Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) Detection of High Speed Flow-level Detection System <s> Global-scale attacks like worms and botnets are increasing in frequency, severity and sophistication, making it critical to detect outbursts at routers/gateways instead of end hosts. In this paper, leveraging data streaming techniques such as the reversible sketch, we design HiFIND, a High-speed Flow-level Intrusion Detection system. In contrast to existing intrusion detection systems, HiFIND: (i) is scalable to flow-level detection on high-speed networks; (ii) is DoS resilient; (iii) can distinguish SYN flooding and various port scans (mostly for worm propagation) for effective mitigation; (iv) enables aggregate detection over multiple routers/gateways; and (v) separates anomalies to limit false positives in detection. Both theoretical analysis and evaluation with several router traces show that HiFIND achieves these properties. To the best of our knowledge, HiFIND is the first online DoS resilient flow-level intrusion detection system for high-speed networks (e.g. OC192), even for the worst-case traffic of 40-byte-packet streams with each packet forming a flow. <s> BIB001 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) Detection of High Speed Flow-level Detection System <s> Distributed denial-of-service (DDoS) attacks became one of the main Internet security problems over the last decade, threatening public web servers in particular. Although the DDoS mechanism is widely understood, its detection is a very hard task because of the similarities between normal traffic and useless packets, sent by compromised hosts to their victims. This work presents a lightweight method for DDoS attack detection based on traffic flow features, in which the extraction of such information is made with a very low overhead compared to traditional approaches. This is possible due to the use of the NOX platform which provides a programmatic interface to facilitate the handling of switch information. Other major contributions include the high rate of detection and very low rate of false alarms obtained by flow analysis using Self Organizing Maps. <s> BIB002 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) Detection of High Speed Flow-level Detection System <s> Software-defined networks facilitate rapid and open innovation at the network control layer by providing a programmable network infrastructure for computing flow policies on demand. However, the dynamism of programmable networks also introduces new security challenges that demand innovative solutions. A critical challenge is efficient detection and reconciliation of potentially conflicting flow rules imposed by dynamic OpenFlow (OF) applications. To that end, we introduce FortNOX, a software extension that provides role-based authorization and security constraint enforcement for the NOX OpenFlow controller. FortNOX enables NOX to check flow rule contradictions in real time, and implements a novel analysis algorithm that is robust even in cases where an adversarial OF application attempts to strategically insert flow rules that would otherwise circumvent flow rules imposed by OF security applications. We demonstrate the utility of FortNOX through a prototype implementation and use it to examine performance and efficiency aspects of the proposed framework. <s> BIB003 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) Detection of High Speed Flow-level Detection System <s> Among the leading reference implementations of the Software Defined Networking (SDN) paradigm is the OpenFlow framework, which decouples the control plane into a centralized application. In this paper, we consider two aspects of OpenFlow that pose security challenges, and we propose two solutions that could address these concerns. The first challenge is the inherent communication bottleneck that arises between the data plane and the control plane, which an adversary could exploit by mounting a "control plane saturation attack" that disrupts network operations. Indeed, even well-mined adversarial models, such as scanning or denial-of-service (DoS) activity, can produce more potent impacts on OpenFlow networks than traditional networks. To address this challenge, we introduce an extension to the OpenFlow data plane called "connection migration", which dramatically reduces the amount of data-to-control-plane interactions that arise during such attacks. The second challenge is that of enabling the control plane to expedite both detection of, and responses to, the changing flow dynamics within the data plane. For this, we introduce "actuating triggers" over the data plane's existing statistics collection services. These triggers are inserted by control layer applications to both register for asynchronous call backs, and insert conditional flow rules that are only activated when a trigger condition is detected within the data plane's statistics module. We present Avant-Guard, an implementation of our two data plane extensions, evaluate the performance impact, and examine its use for developing more scalable and resilient SDN security services. <s> BIB004 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) Detection of High Speed Flow-level Detection System <s> Software Defined Networking (SDN) has been proposed as a drastic shift in the networking paradigm, by decoupling network control from the data plane and making the switching infrastructure truly programmable. The key enabler of SDN, OpenFlow, has seen widespread deployment on production networks and its adoption is constantly increasing. Although openness and programmability