Piggybacking Network Functions on SDN Reactive Routing: A Feasibility Study

ABSTRACT

This paper explores the potential of enabling SDN security and monitoring services by piggybacking on SDN reactive routing. As a case study, we implement and evaluate a piggybacking based intrusion prevention system called SDN-Defense. Our study of university WiFi traffic traces reveals that up to 73% of malicious flows can be detected by inspecting just the first three packets of a flow, and 90% of malicious flows from the first four packets. Using such empirical insights, we propose to forward the first K packets of each new flow to an augmented SDN controller for security inspection, where K is a dynamically configurable parameter. We characterize the cost-benefit trade-offs of SDN-Defense using real wireless traces and discuss potential scalability issues. Finally, we discuss other applications which can be enhanced by using our proposed piggybacking approach.

References

1. Barefoot networks: https://www.barefootnetworks.com/technology/.
2. Cbench: an OpenFlow controller benchmarker. https://github.com/mininet/oflops/tree/master/cbench.
3. Netronome: https://www.netronome.com.
4. Pox: https://github.com/noxrepo/pox.
5. Snort: https://snort.org.
6. L Bernaille, R Teixeira, and K Salamatian. Early application identification. In Proceedings of the 2006 ACM CoNEXT conference, page 6. ACM, 2006.
7. Bernaille et al. Traffic classification on the fly. ACM SIGCOMM Computer Communication Review, 36(2):23--26, 2006.
8. Giotis et al. Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments. Computer Networks, 62:122--136, 2014.
9. Le et al. Traffic dispersion graph based anomaly detection. In Proceedings of the Second Symposium on Information and Communication Technology, pages 36--41. ACM, 2011.
10. Liao et al. Intrusion detection system: A comprehensive review. Journal of Network and Computer Applications, 36(1):16--24, 2013.
11. Xing et al. Sdnips: Enabling software-defined networking based intrusion prevention system in clouds. In 10th International Conference on Network and Service Management (CNSM) and Workshop, pages 308--311. IEEE, 2014.
12. Yoon et al. Enabling security functions with sdn: A feasibility study. Computer Networks, 85:19--35, 2015.
13. C Liu, A Raghuramu, C-N Chuah, and B Krishnamurthy. Piggybacking network functions on sdn reactive routing: A feasibility study. https://www.dropbox.com/s/5gi0toqqkd89lt4/piggybacking-network-functions-v10.pdf?dl=0, 2016.
14. S Mehdi, J Khalid, and S Khayam. Revisiting traffic anomaly detection using software defined networking. In Recent Advances in Intrusion Detection, pages 161--180. Springer, 2011.
15. A Papadogiannakis, M Polychronakis, and E Markatos. Improving the accuracy of network intrusion detection systems under load using selective packet discarding. In Proceedings of the Third European Workshop on System Security, pages 15--21. ACM, 2010.
16. Y. Wang, C. Orapinpatipat, H. Gharakheili, et al. Telescope: Flow-level Video Telemetry using SDN. In Proc. of EWSDN, 2016.

• Networks

  • Network services

    • Network monitoring