SeReNe: On Establishing Secure and Resilient Networking Services for an SDN-based Multi-tenant Datacenter Environment

Proceedings - 2015 45th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2015

Volumn , Issue , 2015, Pages 4-11

  Chung, Chun Jen ^a   Xing, Tianyi ^a   Huang, Dijiang ^a   Medhi, Deep ^b   Trivedi, Kishor ^c  

^a ARIZONA STATE UNIVERSITY   (United States)

^b UNIVERSITY OF MISSOURI KANSAS CITY   (United States)

^c DUKE UNIVERSITY   (United States)

Author keywords

multi tenant datacenter; security and resilience

Indexed keywords

APPLICATION PROGRAMS; BANDWIDTH; COST ENGINEERING; FREQUENCY ALLOCATION; TELECOMMUNICATION TRAFFIC; TOPOLOGY;

DATACENTER; DEFENSIVE MECHANISM; EFFECTIVENESS OF COUNTERMEASURES; MOVING TARGET DEFENSE; NETWORK SECURITY SITUATIONS; NETWORKING ENVIRONMENT; NETWORKING SERVICES; SECURITY AND RESILIENCE;

NETWORK SECURITY;

EID: 84957679321     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DSN-W.2015.25     Document Type: Conference Paper

References (57)

1. "Openflow." [Online]. Available: http://www.openflow.org/wp/learnmore/
2. "Network Function Virtualization," available at http://en.wikipedia.org/wiki/Network-Functions-Virtualization.
3. Coud Sercurity Alliance, "Top threats to cloud computing v1.0," https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf, March 2010.
4. C.-J. Chung, J. Cui, P. Khatkar, and D. Huang, "Non-intrusive process-based monitoring system to mitigate and prevent VM vulnerability explorations." ICST, 2013.
5. C.-J. Chung, P. Khatkar, T. Xing, J. Lee, and D. Huang, "NICE: network intrusion detection and countermeasure selection in virtual network systems," IEEE Transactions on Dependable and Secure Computing, vol. 10, no. 4, pp. 198-211, 2013.
6. -, "Nice: Network intrusion detection and countermeasure selection in virtual network systems," IEEE Transactions on Dependable and Secure Computing (TDSC), Special Issue on Cloud computing Assessment: metrics, algorithms, policies, models, and evaluation techniques, pre-print, avaialble at http://dj.eas.asu.edu/snac/document/tdsc-vinice-v8.pdf, 2012.
7. A. Roy, D. S. Kim, and K. S. Trivedi, "Scalable optimal countermeasure selection using implicit enumeration on attack countermeasure trees," in IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2012, Boston, MA, USA, June 25-28, 2012, 2012, pp. 1-12.
8. R. Ghosh, F. Longo, F. Frattini, S. Russo, and K. S. Trivedi, "Scalable analytics for iaas cloud availability," IEEE T. Cloud Computing, vol. 2, no. 1, pp. 57-70, 2014.
9. G. Cormode, F. Korn, S. Muthukrishnan, and D. Srivastava, "Finding hierarchical heavy hitters in data streams," in Proceedings of the 29th International Conference on Very Large Data Bases - Volume 29, ser. VLDB '03. Berlin, Germany: VLDB Endowment, 2003, p. 464475.
10. C. Callegari, S. Giordano, M. Pagano, and T. Pepe, "Detecting anomalies in backbone network traffic: a performance comparison among several change detection methods," International Journal of Sensor Networks, vol. 11, no. 4, pp. 205-214, Jan. 2012.
11. C. Callegari, A. Coluccia, A. DAlconzo, W. Ellens, S. Giordano, M. Mandjes, M. Pagano, T. Pepe, F. Ricciato, and P. Zuraniewski, "A methodological overview on anomaly detection," in Data Traffic Monitoring and Analysis, ser. Lecture Notes in Computer Science, E. Biersack, C. Callegari, and M. Matijasevic, Eds. Springer Berlin Heidelberg, Jan. 2013, no. 7754, pp. 148-183. [Online]. Available: http://link.springer.com.ezproxy1.lib.asu.edu/chapter/10.1007/978-3-642-36784-7-7
12. "The networking and information technology research and development program," available at http://www.whitehouse.gov/sites/default/files/microsites/ostp/NITRD-FY15-Final.pdf, 2014.
13. "Darpa cyber fault tolerant recovery program," available at https://www.fbo.gov/index?s=opportunity&mode=form&id=43b09e88c3b8289cb4cbf63b402f46c5&tab=core&-cview=1, 2014.