are primary features of OpenFlow, security is of core importance for real-world deployment. In this work, we perform a security analysis of OpenFlow using STRIDE and attack tree modeling methods, and we evaluate our approach on an emulated network testbed. The evaluation assumes an attacker model with access to the network data plane. Finally, we propose appropriate counter-measures that can potentially mitigate the security issues associated with OpenFlow networks. Our analysis and evaluation approach are not exhaustive, but are intended to be adaptable and extensible to new versions and deployment contexts of OpenFlow. <s> BIB005 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) Detection of High Speed Flow-level Detection System <s> Cloud computing has become the real trend of enterprise IT service model that offers cost-effective and scalable processing. Meanwhile, Software-Defined Networking (SDN) is gaining popularity in enterprise networks for flexibility in network management service and reduced operational cost. There seems a trend for the two technologies to go hand-in-hand in providing an enterprise's IT services. However, the new challenges brought by the marriage of cloud computing and SDN, particularly the implications on enterprise network security, have not been well understood. This paper sets to address this important problem. We start by examining the security impact, in particular, the impact on DDoS attack defense mechanisms, in an enterprise network where both technologies are adopted. We find that SDN technology can actually help enterprises to defend against DDoS attacks if the defense architecture is designed properly. To that end, we propose a DDoS attack mitigation architecture that integrates a highly programmable network monitoring to enable attack detection and a flexible control structure to allow fast and specific attack reaction. The simulation results show that our architecture can effectively and efficiently address the security challenges brought by the new network paradigm. <s> BIB006 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) Detection of High Speed Flow-level Detection System <s> A Software Defined Network (SDN) is a new network architecture that provides central control over the network. Although central control is the major advantage of SDN, it is also a single point of failure if it is made unreachable by a Distributed Denial of Service (DDoS) Attack. To mitigate this threat, this paper proposes to use the central control of SDN for attack detection and introduces a solution that is effective and lightweight in terms of the resources that it uses. More precisely, this paper shows how DDoS attacks can exhaust controller resources and provides a solution to detect such attacks based on the entropy variation of the destination IP address. This method is able to detect DDoS within the first five hundred packets of the attack traffic. <s> BIB007 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) Detection of High Speed Flow-level Detection System <s> Software Defined Networking (SDN) is a new networking architecture that aims to provide better decoupling between network control (control plane) and data forwarding functionalities (data plane). This separation introduces several benefits, such as a directly programmable and (virtually) centralized network control. However, researchers showed that the required communication channel between the control and data plane of SDN creates a potential bottleneck in the system, introducing new vulnerabilities.Indeed, this behavior could be exploited to mount powerful attacks, such as the control plane saturation attack, that can severely hinder the performance of the whole network. In this paper we present LineSwitch, an efficient and effective solution against control plane saturation attack. LineSwitch combines SYN proxy techniques and probabilistic blacklisting of network traffic. We implemented LineSwitch as an extension of OpenFlow, the current reference implementation of SDN, and evaluate our solution considering different traffic scenarios (with and without attack). The results of our preliminary experiments confirm that, compared to the state-of-the-art, LineSwitch reduces the time overhead up to 30%, while ensuring the same level of protection. <s> BIB008 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) Detection of High Speed Flow-level Detection System <s> Although software-defined networking (SDN) brings numerous benefits by decoupling the control plane from the data plane, there is a contradictory relationship between SDN and distributed denial-of-service (DDoS) attacks. On one hand, the capabilities of SDN make it easy to detect and to react to DDoS attacks. On the other hand, the separation of the control plane from the data plane of SDN introduces new attacks. Consequently, SDN itself may be a target of DDoS attacks. In this paper, we first discuss the new trends and characteristics of DDoS attacks in cloud computing environments. We show that SDN brings us a new chance to defeat DDoS attacks in cloud computing environments, and we summarize good features of SDN in defeating DDoS attacks. Then we review the studies about launching DDoS attacks on SDN and the methods against DDoS attacks in SDN. In addition, we discuss a number of challenges that need to be addressed to mitigate DDoS attached in SDN with cloud computing. This work can help understand how to make full use of SDN's advantages to defeat DDoS attacks in cloud computing environments and how to prevent SDN itself from becoming a victim of DDoS attacks. <s> BIB009
