Distributed-SOM: A novel performance bottleneck handler for large-sized software-defined networks under flooding attacks

Journal of Network and Computer Applications

Volumn 91, Issue , 2017, Pages 14-25

  Phan, Trung V ^a   Bao, Nguyen Khac ^a   Park, Minho ^a  

^a Soongsil University   (South Korea)

Author keywords

Distributed denial of service; Flooding attacks; Self organizing map; Software defined networks

Indexed keywords

CONFORMAL MAPPING; FLOODS; NETWORK SECURITY; SELF ORGANIZING MAPS; SOFTWARE DEFINED NETWORKING;

DETECT ABNORMAL TRAFFIC; DISTRIBUTED DENIAL OF SERVICE; FLOODING ATTACKS; LARGE-SCALE MODELING; MONITOR AND CONTROL; PERFORMANCE BOTTLENECKS; PROGRAMMABLE NETWORKINGS; SOFTWARE DEFINED NETWORKING (SDN);

DENIAL-OF-SERVICE ATTACK;

EID: 85019111539     PISSN: 10848045     EISSN: 10958592     Source Type: Journal    
DOI: 10.1016/j.jnca.2017.04.016     Document Type: Article

References (54)

1. Alsulaiman, M., Alyahya, A., Alkharboush, R., Alghafis, N., 2009. Intrusion Detection System Using Self-Organizing Maps. In: IEEE Proceedings of the 3rd International Conference on Network and System Security; p.397-402.
2. BoNeSi. the DDoS Botnet Simulator, 〈 https://github.com/markus-go/bonesi〉.
3. Braga, Rodrigo, Mota, Edjard, Passito, Alexandre, 2010. Lightweight DDoS Flooding Attack Detection Using NOX/OpenFlow. In: Proceedings of the 35th Annual IEEE Conference on Local Computer Networks, Denver, Colorado; p.408-415.
4. CAIDA Dataset. DDoS Attack 2007, 〈 https://data.caida.org/datasets/security/ddos-20070804/〉.
5. CAIDA Dataset. Anonymized Internet Traces 2015, 〈 https://data.caida.org/datasets/passive-2015/〉.
6. Cisco IOS Embedded Event Manager (EEM) 〈 http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-embedded-event-managereem/〉.
7. KDD Cup 1999 Data. 〈 http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html〉.
8. Fachkha, Claude, Bou-Harb, Elias, Debbabi, Mourad, 2014. Fingerprinting Internet DNS Amplification DDoS Activities. In: Proceedings of the 6th International Conference on New Technologies, Mobility and Security (NTMS); p.1-5.
9. FERRO, G. Big Switch Networks Launches Mature Hardware-Centric Data Centre SDN Solution, July 2014. 〈 http://etherealmind.com/big-switchnetworks-launches-hardware-centre-mature-data-centre-sdn-solution/〉.
10. Floodlight is an Open SDN Controller, 2017. 〈 http://www.projectfloodlight.org/floodlight/〉.
11. Fonseca, P., Bennesby, R., Mota, E., Passito, A., 2012. A replication component for resilient OpenFlow-based networking. In: IEEE Network Operations and Management Symposium (NOMS); p.933-939.
12. Geetha, K., Sreenath, N., SYN flooding attack – Identification and analysis. Inf. Commun. Embed. Syst. (ICICES), 2014, 1–7 (p).
13. Gu, Qijun, Liu, Peng, 2012. Denial of Service Attacks, John Wiley and Sons, p.454-468, Part II (in book: Handbook of Computer Networks: Distributed Networks, Network Planning, Control, Management, and New Trends and Applications).
14. Gunes Kayacik, H., Zincir-Heywood, N., A hierarchical SOMbased intrusion detection system. Eng. Appl. Artif. Intell. 20:4 (2007), 439–451.
15. Hassas Yeganeh, S., Ganjali, Y., 2012. Kadoo: A Framework for Efficient and Scalable Offloading of Control Application. In: Proceeding HotSDN Conference; p.19-24.
16. HP 3800 Switch Series. 〈 https://www.hpe.com/h20195/v2/getpdf.aspx/c04111485.pdf?Ver=19〉.
