Skip to main content
Erschienen in: Cluster Computing 2/2021

18.09.2020

A survey and classification of the security anomaly detection mechanisms in software defined networks

verfasst von: Tohid Jafarian, Mohammad Masdari, Ali Ghaffari, Kambiz Majidzadeh

Erschienen in: Cluster Computing | Ausgabe 2/2021

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

Software defined network (SDN) decouples the network control and data planes. Despite various advantages of SDNs, they are vulnerable to various security attacks such anomalies, intrusions, and Denial-of-Service (DoS) attacks and so on. On the other hand, any anomaly and intrusion in SDNs can affect many important domains such as banking system and national security. Therefore, the anomaly detection topic is a broad research domain, and to mitigate these security problems, a great deal of research has been conducted in the literature. In this paper, the state-of-the-art schemes applied in detecting and mitigating anomalies in SDNs are explained, categorized, and compared. This paper categorizes the SDN anomaly detection mechanisms into five categories: (1) flow counting scheme, (2) information-based scheme, (3) entropy-based scheme, (4) deep learning, and (5) hybrid scheme. The research gaps and major existing research issues regarding SDN anomaly detection are highlighted. We hope that the analyses, comparisons, and classifications might provide directions for further research.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
2.
Zurück zum Zitat Masoudi, R., Ghaffari, A.: Software defined networks: a survey. J. Netw. Comput. Appl. 67, 1–25 (2016)CrossRef Masoudi, R., Ghaffari, A.: Software defined networks: a survey. J. Netw. Comput. Appl. 67, 1–25 (2016)CrossRef
3.
Zurück zum Zitat Ahmad, I., Namal, S., Ylianttila, M., Gurtov, A.: Security in software defined networks: a survey. IEEE Commun. Surv. Tutor. 17(4), 2317–2346 (2015)CrossRef Ahmad, I., Namal, S., Ylianttila, M., Gurtov, A.: Security in software defined networks: a survey. IEEE Commun. Surv. Tutor. 17(4), 2317–2346 (2015)CrossRef
4.
Zurück zum Zitat Shirmarz, A., Ghaffari, A.: An adaptive greedy flow routing algorithm for performance improvement in software-defined network. Int. J. Numer. Model. Electron. Netw. Dev. Fields 33(1), e2676 (2020) Shirmarz, A., Ghaffari, A.: An adaptive greedy flow routing algorithm for performance improvement in software-defined network. Int. J. Numer. Model. Electron. Netw. Dev. Fields 33(1), e2676 (2020)
6.
Zurück zum Zitat Sun, R., Zhang, S., Yin, C., Wang, J., Min, S.: Strategies for data stream mining method applied in anomaly detection. Clust. Comput. 22(2), 399–408 (2019)CrossRef Sun, R., Zhang, S., Yin, C., Wang, J., Min, S.: Strategies for data stream mining method applied in anomaly detection. Clust. Comput. 22(2), 399–408 (2019)CrossRef
7.
Zurück zum Zitat Wang, J., Xia, L.: Abnormal behavior detection in videos using deep learning. Clust. Comput. 22(4), 9229–9239 (2019)MathSciNetCrossRef Wang, J., Xia, L.: Abnormal behavior detection in videos using deep learning. Clust. Comput. 22(4), 9229–9239 (2019)MathSciNetCrossRef
8.
Zurück zum Zitat Velliangiri, S., Premalatha, J.: Intrusion detection of distributed denial of service attack in cloud. Clust. Comput. 22(5), 10615–10623 (2019)CrossRef Velliangiri, S., Premalatha, J.: Intrusion detection of distributed denial of service attack in cloud. Clust. Comput. 22(5), 10615–10623 (2019)CrossRef
9.
Zurück zum Zitat Yin, C., Zhang, S., Yin, Z., Wang, J.: Anomaly detection model based on data stream clustering. Clust. Comput. 22, S1729–S1738 (2019)CrossRef Yin, C., Zhang, S., Yin, Z., Wang, J.: Anomaly detection model based on data stream clustering. Clust. Comput. 22, S1729–S1738 (2019)CrossRef
11.
Zurück zum Zitat Aljawarneh, S., Yassein, M.B., Aljundi, M.: An enhanced J48 classification algorithm for the anomaly intrusion detection systems. Clust. Comput. 22(5), 10549–10565 (2019)CrossRef Aljawarneh, S., Yassein, M.B., Aljundi, M.: An enhanced J48 classification algorithm for the anomaly intrusion detection systems. Clust. Comput. 22(5), 10549–10565 (2019)CrossRef
12.
Zurück zum Zitat Karmakar, K.K., Varadharajan, V., Tupakula, U.: Mitigating attacks in software defined networks. Clust. Comput. 22(4), 1143–1157 (2019)CrossRef Karmakar, K.K., Varadharajan, V., Tupakula, U.: Mitigating attacks in software defined networks. Clust. Comput. 22(4), 1143–1157 (2019)CrossRef
14.
Zurück zum Zitat Jafarian, T., Masdari, M., Ghaffari, A., Majidzadeh, K.: Security anomaly detection in software-defined networking based on a prediction technique. Int. J. Commun Syst 33(14), e4524 (2020)CrossRef Jafarian, T., Masdari, M., Ghaffari, A., Majidzadeh, K.: Security anomaly detection in software-defined networking based on a prediction technique. Int. J. Commun Syst 33(14), e4524 (2020)CrossRef
15.