(HiFIND) BIB001 : In order to detect the DDoS attack and provide substantial protection to victim and service provider, HiFIND can be utilized. It is highly secured due to its high volume capacity and immune to DDoS attacks for high density data packets. Thus, HiFIND is less prone and highly stable when it comes to DDoS attacks that target weaker system; highly vulnerable to satisfying only low volume traffic. Lightweight DDoS attack detection BIB002 has been proposed which is map based detection scheme inspired from Self Organizing Map (SOM) technique. It is a three stage process consisting of flow collector, feature extractor and classifier. The flow extractor is used for gathering the flow statistics from OpenFlow switches. The feature extractor selects the specific information required for the detection based on which classifier determines legitimate user. The security defense approach called Damask has been proposed in BIB006 to protect SDN from DDoS attacks. The entropy method has been proposed in BIB007 to detect DDoS attack on controller using a threshold value. The entropy of the IP addresses is calculated after every incoming 50 packets and if it is above the threshold value, it declares that there is a suspicious activity in the system. These attacks are mostly directed during the communication with switches. Infected switches send overwhelming requests and controller will be involved in responding to these fake requests denying the requests of legitimate users. This attack creates direct harm to the legitimate users. These attacks can be mitigated by protecting controller from these malicious flows. TopoGuard has been developed in  as a security addon in an OpenFlow controller to address the vulnerabilities in network topology. Network attacks have become most common in many controllers available in today's market such as flood-light, beacon and POX. It focuses on countermeasures for the vulnerabilities involving host tracking services and link discovery in OpenFlow controller. This architecture maintains the record of host profile which includes MAC address, IP address and location information to provide a seamless service without delay in hand-off mechanism. The host profile is monitored and tracked by the Host Tracking Services (HTS) present in the controller. This can be used for determining the valid user. When the controller cannot match the host profile, the new profile is created and stored. If the location of host varies with the profile then it gets updated automatically using HOST_MOVE event presuming the change of location of host. This kind of functionality is not very secure and creates the gateway for the hijackers and spoofing attacks as the users are not validated with any authentication mechanisms. If the attacker can get the access to the location of the target he can trick the controller by mimicking the host creating the Web impersonation attack. Public key based methods can be implemented to validate the host but would not be very efficient solution as the management of these keys would be a tedious task involving cost factor. TopoGuard uses precondition and post condition techniques for validation of the host migration. The precondition is Port_Down signal before host migration and the post condition refers to verification of post location of the host and making sure that it cannot be reached in that location. The Link Discovery Service (LDS) uses Link Layer Discovery Protocol (LLDP) for discovering the internal links between the switches. The link fabrication attacks occur by injecting fake LLDP packets that are capable of creating DoS attacks and man-in-the-middle-attacks. Methods for resolving these kind of attacks include the additional authentication of LLDP packets using Type Length Variable (TLV) and switch port confirmation  . Furthermore, LineSwitch, which is a solution based on probability and blacklisting, offers resiliency against SYN flooding-based control plane saturation attacks and protection from buffer saturation vulnerabilities in SDN BIB008 . FortNOX technique has been introduced in BIB009 and BIB003 to resolve the security threats in application layer and the control layer of SDN. It is a software solution implemented in NOX OpenFlow system to secure the system. It responds to the requests based on the authorization and privileges granted to the users. This method can help to prioritize valid users over fake users. Avant guard has been proposed in BIB004 that focuses on two key aspects i.e., security between the data plane and control plane and increasing the response rate of controller to the data plane requests. These two issues of SDN can be resolved by the addition of some more security features into the system namely connection migration and actuating triggers. Connection migration is used for enhancing more security in data plane using classification, report, migration and relay stage. For providing a strict security, flow packets are allowed to interact with the controller only after passing the TCP handshake mechanism. This method can help in the detection of malicious users. The actuating trigger is enabled to increase the responsiveness between the controller and data plane. These triggers make the data plane report all the existing conditions in switches to the controller asynchronously. In BIB005 , a model has been proposed to analyze the threats that may occur during the communication with data plane by using the OpenFlow protocol. The analysis is done by combination of STRIDE and attack trees to analyze the attacks such as spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.