Network Simulator NS2

Distributed denial-of-service (DDoS) attacks have become a weapon of choice for hackers, cyber extortionists, and cyber terrorists. These attacks can swiftly incapacitate a victim, causing huge revenue losses. Despite the large number of traditional mitigation solutions that exists today, DDoS attacks continue to grow in frequency, volume, and severity. This calls for a new network paradigm to address the requirements of today’s challenging security threats. Software-defined networking (SDN) is an emerging network paradigm which has gained significant traction by many researchers to address the requirement of today’s data centers. Inspired by the capabilities of SDN, we present a comprehensive survey of existing SDN-based DDoS attack detection and mitigation solutions. We classify solutions based on DDoS attack detection techniques and identify requirements of an effective solution. Based on our findings, we propose a novel framework for detection and mitigation of DDoS attacks in a large-scale network which comprises a smart city built on SDN infrastructure. Our proposed framework is capable of meeting application-specific DDoS attack detection and mitigation requirements. The primary contribution of this paper is twofold. First, we provide an in-depth survey and discussion of SDN-based DDoS attack detection and mitigation mechanisms, and we classify them with respect to the detection techniques. Second, leveraging the characteristics of SDN for network security, we propose and present an SDN-based proactive DDoS Defense Framework (ProDefense). We show how this framework can be utilized to secure applications built for smart cities. Moreover, the paper highlights open research challenges, future research directions, and recommendations related to SDN-based DDoS detection and mitigation.

DDoS Attack Detection and Mitigation Using SDN: Methods, Practices, and Solutions

Distributed Denial of Service (DDoS) is one of the most prevalent attacks that an organizational network infrastructure comes across nowadays. We propose a deep learning based multi-vector DDoS detection system in a software-defined network (SDN) environment. SDN provides flexibility to program network devices for different objectives and eliminates the need for third-party vendor-specific hardware. We implement our system as a network application on top of an SDN controller. We use deep learning for feature reduction of a large set of features derived from network traffic headers. We evaluate our system based on different performance metrics by applying it on traffic traces collected from different scenarios. We observe high accuracy with a low false-positive for attack detection in our proposed system.

/pdf/a-deep-learning-based-ddos-detection-system-in-software-1gj20d0srv.pdf

A Deep Learning Based DDoS Detection System in Software-Defined Networking (SDN)

Mobile ad hoc networks (MANETs) are spontaneously deployed over a geographically limited area without well-established infrastructure. The networks work well only if the mobile nodes are trusty and behave cooperatively. Due to the openness in network topology and absence of a centralized administration in management, MANETs are very vulnerable to various attacks from malicious nodes. In order to reduce the hazards from such nodes and enhance the security of network, this paper presents a dynamic trust prediction model to evaluate the trustworthiness of nodes, which is based on the nodes’ historical behaviors, as well as the future behaviors via extended fuzzy logic rules prediction. We have also integrated the proposed trust predication model into the Source Routing Mechanism. Our novel on-demand trust-based unicast routing protocol for MANETs, termed as Trust-based Source Routing protocol (TSR), provides a flexible and feasible approach to choose the shortest route that meets the security requirement of data packets transmission. Extensive experiments have been conducted to evaluate the efficiency and effectiveness of the proposed mechanism in malicious node identification and attack resistance. The results show that TSR improves packet delivery ratio and reduces average end-to-end latency.

Trust prediction and trust-based source routing in mobile ad hoc networks

Distributed Denial of Service (DDoS) attacks are one of the most harmful threats in today’s Internet, disrupting the availability of essential services. The challenge of DDoS detection is the combination of attack approaches coupled with the volume of live traffic to be analysed. In this paper, we present a practical, lightweight deep learning DDoS detection system called Lucid, which exploits the properties of Convolutional Neural Networks (CNNs) to classify traffic flows as either malicious or benign. We make four main contributions; (1) an innovative application of a CNN to detect DDoS traffic with low processing overhead, (2) a dataset-agnostic preprocessing mechanism to produce traffic observations for online attack detection, (3) an activation analysis to explain Lucid’s DDoS classification, and (4) an empirical validation of the solution on a resource-constrained hardware platform. Using the latest datasets, Lucid matches existing state-of-the-art detection accuracy whilst presenting a 40x reduction in processing time, as compared to the state-of-the-art. With our evaluation results, we prove that the proposed approach is suitable for effective DDoS detection in resource-constrained operational environments.