Zurück zum Zitat Nunes, B.A.A., Mendonca, M., Nguyen, X.-N., Obraczka, K., Turletti, T.: A survey of software-defined networking: past, present, and future of programmable networks. IEEE Commun. Surv. Tutor. 16(3), 1617–1634 (2014)CrossRef Nunes, B.A.A., Mendonca, M., Nguyen, X.-N., Obraczka, K., Turletti, T.: A survey of software-defined networking: past, present, and future of programmable networks. IEEE Commun. Surv. Tutor. 16(3), 1617–1634 (2014)CrossRef
16.
Zurück zum Zitat Xia, W., Wen, Y., Foh, C.H., Niyato, D., Xie, H.: A survey on software-defined networking. IEEE Commun. Surv. Tutor. 17(1), 27–51 (2015)CrossRef Xia, W., Wen, Y., Foh, C.H., Niyato, D., Xie, H.: A survey on software-defined networking. IEEE Commun. Surv. Tutor. 17(1), 27–51 (2015)CrossRef
17.
Zurück zum Zitat Giotis, K., Argyropoulos, C., Androulidakis, G., Kalogeras, D., Maglaris, V.: Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments. Comput. Netw. 62, 122–136 (2014)CrossRef Giotis, K., Argyropoulos, C., Androulidakis, G., Kalogeras, D., Maglaris, V.: Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments. Comput. Netw. 62, 122–136 (2014)CrossRef
18.
Zurück zum Zitat Keogh, E., Lonardi, S., Ratanamahatana, C.A.: Towards parameter-free data mining. In: Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2004. ACM, pp. 206–215 Keogh, E., Lonardi, S., Ratanamahatana, C.A.: Towards parameter-free data mining. In: Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2004. ACM, pp. 206–215
19.
Zurück zum Zitat Braga, R., Mota, E., Passito, A.: Lightweight DDoS flooding attack detection using NOX/OpenFlow. In: IEEE 35th Conference on Local Computer Networks (LCN), 2010. IEEE, pp. 408–415 Braga, R., Mota, E., Passito, A.: Lightweight DDoS flooding attack detection using NOX/OpenFlow. In: IEEE 35th Conference on Local Computer Networks (LCN), 2010. IEEE, pp. 408–415
20.
Zurück zum Zitat Chunhua Zhang, J.S., Sun, G.: Research on the anomaly detection of flow streaming technology in network. In: 4th International Conference on Mechatronics, Materials, Chemistry and Computer Engineering (ICMMCCE), 2015 Chunhua Zhang, J.S., Sun, G.: Research on the anomaly detection of flow streaming technology in network. In: 4th International Conference on Mechatronics, Materials, Chemistry and Computer Engineering (ICMMCCE), 2015
21.
Zurück zum Zitat Trammell, B., Boschi, E.: An introduction to IP flow information export (IPFIX). IEEE Commun. Mag. 49(4), 89–95 (2011)CrossRef Trammell, B., Boschi, E.: An introduction to IP flow information export (IPFIX). IEEE Commun. Mag. 49(4), 89–95 (2011)CrossRef
22.
Zurück zum Zitat Rehman, S.U., Song, W.-C., Kang, M.: Network-wide traffic visibility in OF@ TEIN SDN testbed using sFlow. In: Network Operations and Management Symposium (APNOMS), 2014 16th Asia-Pacific, 2014. IEEE, pp. 1–6 Rehman, S.U., Song, W.-C., Kang, M.: Network-wide traffic visibility in OF@ TEIN SDN testbed using sFlow. In: Network Operations and Management Symposium (APNOMS), 2014 16th Asia-Pacific, 2014. IEEE, pp. 1–6
24.
Zurück zum Zitat Tavallaee, M., Bagheri, E., Lu, W., Ghorbani, A.-A.: A detailed analysis of the KDD CUP 99 data set. In: Proceedings of the Second IEEE Symposium on Computational Intelligence for Security and Defence Applications 2009 Tavallaee, M., Bagheri, E., Lu, W., Ghorbani, A.-A.: A detailed analysis of the KDD CUP 99 data set. In: Proceedings of the Second IEEE Symposium on Computational Intelligence for Security and Defence Applications 2009
25.
Zurück zum Zitat Sathya, R., Thangarajan, R.: Efficient anomaly detection and mitigation in software defined networking environment. In: 2nd International Conference on Electronics and Communication Systems (ICECS), 2015. IEEE, pp. 479–484 Sathya, R., Thangarajan, R.: Efficient anomaly detection and mitigation in software defined networking environment. In: 2nd International Conference on Electronics and Communication Systems (ICECS), 2015. IEEE, pp. 479–484
26.
Zurück zum Zitat Mehdi, S.A., Khalid, J., Khayam, S.A.: Revisiting traffic anomaly detection using software defined networking. In: International Workshop on Recent Advances in Intrusion Detection, 2011. Springer, Berlin, pp. 161–180 Mehdi, S.A., Khalid, J., Khayam, S.A.: Revisiting traffic anomaly detection using software defined networking. In: International Workshop on Recent Advances in Intrusion Detection, 2011. Springer, Berlin, pp. 161–180
27.