14. "Adversarial and uncertain reasoning for adaptive cyber defense: Building the scientific foundations," available at http://csis.gmu.edu/pages/projects/ACD-MURI.html, 2013.
15. R. Zhuang, S. A. DeLoach, and X. Ou, "Towards a theory of moving target defense," in Proceedings of the First ACM Workshop on Moving Target Defense. ACM, 2014, pp. 31-40.
16. S. Jajodia, A. K. Ghosh, V. Subrahmanian, V. Swarup, C. Wang, and X. S. Wang, Moving Target Defense II. Springer, 2013.
17. J. Xu, P. Guo, M. Zhao, R. F. Erbacher, M. Zhu, and P. Liu, "Comparing different moving target defense techniques," in Proceedings of the First ACM Workshop on Moving Target Defense. ACM, 2014, pp. 97-107.
18. J. H. H. Jafarian, E. Al-Shaer, and Q. Duan, "Spatio-temporal address mutation for proactive cyber agility against sophisticated attackers," in Proceedings of the First ACM Workshop on Moving Target Defense. ACM, 2014, pp. 69-78.
19. S. B. Mark Murphy, Per Larsen and M. Franz, "Software profiling options and their effects on security based code diversification," in Proceedings of the First ACM Workshop on Moving Target Defense. ACM, 2014.
20. P. E. Ammann and J. C. Knight, "Data diversity: An approach to software fault tolerance," Computers, IEEE Transactions on, vol. 37, no. 4, pp. 418-425, 1988.
21. K. M. Carter, J. F. Riordan, and H. Okhravi, "A game theoretic approach to strategy determination for dynamic platform defenses," in Proceedings of the First ACM Workshop on Moving Target Defense. ACM, 2014, pp. 21-30.
22. T. Hobson, H. Okhravi, D. Bigelow, R. Rudd, and W. Streilein, "On the challenges of effective movement," in Proceedings of the First ACM Workshop on Moving Target Defense. ACM, 2014, pp. 41-50.
23. C. YuHunag, T. MinChi, C. YaoTing, C. YuChieh, and C. YanRen, "A novel design for future on-demand service and security," in 2010 12th IEEE International Conference on Communication Technology (ICCT), 2010, pp. 385-388.
24. R. Braga, E. Mota, and A. Passito, "Lightweight DDoS flooding attack detection using NOX/OpenFlow," in 2010 IEEE 35th Conference on Local Computer Networks (LCN), Oct. 2010, pp. 408-415.
25. G. Yao, J. Bi, and P. Xiao, "Source address validation solution with OpenFlow/NOX architecture," in 2011 19th IEEE International Conference on Network Protocols (ICNP), Oct. 2011, pp. 7 -12.
26. J. H. Jafarian, E. Al-Shaer, and Q. Duan, "Openflow random host mutation: transparent moving target defense using software defined networking," in Proceedings of the first workshop on Hot topics in software defined networks, ser. HotSDN '12. New York, NY, USA: ACM, 2012, pp. 127-132.
27. S. Gutz, A. Story, C. Schlesinger, and N. Foster, "Splendid isolation: A slice abstraction for software-defined networks," in Proceedings of the First Workshop on Hot Topics in Software Defined Networks, ser. HotSDN '12. New York, NY, USA: ACM, 2012, pp. 79-84.
28. M. Platania, D. Obenshain, T. Tantillo, R. Sharma, and Y. Amir, "Towards a practical survivable intrusion tolerant replication system," in Proc. 33rd Symposium on Reliabbe and Distributed Systems, 2014, pp. 242-252.
29. C. Guo, G. Lu, H. J. Wang, S. Yang, C. Kong, P. Sun, W. Wu, and Y. Zhang, "SecondNet: a data center network virtualization architecture with bandwidth guarantees," in Proceedings of ACM Co-NEXT'2010, Philadelphia, Pennsylvania, 2010, pp. 15:1-15:12.
30. T. Xing, Z. Xiong, D. Huang, and D. Medhi, "Cloud security," in Cloud Services, Networking and Management (eds. N. Fonseca and R. Boutaba). IEEE and Wiley, 2015.
31. "OpenStack Open Source Cloud Computing Software," available at http://www.openstack.org, 2011.
32. J. Francois, I. Aib, and R. Boutaba, "FireCol: a collaborative protection network for the detection of flooding DDoS attacks," IEEE/ACM Transactions on Networking, vol. PP, no. 99, p. 1, 2012.
33. "OpenStack Heat," available at https://wiki.openstack.org/wiki/Heat.
