: The Design and Evaluation of a Protection Services Recommender System

Franco

Rodrigues

Stiller

2019

2019 15th International Conference on Network and Service Management (CNSM)

View full text Add to dashboard Cite

Cyberattacks are the cause of several damages on governments and companies in the last years. Such damage includes not only leaks of sensitive information, but also economic loss due to downtime of services. The security market size worth billions of dollars, which represents investments to acquire protection services and training response teams to operate such services, determines a considerable part of the investment in technologies around the world. Although a vast number of protection services are available, it is neither trivial for network operators nor endusers to choose one of them in order to prevent or mitigate an imminent attack. As the next-generation cybersecurity solutions are on the horizon, systems that simplify their adoption are still required in support of security management tasks. Thus, this paper introduces MENTOR, a support tool for cybersecurity, focusing on the recommendation of protection services. MENTOR is able to (a) to deal with different demands from the user and (b) to recommend the adequate protection service in order to provide a proper level of cybersecurity in different scenarios. Four similarity measurements are implemented in order to prove the feasibility of the MENTOR's engine. An evaluation determines the performance and accuracy of each measurement used during the recommendation process.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

MENTOR: The Design and Evaluation of a Protection Services Recommender System

Franco

Rodrigues

Stiller

2019

2019 15th International Conference on Network and Service Management (CNSM)

View full text Add to dashboard Cite

show abstract

“…Apache Spot is deployed and evaluated in the SHIELD [19] [20] SDN/NFV-enabled testbed in Athens, Greece. SHIELD proposes "a universal solution for dynamically establishing and deploying virtual security infrastructures into ISP and corporate networks".…”

Section: Introductionmentioning

confidence: 99%

Evaluation of Apache Spot's machine learning capabilities in an SDN/NFV enabled environment

Mathas

Segou²,

Xilouris³

et al. 2018

Proceedings of the 13th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Software Defined Networking (SDN) and Network Function Virtualisation (NFV) are transforming modern networks towards a service-oriented architecture. At the same time, the cybersecurity industry is rapidly adopting Machine Learning (ML) algorithms to improve detection and mitigation of complex attacks. Traditional intrusion detection systems perform signature-based detection, based on well-known malicious traffic patterns that signify potential attacks. The main drawback of this method is that attack patterns need to be known in advance and signatures must be preconfigured. Hence, typical systems fail to detect a zero-day attack or an attack with unknown signature. This work considers the use of machine learning for advanced anomaly detection, and specifically deploys the Apache Spot ML framework on an SDN/NFV-enabled testbed running cybersecurity services as Virtual Network Functions (VNFs). VNFs are used to capture traffic for ingestion by the ML algorithm and apply mitigation measures in case of a detected anomaly. Apache Spot utilises Latent Dirichlet Allocation to identify anomalous traffic patterns in Netflow, DNS and proxy data. The overall performance of Apache Spot is evaluated by deploying Denial of Service (Slowloris, BoNeSi) and a Data Exfiltration attack (iodine). CCS CONCEPTS • Computer systems organization → Distributed Architectures; Cloud Computing • Networks → Network Security; Network Services • Computing Methodologies → Machine Learning.

show abstract

“…SHIELD (Securing against intruders and other threats through an NFV-enabled environment) is a H2020 project [1] that aims to exploit SDN/NFV capabilities for creating a protection layer for an IT infrastructure [2] . To this aim, security-specialized network functions (named virtual Network Security Functions, vNSF) are developed and exploited.…”

Section: Introductionmentioning

confidence: 99%

NFV-based network protection: The SHIELD approach

Lioy

Gardikis

Gastón

et al. 2017

2017 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)

Self Cite

View full text Add to dashboard Cite

This demo showcases some of the capabilities foreseen for the security infrastructure designed by the H2020 SHIELD project. SHIELD exploits NFV for adaptive monitoring of an IT infrastructure and for feeding the data to an analytics engine to detect attacks in real time. An intelligent reaction system is then activated to reconfigure the SDN/NFV infrastructure so that the attacks are thwarted. The SDN/NFV infrastructure itself is protected from attacks thanks to trusted computing techniques, that permit to quickly identify misbehaving nodes. The proposed demo will present detection and reaction to a DDoS attack (by on-the-fly deployment of new virtual network security functions and/or change of network paths), as well as detection of software attacks against virtual network functions (executed in Docker containers) and unauthorized modification of the SDN switching tables and NFV configurations.

show abstract

SHIELD: A novel NFV-based cybersecurity framework

Cited by 23 publications

References 3 publications

MENTOR: The Design and Evaluation of a Protection Services Recommender System

MENTOR: The Design and Evaluation of a Protection Services Recommender System

Evaluation of Apache Spot's machine learning capabilities in an SDN/NFV enabled environment

NFV-based network protection: The SHIELD approach

Contact Info

Product

Resources

About