Zurück zum Zitat Nadeau, T., Pan, P.: Software driven networks problem statement, 2011 Nadeau, T., Pan, P.: Software driven networks problem statement, 2011
28.
Zurück zum Zitat Xie, H., Tsou, T., Lopez, D., Yin, H., Gurbani, V.: Use cases for ALTO with software defined networks, Working Draft, IETF Secretariat, Internet-Draft draft-xie-alto-sdn-extension-use-cases-01.txt, 2012 Xie, H., Tsou, T., Lopez, D., Yin, H., Gurbani, V.: Use cases for ALTO with software defined networks, Working Draft, IETF Secretariat, Internet-Draft draft-xie-alto-sdn-extension-use-cases-01.txt, 2012
29.
Zurück zum Zitat Kreutz, D., Ramos, F., Verissimo, P.: Towards secure and dependable software-defined networks. In: Proceedings of the Second ACM SIGCOMM WORKSHOP on Hot Topics in Software Defined Networking, 2013. ACM, pp. 55–60 Kreutz, D., Ramos, F., Verissimo, P.: Towards secure and dependable software-defined networks. In: Proceedings of the Second ACM SIGCOMM WORKSHOP on Hot Topics in Software Defined Networking, 2013. ACM, pp. 55–60
30.
Zurück zum Zitat Shin, S., Porras, P., Yegneswaran, V, Gu, G.: A framework for integrating security services into software-defined networks. In: Proceedings of the 2013 Open Networking Summit (Research Track Poster Paper), Ser. ONS, vol. 13, 2013 Shin, S., Porras, P., Yegneswaran, V, Gu, G.: A framework for integrating security services into software-defined networks. In: Proceedings of the 2013 Open Networking Summit (Research Track Poster Paper), Ser. ONS, vol. 13, 2013
31.
Zurück zum Zitat Wen, X., Chen, Y., Hu, C., Shi, C., Wang, Y.: Towards a secure controller platform for openflow applications. In: Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2013. ACM, pp. 171–172 Wen, X., Chen, Y., Hu, C., Shi, C., Wang, Y.: Towards a secure controller platform for openflow applications. In: Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2013. ACM, pp. 171–172
32.
Zurück zum Zitat Hartman, S., Wasserman, M., Zhang, D.: Security requirements in the software defined networking model, IETF Draft (draft-hartman-sdnsec-requirements), 2013 Hartman, S., Wasserman, M., Zhang, D.: Security requirements in the software defined networking model, IETF Draft (draft-hartman-sdnsec-requirements), 2013
33.
Zurück zum Zitat Al-Shaer, E., Al-Haj, S.: FlowChecker: configuration analysis and verification of federated OpenFlow infrastructures. In: Proceedings of the 3rd ACM Workshop on Assurable and Usable Security Configuration, 2010. ACM, pp. 37–44 Al-Shaer, E., Al-Haj, S.: FlowChecker: configuration analysis and verification of federated OpenFlow infrastructures. In: Proceedings of the 3rd ACM Workshop on Assurable and Usable Security Configuration, 2010. ACM, pp. 37–44
34.
Zurück zum Zitat Ferguson, A.D., Guha, A., Place, J., Fonseca, R., Krishnamurthi, S.: Participatory networking. In: Presented as Part of the 2nd USENIX Workshop on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services, 2012 Ferguson, A.D., Guha, A., Place, J., Fonseca, R., Krishnamurthi, S.: Participatory networking. In: Presented as Part of the 2nd USENIX Workshop on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services, 2012
35.
Zurück zum Zitat Fonseca, P., Bennesby, R., Mota, E., Passito, A.: A replication component for resilient OpenFlow-based networking. In: 2012 IEEE Network Operations and Management Symposium, 2012. IEEE, pp. 933–939 Fonseca, P., Bennesby, R., Mota, E., Passito, A.: A replication component for resilient OpenFlow-based networking. In: 2012 IEEE Network Operations and Management Symposium, 2012. IEEE, pp. 933–939
36.
Zurück zum Zitat Jarschel, M., Oechsner, S., Schlosser, D., Pries, R., Goll, S., Tran-Gia, P.: Modeling and performance evaluation of an OpenFlow architecture. In: Proceedings of the 23rd International Teletraffic Congress, 2011. International Teletraffic Congress, pp. 1–7. Jarschel, M., Oechsner, S., Schlosser, D., Pries, R., Goll, S., Tran-Gia, P.: Modeling and performance evaluation of an OpenFlow architecture. In: Proceedings of the 23rd International Teletraffic Congress, 2011. International Teletraffic Congress, pp. 1–7.
37.
Zurück zum Zitat Naous, J., Erickson, D., Covington, G.A., Appenzeller, G., McKeown, N.: Implementing an OpenFlow switch on the NetFPGA platform. In: Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems, 2008. ACM, pp. 1–9 Naous, J., Erickson, D., Covington, G.A., Appenzeller, G., McKeown, N.: Implementing an OpenFlow switch on the NetFPGA platform. In: Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems, 2008. ACM, pp. 1–9
38.
Zurück zum Zitat Shin, S., Gu, G.: Attacking software-defined networks: a first feasibility study. In: Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2013. ACM, pp. 165–166 Shin, S., Gu, G.: Attacking software-defined networks: a first feasibility study. In: Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2013. ACM, pp. 165–166
39.