34. "OpenStack MAAS/JuJu," available at https://maas.ubuntu.com/docs/juju-quick-start.html.
35. "Puppet Software," available at http://puppetlabs.com/.
36. O. Database, "Open source vulnerability database (OVSDB)," http://osvdb.org/.
37. Mitre Corporation, "Common vulnerabilities and exposures, CVE," http://cve.mitre.org/.
38. NIST, "National vulnerability database, NVD," http://nvd.nist.gov.
39. K. Kwon, S. Ahn, and J. Chung, "Network security management using ARP spoofing," in Computational Science and Its Applications - ICCSA 2004, ser. Lecture Notes in Computer Science. Springer Berlin / Heidelberg, 2004, vol. 3043, pp. 142-149.
40. M. Grottke and K. S. Trivedi, "Fighting bugs: Remove, retry, replicate, and rejuvenate," Computer, vol. 40, no. 2, pp. 107-109, Feb. 2007.
41. K. Vaidyanathan and K. Trivedi, "A comprehensive model for software rejuvenation," Dependable and Secure Computing, IEEE Transactions on, vol. 2, no. 2, pp. 124-137, April 2005.
42. M. Grottke and B. Schleich, "How does testing affect the availability of aging software systems?" Perform. Eval., vol. 70, no. 3, pp. 179-196, 2013.
43. J. Zhao, Y. Wang, G. Ning, K. S. Trivedi, R. M. Jr., and K. Cai, "A comprehensive approach to optimal software rejuvenation," Perform. Eval., vol. 70, no. 11, pp. 917-933, 2013.
44. J. Zhao, Y. Jin, K. S. Trivedi, R. M. Jr., and Y. Wang, "Software rejuvenation scheduling using accelerated life testing," JETC, vol. 10, no. 1, p. 9, 2014.
45. R. Matias, A. Andrzejak, F. Machida, D. Elias, and K. Trivedi, "A systematic differential analysis for fast and robust detection of software aging," in 33rd Int. Symp. on Reliable Distributed Systems, October 2014.
46. M. Malaika, S. Nair, and F. Coyle, "N-version architectural framework for application security automation (nvasa)," in CrossTalk, The Journal of Defense Software Engineering (DoD), 2014.
47. J. Gray, "Why do computers stop and what can be done about it?" in Proc. 5th Symposium on Reliability in Distributed Software and Database Systems, 1986, pp. 3-12.
48. K. Trivedi, D. Wang, D. J. Hunt, A. Rindos, W. E. Smith, and B. Vashaw, "Availability modeling of sip protocol on ibm©websphere©," in Dependable Computing, 2008. PRDC '08. 14th IEEE Pacific Rim International Symposium on, Dec 2008, pp. 323-330.
49. D. Cotroneo, M. Grottke, R. Natella, R. Pietrantuono, and K. Trivedi, "Fault triggers in open-source software: An experience report," in Software Reliability Engineering (ISSRE), 2013 IEEE 24th International Symposium on, Nov 2013, pp. 178-187.
50. K. Trivedi, R. Mansharamani, D. Kim, M. Grottke, and M. Nambiar, "Recovery from failures due to mandelbugs in it systems," in 2013 IEEE 19th Pacific Rim International Symposium on Dependable Computing, vol. 0, Los Alamitos, CA, USA, 2011, pp. 224-233.
51. D. Cavezza, R. Pietrantuono, J. Alonso, S. Russo, and K. Trivedi, "Reproducibility of environment-dependent software failures: an experience report," in Int. Symp. on Software Reliability Engineering, 2014, pp. 1-9.
52. J. Alonso, M. Rivalino, E. Vicente, A. Maria, and K. Trivedi, "A comparative experimental study of software rejuvenation overhead," Perform. Eval., vol. 70, no. 3, pp. 231-250, 2013.
53. M. Grottke, A. Nikora, and K. Trivedi, "An empirical investigation of fault types in space mission system software," in Dependable Systems and Networks (DSN), 2010 IEEE/IFIP International Conference on, June 2010, pp. 447-456.
54. J. Alonso, M. Grottke, A. Nikora, and K. Trivedi, "The nature of the times to flight software failure during space missions," in Software Reliability Engineering (ISSRE), 2012 IEEE 23rd International Symposium on, Nov 2012, pp. 331-340.
55. "Apache hadoop." [Online]. Available: http://hadoop.apache.org/
56. "Apache giraph." [Online]. Available: http://giraph.apache.org/
57. "Apache Spark," available at https://spark.apache.org/.