/pdf/lucid-a-practical-lightweight-deep-learning-solution-for-2wl46phf2o.pdf

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

Software-Defined Networking (SDN) and OpenFlow (OF) protocol have brought a promising architecture for the future networks. However, the centralized control and programmable characteristics also bring a lot of security challenges. Distributed denial-of-service (DDoS) attack is still a security threat to SDN. To detect the DDoS attack in SDN, many researches collect the flow tables from the switch and do the anomaly detection in the controller. But in the large scale network, the collecting process burdens the communication overload between the switches and the controller. Sampling technology may relieve this overload, but it brings a new tradeoff between sampling rate and detection accuracy. In this paper, we first extend a copy of the packet number counter of the flow entry in the OpenFlow table. Based on the flow-based nature of SDN, we design a flow statistics process in the switch. Then, we propose an entropy-based lightweight DDoS flooding attack detection model running in the OF edge switch. This achieves a distributed anomaly detection in SDN and reduces the flow collection overload to the controller. We also give the detailed algorithm which has a small calculation overload and can be easily implemented in SDN software or programmable switch, such as Open vSwitch and NetFPGA. The experimental results show that our detection mechanism can detect the attack quickly and achieve a high detection accuracy with a low false positive rate.

An Entropy-Based Distributed DDoS Detection Mechanism in Software-Defined Networking

Caches are widely used in modern computer systems to bridge the increasing gap between processor speed and memory access time. On the other hand, presence of caches, especially data caches, complicates the static worst case execution time (WCET) analysis. Access pattern analysis (e.g., cache miss equations) are applicable to only a specific class of programs, where all array accesses must have predictable access patterns. Abstract interpretation-based methods (must/persistence analysis) determines possible cache conflicts based on coarse-grained memory access information from address analysis, which usually leads to significantly pessimistic estimation. In this paper, we first present a refined persistence analysis method which fixes the potential underestimation problem in the original persistence analysis. Based on our new persistence analysis, we propose a framework to combine access pattern analysis and abstract interpretation for accurate data cache analysis. We capture the dynamic behavior of a memory access by computing its temporal scope (the loop iterations where a given memory block is accessed for a given data reference) during address analysis. Temporal scopes as well as loop hierarchy structure (the static scopes) are integrated and utilized to achieve a more precise abstract cache state modeling. Experimental results shows that our proposed analysis obtains up to 74% reduction in the WCET estimates compared to existing data cache analysis.

/pdf/scope-aware-data-cache-analysis-for-wcet-estimation-1h4fuguopj.pdf

Scope-Aware Data Cache Analysis for WCET Estimation

Owing to the openness in network topology and the absence of centralised administration in management, mobile ad hoc network (MANET) is vulnerable to attacks from malicious nodes In order to decrease the hazards from these malicious nodes, the authors incorporate the concept of trust into the MANET, and build a trust management model which is divided into two parts: subjective trust evaluation model and trusted routing model In subjective trust evaluation model, the credibility of nodes can be evaluated using analytic hierarchy process theory and fuzzy logic rules prediction method Based on the fuzzy dynamic programming theory, in trusted routing model, the authors present a novel trusted routing algorithm which can kick out the untrustworthy nodes in order to obtain a reliable passage delivery route As an application of the proposed trusted routing algorithm, a novel reactive routing protocol on the basis of the standard dynamic source routing protocol, called fuzzy trusted dynamic source routing (FTDSR) protocol is proposed Several experiments have been conducted to evaluate the efficiency of the protocol in malicious node identification and attack resistance The experimental results show that FTDSR can effectively detect the malicious nodes that guarantee the packet delivery ratio and the network throughput

Trust management model for mobile ad hoc network based on analytic hierarchy process and fuzzy theory

A mobile ad hoc network (MANET) is a self-organized system comprised by multiple mobile wireless nodes. Due to the openness in network topology and the absence of centralized administration in management, MANET is vulnerable to attacks from malicious nodes. In order to reduce the hazards from these malicious nodes, we incorporate the concept of trust into the MANET, and build a subjective trust management model with multiple decision factors based on the analytic hierarchy process (AHP) theory and the fuzzy logic rules prediction method£­AFStrust. We consider multiple decision factors, including direct trust, recommendation trust, incentive function and active degree, in our model to reflect trust relationship's complexity and uncertainty from various aspects. It overcomes the shortage of traditional method, where the decision factors are incomplete. Moreover, the weight of classification is set up by AHP for these decision factors, which makes the model has a better rationality and a higher practicability. Compared to the existing trust management models, comprehensive experiments have been conducted to evaluate the efficiency of our trust management model in the improvement of network interaction quality, trust dynamic adaptability, malicious node identification, attack resistance and enhancements of system's security.

/pdf/a-subjective-trust-management-model-with-multiple-decision-59yy9uqhdt.pdf

Lei Ju

Papers

Trust prediction and trust-based source routing in mobile ad hoc networks

An Entropy-Based Distributed DDoS Detection Mechanism in Software-Defined Networking

Scope-Aware Data Cache Analysis for WCET Estimation

Trust management model for mobile ad hoc network based on analytic hierarchy process and fuzzy theory

A Subjective Trust Management Model with Multiple Decision Factors for MANET Based on AHP and Fuzzy Logic Rules