17. Jain et al., S., 2013. B4: Experience with a Globally-Deployed Software Defined WAN. In: Proceeding ACM SIGCOMM 2013 Conference; p.3-14.
18. Jankowski, D., Amanowicz, M., Intrusion detection in software defined networks with self-organized maps. J. Telecommun. Inf. Technol. 1:4 (2015), 3–9.
19. Jiang, D., Yang, Y., Xia, M., 2009. Research on Intrusion Detection Based on an Improved SOM Neural Network. In: IEEE Proceedings of the Fifth International Conference on Information Assurance and Security; p.400-403.
20. John Pescatore. DDoS Attacks Advancing and Enduring: A SANS Survey 2014, 〈 https://www.sans.org/reading-room/whitepapers/analyst/ddos-attacks-advancing-enduring-survey-34700〉.
21. Kaspersky Lab. Statistics on botnet-assisted DDoS attacks in Q1 2015, Technical Report, 2015, https://securelist.com/blog/research/70071/statistics-on-botnet-assisted-ddos-attacks-in-q1-2015.
22. Kiziloren, T., Germen, E., 2007. Network traffic classification with Self Organizing Maps. In: Proceedings of the 22nd International symposium on computer and information sciences; p.1-5.
23. Kohonen, T., 1990. The self-organizing map. In: Proceedings of the IEEE, p.1464–1480.
24. Kohonen, Teuvo, 2001. The Basic SOM. Springer-Verlag Berlin Heidelberg, p.105-176, Chapter 3 (in book: Self-Organizing Maps).
25. Koponen et al., T., 2010. Onix: A Distributed Control Platform for Large-Scale Production Networks. In: Proceeding OSDI Conference; p.1-6.
26. LANDER:DARPA 2009 DDoS attack-20091105. 〈 https://ant.isi.edu/datasets/readmes/DARPA-2009-DDoS-attack-20091105.README.txt〉.
27. Langin, C., Zhou, H., Rahimi, S., Gupta, B., Zargham, M., Sayeh, M., 2009. A Self-Organizing Map and its Modeling for Discovering Malignant Network Traffic. In: IEEE Symposium onComputational Intelligence in Cyber Security; p.122-129.
28. Masoudi, Rahim, Ghaffari, Ali, Software defined networks: a survey. J. Netw. Comput. Appl. 1:67 (2016), 1–25, 10.1016/j.jnca.2016.03.016.
29. Medhi, D., Network Routing: Algorithms, Protocols, and Architectures. 1st ed., 2007, Morgan Kaufmann.
30. Kim, Minhoe, Souhwan Jung, Minho Park, 2015. A Distributed Self Organizing Map for DoS Attack Detection. In: Proceedings of the 7th International Conference on Ubiquitous and Future Networks (ICUFN);, p.19-22.
31. Mitrokotsa, A., Douligeris, C., 2005. Detecting denial of service attacks using emergent self-organizing maps. In: IEEE Signal Processing and Information Technology; p.375-380.
32. Naous, J., Stutsman, R., Mazieres, D., McKeown, N., Zeldovich, N., 2009. Delegating network security with more information. In: Proceedings of the 1st ACM workshop on Research on enterprise networking; p.19-26.
33. Nascimento, Z., Sadok, D., Fernandes, S., 2013. A Hybrid Model for Network Traffic Identification Based on Association Rules and Self-Organizing Maps (SOM). In: Proceedings of the Ninth International Conference on Networking and Services; p.213-219.
34. NSL-KDD Data Set for Network-based Intrusion Detection Systems, 2009. 〈 http://iscx.cs.unb.ca/NSL-KDD/〉.
35. Omnipeek Network Analysis, 2017. 〈 https://www.savvius.com/products/network-visibility-performance-diagnostics/omnipeek-family/omnipeek-network-analysis〉.
36. Open network linux, 2017 〈 http://opennetlinux.org〉.
37. OpenFlow. OpenFlow Switch Specification Version 1.4.0, 2013 〈 https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/op-enflow/openflow-spec-v1.4.0.pdf〉.
