Identifying cyber-attacks on software defined networks: An inference-based intrusion detection approach. (15th February 2017)

• Record Type: Journal Article
• Authors: AlEroud, Ahmed; Alsmadi, Izzat
• Is Part Of: Journal of network and computer applications. Volume 80(2017)
• Page Start: 152
• Page End: 164
• Publication Date: 2017-02-15
• Subjects: Software defined networks -- Information security -- Intrusion detection -- Graph mining, Denial of service attacks -- Security architecture; Microcomputers -- Periodicals; Computer networks -- Periodicals; Application software -- Periodicals; Micro-ordinateurs -- Périodiques; Réseaux d'ordinateurs -- Périodiques; Logiciels d'application -- Périodiques; Application software; Computer networks; Microcomputers; Periodicals; 004.05; 004
• DOI: 10.1016/j.jnca.2016.12.024
• Languages: English
• ISSNs: 1084-8045

Abstract

Abstract: Software Defined Networking is an emerging architecture which focuses on the role of software to manage computer networks. Software Defined Networks (SDNs) introduce several mechanisms to detect specific types of attacks such as Denial of Service (DoS). Nevertheless, they are vulnerable to similar attacks that occur in traditional networks, such as the attacks that target control and data plane. Several techniques are proposed to handle the security vulnerabilities in SDNs. However, it is fairly challenging to create attack signatures, scenarios, or even intrusion detection rules that are applicable to dynamic environments such SDNs. This paper introduces a new approach to identify attacks on SDNs that uses: (1) similarity with existing attacks that target traditional networks, (2) an inference mechanism to avoid false positives and negatives during the prediction process, and (3) a packet aggregation technique which aims at creating attack signatures and use them to predict attacks on SDNs. We validated our approach on two datasets and showed that it yields promising results.