Zurück zum Zitat Shin, S., Yegneswaran, V., Porras, P., Gu, G.: AVANT-GUARD: scalable and vigilant switch flow management in software-defined networks. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, 2013. ACM, pp. 413–424 Shin, S., Yegneswaran, V., Porras, P., Gu, G.: AVANT-GUARD: scalable and vigilant switch flow management in software-defined networks. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, 2013. ACM, pp. 413–424
40.
Zurück zum Zitat Yao, G., Bi, J., Guo, L.: On the cascading failures of multi-controllers in software defined networks. In: 2013 21st IEEE International Conference on Network Protocols (ICNP), 2013. IEEE, pp. 1–2 Yao, G., Bi, J., Guo, L.: On the cascading failures of multi-controllers in software defined networks. In: 2013 21st IEEE International Conference on Network Protocols (ICNP), 2013. IEEE, pp. 1–2
41.
Zurück zum Zitat Seedorf, J., Burger, E.: Application-Layer Traffic Optimization (ALTO) Problem Statement, 2070–1721, 2009 Seedorf, J., Burger, E.: Application-Layer Traffic Optimization (ALTO) Problem Statement, 2070–1721, 2009
42.
Zurück zum Zitat Benton, K., Camp, L.J., Small, C.: Openflow vulnerability assessment. In: Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2013. ACM, pp. 151–152 Benton, K., Camp, L.J., Small, C.: Openflow vulnerability assessment. In: Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2013. ACM, pp. 151–152
43.
Zurück zum Zitat Liyanage, M., Gurtov, A.: Secured VPN models for LTE backhaul networks. In: Vehicular Technology Conference (VTC Fall), 2012 IEEE, 2012. IEEE, pp. 1–5 Liyanage, M., Gurtov, A.: Secured VPN models for LTE backhaul networks. In: Vehicular Technology Conference (VTC Fall), 2012 IEEE, 2012. IEEE, pp. 1–5
44.
Zurück zum Zitat Staessens, D., Sharma, S., Colle, D., Pickavet, M., Demeester, P.: Software defined networking: meeting carrier grade requirements. In: 18th IEEE Workshop on Local & Metropolitan Area Networks (LANMAN), 2011. IEEE, pp. 1–6 Staessens, D., Sharma, S., Colle, D., Pickavet, M., Demeester, P.: Software defined networking: meeting carrier grade requirements. In: 18th IEEE Workshop on Local & Metropolitan Area Networks (LANMAN), 2011. IEEE, pp. 1–6
45.
Zurück zum Zitat Zhang, Y., Beheshti, N., Tatipamula, M.: On resilience of split-architecture networks. In: Global Telecommunications Conference (GLOBECOM 2011), 2011 IEEE, 2011. IEEE, pp. 1–6 Zhang, Y., Beheshti, N., Tatipamula, M.: On resilience of split-architecture networks. In: Global Telecommunications Conference (GLOBECOM 2011), 2011 IEEE, 2011. IEEE, pp. 1–6
46.
Zurück zum Zitat Lantz, B., Heller, B., McKeown, N.: A network in a laptop: rapid prototyping for software-defined networks. In: Proceedings of the 9th ACM SIGCOMM Workshop on Hot Topics in Networks, 2010. ACM, p. 19 Lantz, B., Heller, B., McKeown, N.: A network in a laptop: rapid prototyping for software-defined networks. In: Proceedings of the 9th ACM SIGCOMM Workshop on Hot Topics in Networks, 2010. ACM, p. 19
47.
Zurück zum Zitat Tootoonchian, A., Ghobadi, M., Ganjali, Y.: OpenTM: traffic matrix estimator for OpenFlow networks. In: International Conference on Passive and Active Network Measurement, 2010, Springer, Berlin, pp. 201–210 Tootoonchian, A., Ghobadi, M., Ganjali, Y.: OpenTM: traffic matrix estimator for OpenFlow networks. In: International Conference on Passive and Active Network Measurement, 2010, Springer, Berlin, pp. 201–210
48.
Zurück zum Zitat Powell, D., Stroud, R.: Conceptual model and architecture of MAFTIA, Technical Report Series-University of Newcastle Upon Tyne Computing Science, 2003 Powell, D., Stroud, R.: Conceptual model and architecture of MAFTIA, Technical Report Series-University of Newcastle Upon Tyne Computing Science, 2003
49.
Zurück zum Zitat Aslam, T.: A taxonomy of security faults in the Unix operating system, Purdue University, 1995 Aslam, T.: A taxonomy of security faults in the Unix operating system, Purdue University, 1995
50.
Zurück zum Zitat Khan, S., Gani, A., Wahab, A.W.A., Shiraz, M., Ahmad, I.: Network forensics: review, taxonomy, and open challenges. J. Netw. Comput. Appl. 66, 214–235 (2016)CrossRef Khan, S., Gani, A., Wahab, A.W.A., Shiraz, M., Ahmad, I.: Network forensics: review, taxonomy, and open challenges. J. Netw. Comput. Appl. 66, 214–235 (2016)CrossRef
51.
Zurück zum Zitat Kumar, S.: Classification and detection of computer intrusions, Purdue University, 1995 Kumar, S.: Classification and detection of computer intrusions, Purdue University, 1995
52.
