WedgeTail: An intrusion prevention system for the data plane of software defined networks

ASIA CCS 2017 - Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security

Volumn , Issue , 2017, Pages 849-861

  Shaghaghi, Arash ^a,b   Kaafar, Mohamed Ali ^b   Jha, Sanjay ^a  

^a UNIVERSITY OF NEW SOUTH WALES   (Australia)

^b CSIRO   (Australia)

Author keywords

Data plane security; Intrusion prevention system; SDN security; Software defined networks

Indexed keywords

MERCURY (METAL); SOFTWARE DEFINED NETWORKING; SWITCHING SYSTEMS;

DATA PLANES; GEOMETRIC SPACE; INTRUSION PREVENTION SYSTEMS; RELATED WORKS; SAMPLING MECHANISMS; SDN SECURITY; SIMULATED ENVIRONMENT; TRAJECTORY-BASED;

NETWORK SECURITY;

EID: 85021938193     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/3052973.3053039     Document Type: Conference Paper

References (44)

1. Mausezahn. http://www.perihel.at/sec/mz/.
2. Open Networking Foundation (ONF). https://www.opennetworking.org/.
3. S. T. Ali, V. Sivaraman, A. Radford, and S. Jha. A survey of securing networks using software defied networking. IEEE transactions on reliability, 64(3):1086-1097, 2015.
4. G. Andrienko, N. Andrienko, S. Rinzivillo, M. Nanni, and D. Pedreschi. A visual analytics toolkit for cluster-based classification of mobility data. In International Symposium on Spatial and Temporal Databases, pages 432-435. Springer, 2009.
5. G. Andrienko, N. Andrienko, S. Rinzivillo, M. Nanni, D. Pedreschi, and F. Giannotti. Interactive visual clustering of large collections of trajectories. In Visual Analytics Science and Technology, 2009. VAST 2009. IEEE Symposium on, pages 3-10. IEEE, 2009.
6. K. Benton, L. J. Camp, and C. Small. Openow vulnerability assessment. In Proceedings of the second ACM SIGCOMM workshop on Hot topics in software defied networking, pages 151-152. ACM, 2013.
7. Cbench. https://goo.gl/10TLJk.
8. T.-W. Chao, Y.-M. Ke, B.-H. Chen, J.-L. Chen, C. J. Hsieh, S.-C. Lee, and H.-C. Hsiao. Securing data planes in software-defied networks. In 2016 IEEE NetSoft Conference and Workshops (NetSoft), pages 465-470. IEEE, 2016.
9. CRATE datasets. ftp://download.iwlab.foi.se/dataset.
10. Data Set for IMC 2010 Data Center Measurement. http://pages.cs.wisc.edu/~tbenson/IMC10 Data.html.
11. M. Dhawan, R. Poddar, K. Mahajan, and V. Mann. Sphinx: Detecting security attacks in software-defied networks. In NDSS, 2015.
12. N. G. Dufield and M. Grossglauser. Trajectory sampling for direct trafic observation. In ACM SIGCOMM Computer Communication Review, volume 30, pages 271-282. ACM, 2000.
13. R. Ghannam and A. Chung. Handling malicious switches in software defied networks. In NOMS 2016-2016 IEEE/IFIP Network Operations and Management Symposium, pages 1245-1248. IEEE, 2016.
14. F. Giannotti, M. Nanni, F. Pinelli, and D. Pedreschi. Trajectory pattern mining. In Proceedings of the 13th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 330-339. ACM, 2007.
15. N. Handigol, B. Heller, V. Jeyakumar, D. Mazifferes, and N. McKeown. I know what your packet did last hop: Using packet histories to troubleshoot networks. In 11th USENIX Symposium on Networked Systems Design and Implementation (NSDI 14), pages 71-85, 2014.
16. P. Hunter. Pakistan youtube block exposes fundamental internet security weakness: Concern that pakistani action affected youtube access elsewhere in world. Computer Fraud & Security, 2008(4):10-11, 2008.
17. A. Kamisinski and C. Fung. Flowmon: Detecting malicious switches in software-defied networks. In Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense, pages 39-45. ACM, 2015.
18. P. Kazemian, M. Chang, H. Zeng, G. Varghese, N. McKeown, and S. Whyte. Real time network policy checking using header space analysis. In Presented as part of the 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI 13), pages 99-111, 2013.
19. P. Kazemian, G. Varghese, and N. McKeown. Header space analysis: Static checking for networks. In Presented as part of the 9th USENIX Symposium on Networked Systems Design and Implementation (NSDI 12), pages 113-126, 2012.
20. A. Khurshid, X. Zou, W. Zhou, M. Caesar, and P. B. Godfrey. Veriow: Verifying network-wide invariants in real time. In Presented as part of the 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI 13), pages 15-27, 2013.
