Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments

Computer Networks

Volumn 62, Issue , 2014, Pages 122-136

  Giotis, K ^a   Argyropoulos, C ^a   Androulidakis, G ^a   Kalogeras, D ^a   Maglaris, V ^a  

^a NATIONAL TECHNICAL UNIVERSITY OF ATHENS NTUA   (Greece)

Author keywords

Anomaly detection; Attack mitigation; OpenFlow; SDN; sFlow; Software Defined Networking

Indexed keywords

INTERNATIONAL TRADE;

ANOMALY DETECTION; ATTACK MITIGATION; OPENFLOW; SDN; SFLOW; SOFTWARE-DEFINED NETWORKINGS;

NETWORK ARCHITECTURE;

EID: 84897109717     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.bjp.2013.10.014     Document Type: Article

References (34)

1. Open Networking Foundation, Software-Defined Networking: The New Norm for Networks, ONF White Paper. < https://www.opennetworking.org/ >.
2. Nick McKeown et al. OpenFlow: enabling innovation in campus networks ACM SIGCOMM Comput. Commun. Rev. 38 2 2008 69 74
3. P. Phaal, sFlow Specification Version 5, July 2004.
4. M.S. Kim, H.J. Kong, S.C. Hong, S.H. Chung, J. Hong, A flow-based method for abnormal network traffic detection, in: Network Operations and Management Symposium, 2004. NOMS 2004. IEEE/IFIP, vol. 1, pp. 599-612.
5. A. Lakhina, M. Crovella, C. Diot, Mining anomalies using traffic feature distributions, in ACM SIGCOMM, 2005, pp. 217-228. (Pubitemid 46323506)
6. Daniela Brauckhoff, Martin May, and Bernhard Plattner, Flow-Level anomaly detection - blessing or curse? in: IEEE INFOCOM 2007, Student Workshop, Anchorage, 2007.
7. Georgios Androulidakis, Vassilis Chatzigiannakis, and Symeon Papavassiliou Network anomaly detection and classification via opportunistic sampling IEEE Network: Mag. Global Internetworking - Special Issue Title Recent Develop. Network Intrusion Detect. 23 1 2009 6 12
8. Arno Wagner, Bernhard Plattner, Entropy based worm and anomaly detection in fast IP networks, in: WETICE '05 Proceedings of the 14th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprise, 2005, pp. 178-177.
9. Teemu Koponen et al. Onix: a distributed control platform for large-scale production networks Proceedings of the 9th USENIX Conference on Operating Systems Design and Implementation 2012 Vancouver BC, Canada 1 6
10. Amin Tootoonchian, and Yashar Ganjali HyperFlow: a distributed control plane for OpenFlow Proceedings of the 2010 Internet Network Management Conference on Research on Enterprise Networking (INM/WREN'10) 2010 USENIX Association Berkeley, CA, USA 3
11. Nate Foster et al., Frenetic: a high-level language for OpenFlow networks, in: Proceedings of the Workshop on Programmable Routers for Extensible Services of Tomorrow (PRESTO '10), 2010.
12. Lalith Suresh, Julius Schulz-Zander, Ruben Merz, Anja Feldmann, Teresa Vazao, Towards programmable enterprise WLANS with Odin, in: Proceedings of the First Workshop on Hot Topics in Software Defined Networks (HotSDN '12), 2012.
13. Rodrigo Braga, Edjard Mota, Alexandre Passito, Lightweight DDoS flooding attack detection using NOX/OpenFlow, in: LCN '10 Proceedings of the 2010 IEEE 35th Conference on Local, Computer, 2010, pp. 408-415.
14. Syed Akbar Mehdi, Junaid Khalid, Syed Ali Khayam, Revisiting traffic anomaly detection using software defined networking, in: RAID'11 Proceedings of the 14th International Conference on Recent Advances in Intrusion Detection, 2011, pp. 161-180.
15. Ed.B. Claise, Cisco Systems NetFlow Services Export Version 9, RFC 3954, October 2004.
16. The OpenFlow specification version 1.0.0. < http://OpenFlowSwitch.org >.
17. P. Phaal, S. Panchen, N. McKee, InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks, IETF, RFC 3176, 2001.
18. Christos Siaterlis, and Vasilis Maglaris One step ahead to multisensor data fusion for DDoS detection J. Comput. Sec. 13 5 2005 779 806 (Pubitemid 41767398)
19. Le The Quyen, Marat Zhanikeev, Yoshiaki Tanaka, Detecting and identifying network anomalies by component analysis, in: APNOMS'06 Proceedings of the 9th Asia-Pacific International Conference on Network Operations and Management: Management of Convergence Networks and Services, 2006, pp. 501-504. (Pubitemid 44681322)
20. S. Staniford, J.A. Hoagland, and J.M. McAlerney Practical automated detection of stealthy portscans J. Comput. Sec. 10 2002 105 136 (Pubitemid 34531414)
21. Tarem Ahmed, Boris Oreshkin, Mark Coates, Machine learning approaches to network anomaly detection, in: SYSML'07 Proceedings of the 2nd USENIX Workshop on Tackling Computer Systems Problems with Machine Learning Techniques, 2007.
22. Su-Yun Wu, and Yen Ester Data mining-based intrusion detectors Expert Syst. Appl. 36 3 2009 5605 5612
23. P. García-Teodoro, J. Díaz-Verdejo, G. Maciá- Fernández, and E. Vázquez Anomaly-based network intrusion detection: techniques, systems and challenges Comput. Sec. (Elsevier) 28 1-2 2009 18 28
24. Animesh Patcha, and Jung-Min Park An overview of anomaly detection techniques: Existing solutions and latest technological trends Comput. Netw.: Int. J. Comput. Telecommun. Netw. 51 12 2007 3448 3470 (Pubitemid 46921030)
25. Justin Pettit, Jesse Gross, Ben Plaff, Martin Casado, Simon Crosby, Virtual switching in an era of advanced Edges, in: 2nd Workshop on Data Center - Converged and Virtual Ethernet Switching (DC-CAVES), ITC 22, September 2010.
26. S. Shah, A. Nucci, M. Munafo, R. Cruz, and S. Muthukrishnan DoWitcher: effective worm detection and containment in the internet core INFOCOM 2007. 26th IEEE International Conference on Computer Communications 2007 IEEE 2541 2545 (Pubitemid 47334517)
27. Nox Repository Website. < http://www.noxrepo.org/ >.
28. Natasha Gude et al. NOX: towards an operating system for networks ACM SIGCOMM Comput. Commun. Rev. 38 3 2008 105 110
29. Ben Plaff et al., Extending networking into the virtualization layer, in: 8th ACM Workshop on Hot Topics in Networks (HotNets-VIII), New York, City, 2009.
30. Luca Deri, and Stefano Suin Effective traffic measurement using ntop IEEE Commun. Mag. 38 5 2000 138 143
31. Tcpreplay. < http://tcpreplay.synfin.net >.
32. SCAPY. < http://hg.secdev.org/scapy >.
33. Stuart E. Schechter, Jaeyon Jung, Arthur W. Berger, Fast detection of scanning worm infections, in: Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID), 2004.
34. Jaeyon Jung, Vern Paxson, Arthur W. Berger, Hari Balakrishnan, Fast portscan detection using sequential hypothesis testing, in: Proc. IEEE Symposium on Security and Privacy, 2004.