38. OpenvSwitch. OpenvSwitch version 2.3.0, 2014 〈 http://openvswitch.org/releases/openvswitch-2.3.0.tar.gz〉.
39. Park, T., Kim, Y., Shin, S., 2016. UNISAFE: A Union of Security Actions for Software Switches. In: the SDN-NFVSec Workshop, p.13–18.
40. Pica os white box switch os, 2017. 〈 http://www.pica8.com/white-box-switches/white-box-switch-os.php〉.
41. Ramadas, M., Ostermann, S., Tjaden, B., 2003. Detecting anomalous network traffic with self-organizing maps, Recent Advances in Intrusion Detection, Springer-Verlag Berlin Heidelberg, p.36–54, Chapter 1 (in book: Recent Advances in Intrusion Dection).
42. Shin, S., Yegneswaran, V., Porras, P., Gu, G., 2013. AVANT-GUARD: scalable and vigilant switch flow managament in software-defined networks. In: Proceeding of the 2013 ACM SIGSAC Conference on Computer and Commications Security; p.413-424.
43. Sonchack, J., Aviv, Adam J., Keller, E., Smith, M., 2016. Enabling Practical Software-defined Networking Security Applications with OFX. In: The Network and Distributed System Security Symposium (NDSS); p.181-195.
44. Suh, J., Choi, H., Yoon, W., You, T., Kwon, T., Choi, Y., 2010. Implementation of Content-oriented Networking Architecture (CONA): A Focus on DDoS Countermeasure. In: European NetFPGA Developers Workshop.
45. Kanungo, Tapas, Mount, David M., Netanyahu, Nathan S., Piatko, Christine D., Silverman, Ruth, Wu, Angela Y., An efficient k-means clustering algorithm: analysis and Implementation. IEEE Trans. Pat. Ana Ma Intel. 24:7 (2002), 881–892.
46. Ting, B., Yong, W., Xiaoling, T., 2010. Network Traffic Classification Based on Kernel Self-Organizing Maps. In: International Conference on Intelligent Computing and Integrated Systems; p.310-314.
47. Trung, V.Phan, Van Toan, T., Van Tuyen, D., Huong, T.T., Thanh, N.H.,. OpenFlowSIA: An optimized protection scheme for software-defined networks from flooding attacks. In: Proceedings of the Sixth International Conference on Communications and Electronics, IEEE, p. 13-18.
48. Van Trung et al., P., 2015. A Multi-criteria-based DDoS attack prevention solution using Software Defined Networking. In: IEEE The International Conference on Advanced Technologies for Communications, p.308-313.
49. Wang, C., Yu, H., Wang, H., Grey self-organizing map based intrusion detection. Optoelectron. Lett. 5:1 (2009), 64–68.
50. Wang, H., Xu, L., Gu, G., 2015. FloodGuard: A DoS Attack Prevention Extension in Software-Defined Networks. In: Proceeding IEEE/IFIP Proceedings of the 45th International Conference on Dependable Systems and Networks (DSN); p.239-250.
51. Yao, G., Bi, J., Xiao, P., 2011. Source address validation solution with OpenFlow/NOX architecture. In: Proceedings of the 19th IEEE International Conference on Network Protocols (ICNP); p.7–12.
52. YuHunag, C., MinChi, T., YaoTing, C., YuChieh, C., YanRen, C., 2010. A novel design for future on-demand service and security. In: IEEE International Conference Communication Technology (ICCT); p.385-388.
53. Yunhe Cui, Yan, Lianshan, Li, Saifei, Xing, Huanlai, Pan, Wei, Zhu, Jian, Zheng, Xiaoyang, 2016. SD-Anti-DDoS: Fast and Efficient DDoS Defense in Software-Defined Networks. Journal of of Network and Computer Applications, doi:10.1016/j.jnca.2016.04.005.
54. Zanero, Stefano, 2005. Analyzing TCP Traffic Patterns Using Self Organizing Maps. In: Proceedings of the 13th International Conference on Image Analysis and Processing; p.83-90.