Zurück zum Zitat Landwehr, C.E., Bull, A.R., McDermott, J.P., Choi, W.S.: A taxonomy of computer program security flaws. ACM Comput. Surv. 26(3), 211–254 (1994)CrossRef Landwehr, C.E., Bull, A.R., McDermott, J.P., Choi, W.S.: A taxonomy of computer program security flaws. ACM Comput. Surv. 26(3), 211–254 (1994)CrossRef
53.
Zurück zum Zitat Lindqvist, U., Jonsson, E.: How to systematically classify computer security intrusions. In: IEEE Symposium on Security and Privacy, 1997. Proceedings 1997. IEEE, pp. 154–163 Lindqvist, U., Jonsson, E.: How to systematically classify computer security intrusions. In: IEEE Symposium on Security and Privacy, 1997. Proceedings 1997. IEEE, pp. 154–163
54.
Zurück zum Zitat Lough, D.L.: A taxonomy of computer attacks with applications to wireless networks, 2001 Lough, D.L.: A taxonomy of computer attacks with applications to wireless networks, 2001
55.
Zurück zum Zitat Howard, J.D.: An analysis of security incidents on the Internet 1989–1995, DTIC Document, 1997 Howard, J.D.: An analysis of security incidents on the Internet 1989–1995, DTIC Document, 1997
56.
Zurück zum Zitat Kendall, K.: A database of computer attacks for the evaluation of intrusion detection systems, DTIC Document, 1999 Kendall, K.: A database of computer attacks for the evaluation of intrusion detection systems, DTIC Document, 1999
57.
Zurück zum Zitat Lin, J.-L., Wang, X.S., Jajodia, S.: Abstraction-based misuse detection: High-level specifications and adaptable strategies. In: Computer Security Foundations Workshop, 1998. Proceedings. 11th IEEE, 1998. IEEE, pp. 190–201 Lin, J.-L., Wang, X.S., Jajodia, S.: Abstraction-based misuse detection: High-level specifications and adaptable strategies. In: Computer Security Foundations Workshop, 1998. Proceedings. 11th IEEE, 1998. IEEE, pp. 190–201
58.
Zurück zum Zitat Altwaijry, H., Algarny, S.: Bayesian based intrusion detection system. J. King Saud Univ. 24(1), 1–6 (2012) Altwaijry, H., Algarny, S.: Bayesian based intrusion detection system. J. King Saud Univ. 24(1), 1–6 (2012)
59.
Zurück zum Zitat Ali, S.T., Sivaraman, V., Radford, A., Jha, S.: A survey of securing networks using software defined networking. IEEE Trans. Reliab. 64(3), 1086–1097 (2015)CrossRef Ali, S.T., Sivaraman, V., Radford, A., Jha, S.: A survey of securing networks using software defined networking. IEEE Trans. Reliab. 64(3), 1086–1097 (2015)CrossRef
60.
Zurück zum Zitat Zhang, Y.: An adaptive flow counting method for anomaly detection in SDN. In: Proceedings of the ninth ACM Conference on Emerging Networking Experiments and Technologies, 2013. ACM, pp. 25–30 Zhang, Y.: An adaptive flow counting method for anomaly detection in SDN. In: Proceedings of the ninth ACM Conference on Emerging Networking Experiments and Technologies, 2013. ACM, pp. 25–30
61.
Zurück zum Zitat Garg, G., Garg, R.: Security of networks using efficient adaptive flow counting for anomaly detection in SDN. Artificial Intelligence and Evolutionary Computations in Engineering Systems, pp. 667–674. Springer, Berlin (2016)CrossRef Garg, G., Garg, R.: Security of networks using efficient adaptive flow counting for anomaly detection in SDN. Artificial Intelligence and Evolutionary Computations in Engineering Systems, pp. 667–674. Springer, Berlin (2016)CrossRef
62.
Zurück zum Zitat Garg, G., Garg, R.: Detecting anomalies efficiently in SDN using adaptive mechanism. In: 2015 Fifth International Conference on Advanced Computing & Communication Technologies, 2015. IEEE, pp. 367–370 Garg, G., Garg, R.: Detecting anomalies efficiently in SDN using adaptive mechanism. In: 2015 Fifth International Conference on Advanced Computing & Communication Technologies, 2015. IEEE, pp. 367–370
64.
Zurück zum Zitat Granby, B.R., Askwith, B., Marnerides, A.K.: SDN-PANDA: software-defined network platform for anomaly detection applications. In: 2015 IEEE 23rd International Conference on Network Protocols (ICNP), 2015. IEEE, pp. 463–466 Granby, B.R., Askwith, B., Marnerides, A.K.: SDN-PANDA: software-defined network platform for anomaly detection applications. In: 2015 IEEE 23rd International Conference on Network Protocols (ICNP), 2015. IEEE, pp. 463–466
65.
Zurück zum Zitat Hommes, S., State, R., Engel, T.: Implications and detection of DoS attacks in OpenFlow-based networks. In: 2014 IEEE Global Communications Conference, 2014. IEEE, pp. 537–543 Hommes, S., State, R., Engel, T.: Implications and detection of DoS attacks in OpenFlow-based networks. In: 2014 IEEE Global Communications Conference, 2014. IEEE, pp. 537–543
66.
Zurück zum Zitat Shin, S., Porras, P.A., Yegneswaran, V., Fong, M.W., Gu, G., Tyson, M.: FRESCO: modular composable security services for software-defined networks. In: NDSS, 2013 Shin, S., Porras, P.A., Yegneswaran, V., Fong, M.W., Gu, G., Tyson, M.: FRESCO: modular composable security services for software-defined networks. In: NDSS, 2013
67.
