Cloud Security

Cloud Services, Networking, and Management

Volumn , Issue , 2015, Pages 269-294

  Xing, Tianyi ^a   Xiong, Zhengyang ^a   Qian, Haiyang ^b   Medhi, Deep ^c   Huang, Dijiang ^d  

^a ARIZONA STATE UNIVERSITY   (United States)

^b China Mobile Technology   (United States)

^c UNIVERSITY OF MISSOURI KANSAS CITY   (United States)

^d ARIZONA STATE UNIVERSITY   (United States)

Author keywords

Cloud security; FlowIPS design; IDPS solution; Network reconfiguration (NR) features; POX controllers; Software defined networking (SDN)

Indexed keywords

INTRUSION DETECTION; SOFTWARE DEFINED NETWORKING;

CLOUD SECURITIES; INTRUSION DETECTION AND PREVENTION SYSTEMS; INTRUSION DETECTION SYSTEMS; INTRUSION PREVENTION; NETWORK RE-CONFIGURATION; PERFORMANCE EVALUATIONS; SOFTWARE DEFINED NETWORKING (SDN); TECHNICAL BACKGROUND;

NETWORK SECURITY;

EID: 85015506899     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1002/9781119042655.ch11     Document Type: Chapter

References (44)

1. T. Xing, D. Huang, L. Xu, C.-J. Chung, and P. Khatkar, "Snortflow: A openflow-based intrusion prevention system in cloud environment, "in GENI Research and Educational Experiment Workshop, GREE, Salt Lake City, UT, 2013.
2. C.-J. Chung, P. Khatkar, T. Xing, J. Lee, and D. Huang, "Nice: Network intrusion detection and countermeasure selection in virtual network systems, "in IEEE Transactions on Dependable and Secure Computing (TDSC), Special Issue on Cloud Computing Assessment, vol. 10, no. 4, pp. 198-211, 2013.
3. C. C. S. Alliance, "Top threats to cloud computing v1.0, "in Cloud Security Alliance, 2010.
4. K. Kell, "Ec2 security revisited, "in Online Blog, 2013.
5. "SourceFire Inc." [Online]. Available: http://www.snort.org.
6. "Suricata Inc." [Online]. Available: http://suricata-ids.org.
7. W. Morton, "Intrusion prevention straitegies for cloud computing, "2011.
8. N. Gude, T. Koponen, J. Pettit, B. Pfaff, M. Casado, N. McKeown, and S. Shenkes, "Nox: Towards an operating system for networks, "in ACM SIGCOMM Computer Communication Review, Vol. 38, no. 3, pp. 105-110, July 2008.
9. "Citrix Systems, Inc." [Online]. Available: http://www.citrix.com/products/xenserver.
10. "KVM." [Online]. Available: http://www.linux-kvm.org.
11. R. U. Rehman, Intrusion Detection Systems with Snort: Advanced IDS Techniques Using Snort, Apache, MySQL, PHP, and ACID. Prentice Hall Professional, Upper Saddle River, NJ, 2003.
12. V. Sekar, R. Krishnaswamy, A. Gupta, and M. K. Reiter, "Network-wide deployment of intrusion detection and prevention systems, "in Proceedings of the 6th International Conference, ser. Co-NEXT '10. New York, NY, USA: ACM, 2010, pp. 18:1-18:12. [Online]. Available: http://doi.acm.org/10.1145/1921168.1921192.
13. C. Kruegel, F. Valeur, G. Vigna, and R. Kemmerer, "Stateful intrusion detection for high-speed network's, "in Proceedings. 2002 IEEE Symposium on Security and Privacy, 2002. Oakland, CA, 2002, pp. 285-293.
14. K. Vieira, A. Schulter, C.Westphall, and C.Westphall, "Intrusion detection for grid and cloud computing, "IT Professional, vol. 12, no. 4, pp. 38-43, July 2010.
15. S. Roschke, F. Cheng, and C. Meinel, "An extensible and virtualization-compatible IDs management architecture, "in Fifth International Conference on Information Assurance and Security, 2009 (IAS '09). vol. 2, Xi'An, China, 2009, pp. 130-134.
16. J. Francois, I. Aib, and R. Boutaba, "Firecol: A collaborative protection network for the detection of flooding ddos attacks, "IEEE/ACM Transactions on Networking, vol. 20, no. 6, pp. 1828-1841, Dec 2012.
17. R. Braga, E. Mota, and A. Passito, "Lightweight DDoS flooding attack detection using nox/openflow, "in 2010 IEEE 35th Conference on Local Computer Networks (LCN), Denever, CO, Oct 2010, pp. 408-415.
18. S. Yu, Y. Tian, S. Guo, and D.Wu, "Can we beat DDoS attacks in clouds?, "IEEE Transactions on Parallel and Distributed Systems, vol. 25, no. 9, pp. 2245-2254, September 2014.
19. G. Yan, R. Lee, A. Kent, and D. Wolpert, "Towards a Bayesian network game framework for evaluating DDoS attacks and defense, "in Proceedings of the 2012 ACM Conference on Computer and Communications Security, ser. CCS '12. New York: ACM, 2012, pp. 553-566. [Online]. Available: http://doi.acm.org/10.1145/2382196.2382255.
20. M. T. Goodrich, "Probabilistic packet marking for large-scale ip traceback, "IEEE/ACMTransactions on Networking, vol. 16, no. 1, pp. 15-24, Feb. 2008. [Online]. Available: http:// dx.doi.org/10.1109/TNET.2007.910594.
21. A. Belenky and N. Ansari, "IP traceback with deterministic packet marking, "IEEE Communications Letters, vol. 7, no. 4, pp. 162-164, 2003.
22. S. Yu, W. Zhou, R. Doss, and W. Jia, "Traceback of ddos attacks using entropy variations, "IEEE Transactions on Parallel and Distributed Systems, vol. 22, no. 3, pp. 412-425, 2011.
23. B. Koldehofe, F. Durr, M. A. Tariq, and K. Rothermel, "The power of software-defined networking: Line-rate content-based routing using openflow, "in Proceedings of the 7thWorkshop on Middleware for Next Generation Internet Computing, MW4NG '12. New York: ACM, 2012, pp. 3:1-3:6.