21. T. H.-J. Kim, C. Basescu, L. Jia, S. B. Lee, Y.-C. Hu, and A. Perrig. Lightweight source authentication and path validation. In ACM SIGCOMM Computer Communication Review, volume 44, pages 271-282. ACM, 2014.
22. R. Klöti, V. Kotronis, and P. Smith. Openow: A security analysis. In 21st IEEE International Conference on Network Protocols (ICNP), pages 1-6. IEEE, 2013.
23. S. Knight, H. X. Nguyen, N. Falkner, R. Bowden, and M. Roughan. The internet topology zoo. IEEE Journal on Selected Areas in Communications, 29(9):1765-1775, 2011.
24. D. Kreutz, F. Ramos, and P. Verissimo. Towards secure and dependable software-defied networks. In Proceedings of the second ACM SIGCOMM workshop on Hot topics in software defied networking, pages 55-60. ACM, 2013.
25. D. Kreutz, F. M. Ramos, P. E. Verissimo, C. E. Rothenberg, S. Azodolmolky, and S. Uhlig. Software-defied networking: A comprehensive survey. Proceedings of the IEEE, 103(1):14-76, 2015.
26. LBNL/ICSI Enterprise Tracing Project. http://www.icir.org/enterprise-tracing/.
27. J.-G. Lee, J. Han, and X. Li. Trajectory outlier detection: A partition-and-detect framework. In 2008 IEEE 24th International Conference on Data Engineering, pages 140-149. IEEE, 2008.
28. H. Mai, A. Khurshid, R. Agarwal, M. Caesar, P. Godfrey, and S. T. King. Debugging the data plane with anteater. In ACM SIGCOMM Computer Communication Review, volume 41, pages 290-301. ACM, 2011.
29. N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner. Openow: Enabling innovation in campus networks. ACM SIGCOMM Computer Communication Review, 38(2):69-74, 2008.
30. S. Meloni, J. Gomez-Gardenes, V. Latora, and Y. Moreno. Scaling breakdown in ow uctuations on complex networks. Physical review letters, 100(20):208701, 2008.
31. A. T. Mizrak, Y.-C. Cheng, K. Marzullo, and S. Savage. Fatih: Detecting and isolating malicious routers. In 2005 International Conference on Dependable Systems and Networks (DSN'05), pages 538-547. IEEE, 2005.
32. A. T. Mizrak, S. Savage, and K. Marzullo. Detecting malicious packet losses. IEEE Transactions on Parallel and distributed systems, 20(2):191-206, 2009.
33. Open Networking Foundation (ONF). Sdn architecture, onf tr-502. opennetworking.org/images/stories/downloads/sdn-resources/technical-reports/TR SDN ARCH 1.0 06062014.pdf.
34. S. Orlowski, R. Wessäly, M. Pioro, and A. Tomaszewski. Sndlib 1.0-survivable network design library. Networks, 55(3):276-286, 2010.
35. N. Pelekis, I. Kopanakis, C. Panagiotakis, and Y. Theodoridis. Unsupervised trajectory sampling. In Machine learning and knowledge discovery in databases, pages 17-33. Springer, 2010.
36. J. Rasley, B. Stephens, C. Dixon, E. Rozner, W. Felter, K. Agarwal, J. Carter, and R. Fonseca. Planck: Millisecond-scale monitoring and control for commodity networks. ACM SIGCOMM Computer Communication Review, 44(4):407-418, 2015.
37. Route Views. http://www.routeviews.org.
38. S. Scott-Hayward, S. Natarajan, and S. Sezer. A survey of security in software defied networks. IEEE Communications Surveys & Tutorials, 18(1):623-654, 2015.
39. N. Spring, R. Mahajan, D. Wetherall, and T. Anderson. Measuring isp topologies with rocketfuel. IEEE/ACM Transactions on networking, 12(1):2-16, 2004.
40. J. Suh, T. T. Kwon, C. Dixon, W. Felter, and J. Carter. Opensample: A low-latency, sampling-based measurement platform for commodity sdn. In Distributed Computing Systems (ICDCS), 2014 IEEE 34th International Conference on, pages 228-237. IEEE, 2014.
41. H. Zeng, S. Zhang, F. Ye, V. Jeyakumar, M. Ju, J. Liu, N. McKeown, and A. Vahdat. Libra: Divide and conquer to verify forwarding tables in huge networks. In 11th USENIX Symposium on Networked Systems Design and Implementation (NSDI 14), pages 87-99, 2014.
42. X. Zhang, C. Lan, and A. Perrig. Secure and scalable fault localization under dynamic trafic patterns. In Security and Privacy (SP), 2012 IEEE Symposium on, pages 317-331. IEEE, 2012.
43. X. Zhang, Z. Zhou, H.-C. Hsiao, T. H.-J. Kim, A. Perrig, and P. Tague. Shortmac: Eficient data-plane fault localization. In NDSS, 2012.
44. Y. J. Zhu and L. Jacob. On making tcp robust against spurious retransmissions. Computer communications, 28(1):25-36, 2005.