Zurück zum Zitat Carvalho, L.F., Fernandes, G., Rodrigues, J.J., Mendes, L.S., Proença, M.L.: A novel anomaly detection system to assist network management in SDN environment. In: IEEE International Conference on Communications (ICC), 2017. IEEE, pp. 1–6 Carvalho, L.F., Fernandes, G., Rodrigues, J.J., Mendes, L.S., Proença, M.L.: A novel anomaly detection system to assist network management in SDN environment. In: IEEE International Conference on Communications (ICC), 2017. IEEE, pp. 1–6
68.
Zurück zum Zitat Lee, S., Kim, J., Shin, S., Porras, P., Yegneswaran, V.: Athena: a framework for scalable anomaly detection in software-defined networks. In: 2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2017. IEEE, pp. 249–260 Lee, S., Kim, J., Shin, S., Porras, P., Yegneswaran, V.: Athena: a framework for scalable anomaly detection in software-defined networks. In: 2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2017. IEEE, pp. 249–260
69.
Zurück zum Zitat He, D., Chan, S., Ni, X., Guizani, M.: Software-defined-networking-enabled traffic anomaly detection and mitigation. IEEE Internet Things J. 4(6), 1890–1898 (2017)CrossRef He, D., Chan, S., Ni, X., Guizani, M.: Software-defined-networking-enabled traffic anomaly detection and mitigation. IEEE Internet Things J. 4(6), 1890–1898 (2017)CrossRef
70.
Zurück zum Zitat Carvalho, L.F., Abrão, T., de Souza Mendes, L., Proença, M.L.: An ecosystem for anomaly detection and mitigation in software-defined networking. Expert Syst. Appl. 104, 121–133 (2018)CrossRef Carvalho, L.F., Abrão, T., de Souza Mendes, L., Proença, M.L.: An ecosystem for anomaly detection and mitigation in software-defined networking. Expert Syst. Appl. 104, 121–133 (2018)CrossRef
71.
Zurück zum Zitat Peng, H., Sun, Z., Zhao, X., Tan, S., Sun, Z.: A detection method for anomaly flow in software defined network, IEEE Access, 2018 Peng, H., Sun, Z., Zhao, X., Tan, S., Sun, Z.: A detection method for anomaly flow in software defined network, IEEE Access, 2018
72.
Zurück zum Zitat Schechter, S.E., Jung, J., Berger, A.W.: Fast detection of scanning worm infections. In: International Workshop on Recent Advances in Intrusion Detection, 2004, Springer, New York, pp. 59–81 Schechter, S.E., Jung, J., Berger, A.W.: Fast detection of scanning worm infections. In: International Workshop on Recent Advances in Intrusion Detection, 2004, Springer, New York, pp. 59–81
73.
Zurück zum Zitat Twycross, J., Williamson, M.M.: Implementing and testing a virus throttle. In: Usenix Security, 2003 Twycross, J., Williamson, M.M.: Implementing and testing a virus throttle. In: Usenix Security, 2003
74.
Zurück zum Zitat Williamson, M.M.: Throttling viruses: restricting propagation to defeat malicious mobile code. In: Computer Security Applications Conference, 2002. Proceedings. 18th Annual, 2002. IEEE, pp. 61–68 Williamson, M.M.: Throttling viruses: restricting propagation to defeat malicious mobile code. In: Computer Security Applications Conference, 2002. Proceedings. 18th Annual, 2002. IEEE, pp. 61–68
75.
Zurück zum Zitat Mahoney, M.V.: Network traffic anomaly detection based on packet bytes. In: Proceedings of the 2003 ACM symposium on Applied computing, 2003. ACM, pp. 346–350 Mahoney, M.V.: Network traffic anomaly detection based on packet bytes. In: Proceedings of the 2003 ACM symposium on Applied computing, 2003. ACM, pp. 346–350
76.
Zurück zum Zitat Dotcenko, S., Vladyko, A., Letenko, I.: A fuzzy logic-based information security management for software-defined networks. In: 16th International Conference on Advanced Communication Technology, 2014. IEEE, pp. 167–171 Dotcenko, S., Vladyko, A., Letenko, I.: A fuzzy logic-based information security management for software-defined networks. In: 16th International Conference on Advanced Communication Technology, 2014. IEEE, pp. 167–171
77.
Zurück zum Zitat Kokila, R., Selvi, S.T., Govindarajan, K.: DDoS detection and analysis in SDN-based environment using support vector machine classifier. In: 2014 Sixth International Conference on Advanced Computing (ICoAC), 2014. IEEE, pp. 205–210 Kokila, R., Selvi, S.T., Govindarajan, K.: DDoS detection and analysis in SDN-based environment using support vector machine classifier. In: 2014 Sixth International Conference on Advanced Computing (ICoAC), 2014. IEEE, pp. 205–210
80.
Zurück zum Zitat Yang, C.: Anomaly network traffic detection algorithm based on information entropy measurement under the cloud computing environment. Clust. Comput. 22(4), 8309–8317 (2019)CrossRef Yang, C.: Anomaly network traffic detection algorithm based on information entropy measurement under the cloud computing environment. Clust. Comput. 22(4), 8309–8317 (2019)CrossRef
81.
