Search

SDN architectures are frequently used by organizations for the management of their networks and the detection of anomalous traffic in a single domain. However, in the real world, anomalous traffic might result in attacks like distributed denial of service (DDoS) that affect numerous domains. During intrusion detection, each SDN domain has to send real traffic data of a large volume to the multi-domain controller, exposing its sensitive information. This paper proposes a smart multistage framework for detecting attacks and ensuring privacy at no additional cost. This work utilized the recent unbalanced InSDN dataset for experimentation. It also uses an oversampling technique that reduces the imbalance rate for each attack type and selects the smallest possible training size and feature set size for an increase in detection accuracy and a reduction in computational complexity. Then, a multi-class classifier method for intrusion detection that does not require regularization or hyperparameter tuning, called ensemble-learning-based shallow decision tree (ELSDT) is proposed. Furthermore, the performance of the proposed classifier on the InSDN dataset is assessed on an SDN testbed. Experimental results show the ability of the proposed smart multistage privacy-preserving framework to make a significant reduction in the training sample size and feature set size to 87% and 76%, respectively. It also shows its outperformance in recent literature works by 5.67% improved accuracy. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) is a strategy that leads the network via software by separating its control plane from the underlying forwarding plane. In support of a global digital network, multi-domain SDN architecture emerges as a viable solution. However, the complex and ever-evolving nature of network threats in a multi-domain environment presents a significant security challenge for controllers in detecting abnormalities. Moreover, multi-domain anomaly detection poses a daunting problem due to the need to process vast amounts of data from diverse domains. Deep learning models have gained popularity for extracting high-level feature representations from massive datasets. In this work, a novel deep neural network architecture, supervised learning based LD-BiHGA (Low Dimensional Bi-channel Hybrid GAN Attention) system is designed to learn class-specific features for accurate anomaly detection. Two asymmetric GANs are employed for learning the normal and abnormal network flows separately. Then, to extract more relevant features, a bi-channel attention mechanism is added. This is the first study to introduce an innovative hybrid architecture that merges bi-channel hybrid GANs with attention models for the purpose of anomaly detection in a multi-domain SDN environment that effectively handles real-time unbalanced data. The suggested architecture demonstrates its effectiveness on three benchmark datasets, achieving an average accuracy improvement of 7.225% on balanced datasets and 3.335% on imbalanced datasets compared to previous intrusion detection system (IDS) architectures in the literature. [ABSTRACT FROM AUTHOR]

Next-generation wireless technology supports notably high data rates and smart hand-held devices together with data processing, which creates a great challenge for moving these contents from server to client. The classical issue of mobile data synchronization for high-speed data networks can be addressed through Software Defined Networking (SDN) Control. The proposed IDBSync (Improved Database Synchronization) mechanism expedites data synchronization between the server-side and mobile database in a SDN setup. The tables of the synchronization server are maintained in the control plane, including replicas of the data tables at the server and client devices collected from the data planes for application of the synchronization policy. The IDBSync uses BaSyM (Batch Level Synchronization Methodology) to group similar cases for synchronization to considerably reduce network usage and energy consumption in a heterogeneous environment. Comparative performance analysis of the proposed mechanism is performed with reference to commercial approaches. [ABSTRACT FROM AUTHOR]

The authentication mechanisms in Broadband Wireless Networks (BWN) are predominantly based on Extensible Authentication Protocol (EAP). However, the complexity of EAP causes an impediment in BWN networks which involve high speed mobility. Even though it provides a highly secured mechanism, the current authentication process has high authentication overheads which affect the Quality of Service (QoS) in time sensitive data applications such as VoIP and VoD. The alternative would be to consider re-authentication approach which reduces the number of full EAP authentications but at the same time provides a secure handoff to the mobile users at a lower latency and hence does not impact the QoS of the applications. The proposed Frequency-based Re-authentication Protocol (FRP) is an extension to EAP, aiming to reduce the network access time and in turn reduce the authentication latency, by taking into account the frequency of visits of a particular mobile user to an access domain. In addition, we also propose a frequent - User Authentication Process (f-UAP) which when used with FRP significantly minimizes the EAP authentication overhead. A mathematical model is formulated to illustrate the tradeoff achieved when FRP along with EAP is used in the f-UAP approach. The security evaluation of the proposed FRP is carried out using Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. Furthermore, simulation analysis show that the FRP authentication latency is lower compared to the existing re-authentication mechanisms. [ABSTRACT FROM AUTHOR]