24. R. Kappor, G. Porter, M. Tewari, G. M. Voelker, and A. Vahdat, "Chronos: Predictable low latency for data center applications, "in Proceedings of the Third ACM Symposium on Cloud Computing, SoCC '12. New York: ACM, 2012, pp. 9:1-9:14.
25. M. Suchara, D. Xu, R. Doverspike, D. Johnson, and J. Rexford, "Network architecture for joint failure recovery and traffic engineering, "in Proceedings of the ACM SIGMETRICS Joint International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS '11, New York: ACM, 2011, pp. 97-108.
26. M. R. Nascimento, C. E. Rothenberg, M. R. Salvador, and M. F. Magalhaes, "QuagFlow: Partnering quagga with openflow, "in Proceedings of the ACM SIGCOMM 2010 Conference, SIGCOMM '10. New York: ACM, 2010, pp. 441-442.
27. S. Shin and G. Gu, "Cloudwatcher: Network security monitoring using openflow in dynamic cloud networks (or: How to provide security monitoring as a service in clouds?), "in Proceedings of the 2012 20th IEEE International Conference on Network Protocols (ICNP), ser. ICNP '12. Washington, DC: IEEE Computer Society, 2012, pp. 1-6. [Online]. Available: http://dx.doi.org/10.1109/ICNP.2012.6459946.
28. J. R. Ballard, I. Rae, and A. Akella, "Extensible and scalable network monitoring using openSAFE, "in Proceedings of the 2010 Internet Network Management Conference on Research on Enterprise Networking, INM/WREN '10. Berkeley, CA: USENIX Association, 2010, p. 8.
29. N. L. van Adrichem, C. Doerr, and F. A. Kuipers, "Opennetmon: Network monitoring in openflow software-defined networks, "in Network Operations and Management Symposium (NOMS). IEEE, 2014.
30. P. Porras, S. Shin, V. Yegneswaran, M. Fong, M. Tyson, and G. Gu, "A security enforcement kernel for openflownetworks, "in Proceedings of the FirstWorkshop on Hot Topics in Software Defined Networks, ser. HotSDN '12. NewYork:ACM, 2012, pp. 121-126. [Online].Available: http://doi.acm.org/10.1145/2342441.2342466.
31. S. Shin, P. A. Porras, V. Yegneswaran, M. W. Fong, G. Gu, and M. Tyson, "Fresco: Modular composable security services for software-defined networks, "in Proceedings of the 20th Annual Network and Distributed System Security Symposium (NDSS '13), February 2013.
32. J. Suh, H.-G. Choi, W. Yoon, T. You, T. Kwon, and Y. Choi, "Implementation of contentoriented networking architecture (cona): A focus on DDoS countermeasure." September 2010.
33. P. Fonseca, R. Bennesby, E. Mota, and A. Passito, "A replication component for resilient openflow-based networking, "in Network Operations and Management Symposium (NOMS), 2012 IEEE, April 2012, pp. 933-939.
34. S. Shin, V. Yegneswaran, P. Porras, and G. Gu, "Avant-guard: Scalable and vigilant switch flow management in software-defined networks, "in Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, ser. CCS '13, 2013, pp. 413-424.
35. R. Skowyra, S. Bahargam, and A. Bestavros, "Software-defined IDs for securing embedded mobile devices, "in High Performance Extreme Computing Conference (HPEC), 2013 IEEE, Waltham, MA, Sept 2013, pp. 1-7.
36. A. Papadogiannakis, M. Polychronakis, and E. O. Markatos, "Improving the accuracy of network intrusion detection system under load using selective packet discarding, "in Proceedings of the Third European Workshop on System Security, EUROSEC '10. New York: ACM, 2010, pp. 15-21.
37. L. Tan and T. Sherwood, "A high throughput string matching architecture for intrusion detection and prevention, "in the 32nd Annual International Symposium on Computer Architecture (ISCA), Madison, WI, 2005.
38. J. H. Jafarian, E. AI-Shaer, and Q. Duan, "Openflow random host mutation: Transparent moving target defense using software defined networking, "in Proceedings of the First Workshop on Hot Topics in Software Defined Networks, HotSDN '12. New York: ACM, 2012, pp. 127-132.
39. V. Inc., "Vmware vcloud networking and security overview, "in white paper, 2012.
40. C.-J. Chung, J. Cui, P. Khatkar, and D. Huang, "Non-intrusive process-based monitoring system to mitigate and prevent vm vulnerability explorations, "in 2013 9th International Conference on Collaborative Computing: Networking, Applications and Worksharing (Collaboratecom), Austin, TX. IEEE, Washington, DC, 2013, pp. 21-30.
41. N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner, "Openflow: Enabling innovation in campus networks, "in ACM SIGCOMM Computer Communication Review, vol. 38, no. 2, pp. 69-74. Apr, 2008.
42. P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfieldh, "Xen and the art of virtualization, "in Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles (SOSP), New York 2003.
43. A. Alhomoud, R. Munir, J. P. Disso, I. Awan, and A. Al-Dhelaan, "Performance evaluation study of intrusion detection systems, "in The 2nd International Conference on Ambient System, Networks and Technologies, Niagara Falls, Canada, 2011.
44. "Back Track Linux." [Online]. Available: http://www.backtrack-linux.org.