Zurück zum Zitat Wang, R., Jia, Z., Ju, L.: An entropy-based distributed DDoS detection mechanism in software-defined networking. In: Trustcom/BigDataSE/ISPA, 2015 IEEE, 2015, vol. 1. IEEE, pp. 310–317 Wang, R., Jia, Z., Ju, L.: An entropy-based distributed DDoS detection mechanism in software-defined networking. In: Trustcom/BigDataSE/ISPA, 2015 IEEE, 2015, vol. 1. IEEE, pp. 310–317
82.
Zurück zum Zitat François, J., Festor, O.: Anomaly traceback using software defined networking. In: 2014 IEEE International Workshop on Information Forensics and Security (WIFS), 2014. IEEE, pp. 203–208 François, J., Festor, O.: Anomaly traceback using software defined networking. In: 2014 IEEE International Workshop on Information Forensics and Security (WIFS), 2014. IEEE, pp. 203–208
83.
Zurück zum Zitat Deng, L., Yu, D.: Deep learning: methods and applications. Found. Trends Signal Process. 7(3–4), 197–387 (2014)MathSciNetCrossRef Deng, L., Yu, D.: Deep learning: methods and applications. Found. Trends Signal Process. 7(3–4), 197–387 (2014)MathSciNetCrossRef
85.
Zurück zum Zitat Dey, S.K., Rahman, M.M.: Flow based anomaly detection in software defined networking: a deep learning approach with feature selection method. In: 2018 4th International Conference on Electrical Engineering and Information & Communication Technology (iCEEiCT), 2018, IEEE, pp. 630–635 Dey, S.K., Rahman, M.M.: Flow based anomaly detection in software defined networking: a deep learning approach with feature selection method. In: 2018 4th International Conference on Electrical Engineering and Information & Communication Technology (iCEEiCT), 2018, IEEE, pp. 630–635
86.
Zurück zum Zitat Niyaz, Q., Sun, W., Javaid, A.Y.: A deep learning based DDoS detection system in software-defined networking (SDN), arXiv preprint arXiv:1611.07400, 2016 Niyaz, Q., Sun, W., Javaid, A.Y.: A deep learning based DDoS detection system in software-defined networking (SDN), arXiv preprint arXiv:1611.07400, 2016
87.
Zurück zum Zitat Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., Ghogho, M.: Deep learning approach for network intrusion detection in software defined networking. In: 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), 2016. IEEE, pp. 258–263. Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., Ghogho, M.: Deep learning approach for network intrusion detection in software defined networking. In: 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), 2016. IEEE, pp. 258–263.
88.
Zurück zum Zitat Garg, S., Kaur, K., Kumar, N., Rodrigues, J.J.: Hybrid deep-learning-based anomaly detection scheme for suspicious flow detection in SDN: a social multimedia perspective. IEEE Trans. Multimed. 21(3), 566–578 (2019)CrossRef Garg, S., Kaur, K., Kumar, N., Rodrigues, J.J.: Hybrid deep-learning-based anomaly detection scheme for suspicious flow detection in SDN: a social multimedia perspective. IEEE Trans. Multimed. 21(3), 566–578 (2019)CrossRef
89.
Zurück zum Zitat Li, J., Zhao, Z., Li, R.: Machine learning-based IDS for software-defined 5G network. IET Netw. 7(2), 53–60 (2017)CrossRef Li, J., Zhao, Z., Li, R.: Machine learning-based IDS for software-defined 5G network. IET Netw. 7(2), 53–60 (2017)CrossRef
90.
Zurück zum Zitat da Silva, A.S., Wickboldt, J.A., Granville, L.Z., Schaeffer-Filho, A.: ATLANTIC: a framework for anomaly traffic detection, classification, and mitigation in SDN, in Network Operations and Management Symposium (NOMS), 2016 IEEE/IFIP, 2016. IEEE, pp. 27–35 da Silva, A.S., Wickboldt, J.A., Granville, L.Z., Schaeffer-Filho, A.: ATLANTIC: a framework for anomaly traffic detection, classification, and mitigation in SDN, in Network Operations and Management Symposium (NOMS), 2016 IEEE/IFIP, 2016. IEEE, pp. 27–35
91.
Zurück zum Zitat Pang, C., Jiang, Y., Li, Q.: FADE: detecting forwarding anomaly in software-defined networks. In: 2016 IEEE International Conference on Communications (ICC), 22–27 May 2016, pp. 1–6 Pang, C., Jiang, Y., Li, Q.: FADE: detecting forwarding anomaly in software-defined networks. In: 2016 IEEE International Conference on Communications (ICC), 22–27 May 2016, pp. 1–6
92.
Zurück zum Zitat Shin, S., Gu, G.: CloudWatcher: network security monitoring using OpenFlow in dynamic cloud networks (or: How to provide security monitoring as a service in clouds?). In 2012 20th IEEE International Conference on Network Protocols (ICNP), 2012. IEEE, pp. 1–6 Shin, S., Gu, G.: CloudWatcher: network security monitoring using OpenFlow in dynamic cloud networks (or: How to provide security monitoring as a service in clouds?). In 2012 20th IEEE International Conference on Network Protocols (ICNP), 2012. IEEE, pp. 1–6
93.
Zurück zum Zitat Jafarian, J.H., Al-Shaer, E., Duan, Q.: Openflow random host mutation: transparent moving target defense using software defined networking. In: Proceedings of the First Workshop on Hot Topics in Software Defined Networks, 2012. ACM, pp. 127–132 Jafarian, J.H., Al-Shaer, E., Duan, Q.: Openflow random host mutation: transparent moving target defense using software defined networking. In: Proceedings of the First Workshop on Hot Topics in Software Defined Networks, 2012. ACM, pp. 127–132
95.
Zurück zum Zitat Ding, A.Y., Crowcroft, J., Tarkoma, S., Flinck, H.: Software defined networking for security enhancement in wireless mobile networks. Comput. Netw. 66, 94–101 (2014)CrossRef Ding, A.Y., Crowcroft, J., Tarkoma, S., Flinck, H.: Software defined networking for security enhancement in wireless mobile networks. Comput. Netw. 66, 94–101 (2014)CrossRef
96.
Zurück zum Zitat Jin, X., Li, L.E., Vanbever, L., Rexford, J.: Softcell: scalable and flexible cellular core network architecture. In: Proceedings of the ninth ACM Conference on Emerging Networking Experiments and Technologies, 2013. ACM, pp. 163–174 Jin, X., Li, L.E., Vanbever, L., Rexford, J.: Softcell: scalable and flexible cellular core network architecture. In: Proceedings of the ninth ACM Conference on Emerging Networking Experiments and Technologies, 2013. ACM, pp. 163–174
97.
Zurück zum Zitat Gudipati, A., Perry, D., Li, L.E., Katti, S.: SoftRAN: software defined radio access network. In: Proceedings of the second ACM SIGCOMM workshop on Hot topics in software defined networking, 2013. ACM, pp. 25–30 Gudipati, A., Perry, D., Li, L.E., Katti, S.: SoftRAN: software defined radio access network. In: Proceedings of the second ACM SIGCOMM workshop on Hot topics in software defined networking, 2013. ACM, pp. 25–30
98.
Zurück zum Zitat Bansal, M., Mehlman, J., Katti, S., Levis, P.: Openradio: a programmable wireless dataplane. In: Proceedings of the first workshop on Hot topics in software defined networks, 2012. ACM, pp. 109–114 Bansal, M., Mehlman, J., Katti, S., Levis, P.: Openradio: a programmable wireless dataplane. In: Proceedings of the first workshop on Hot topics in software defined networks, 2012. ACM, pp. 109–114
99.
Zurück zum Zitat Shirali-Shahreza, S., Ganjali, Y.: Efficient implementation of security applications in OpenFlow controller with FleXam. In: 2013 IEEE 21st Annual Symposium on High-Performance Interconnects, 2013. IEEE, pp. 49–54 Shirali-Shahreza, S., Ganjali, Y.: Efficient implementation of security applications in OpenFlow controller with FleXam. In: 2013 IEEE 21st Annual Symposium on High-Performance Interconnects, 2013. IEEE, pp. 49–54
100.
Zurück zum Zitat Wang, B., Zheng, Y., Lou, W., Hou, Y.T.: DDoS attack protection in the era of cloud computing and software-defined networking. Comput. Netw. 81, 308–319 (2015)CrossRef Wang, B., Zheng, Y., Lou, W., Hou, Y.T.: DDoS attack protection in the era of cloud computing and software-defined networking. Comput. Netw. 81, 308–319 (2015)CrossRef
101.
Zurück zum Zitat Seeber, S., Rodosek, G.D.: Improving network security through SDN in cloud scenarios. In: 10th International Conference on Network and Service Management (CNSM) and Workshop, 2014. IEEE, pp. 376–381 Seeber, S., Rodosek, G.D.: Improving network security through SDN in cloud scenarios. In: 10th International Conference on Network and Service Management (CNSM) and Workshop, 2014. IEEE, pp. 376–381
102.
Zurück zum Zitat Tsugawa, M., Matsunaga, A., Fortes, J.A.: Cloud computing security: what changes with software-defined networking? Secure Cloud Computing, pp. 77–93. Springer, Berlin (2014)CrossRef Tsugawa, M., Matsunaga, A., Fortes, J.A.: Cloud computing security: what changes with software-defined networking? Secure Cloud Computing, pp. 77–93. Springer, Berlin (2014)CrossRef
104.
Zurück zum Zitat Martins, J., et al.: ClickOS and the art of network function virtualization. In: Proceedings of the 11th USENIX Conference on Networked Systems Design and Implementation, 2014. USENIX Association, pp. 459–473 Martins, J., et al.: ClickOS and the art of network function virtualization. In: Proceedings of the 11th USENIX Conference on Networked Systems Design and Implementation, 2014. USENIX Association, pp. 459–473
Metadaten
Titel
A survey and classification of the security anomaly detection mechanisms in software defined networks
verfasst von
Tohid Jafarian
Mohammad Masdari
Ali Ghaffari
Kambiz Majidzadeh
Publikationsdatum
18.09.2020
Verlag
Springer US
Erschienen in
Cluster Computing / Ausgabe 2/2021
Print ISSN: 1386-7857
Elektronische ISSN: 1573-7543
DOI
https://doi.org/10.1007/s10586-020-03184-1

Weitere Artikel der Ausgabe 2/2021

Cluster Computing 2/2021 Zur Ausgabe