Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> A. SDN as a Security Solution <s> Network intrusion detection systems (NIDS) are an important part of any network security architecture. They provide a layer of defense which monitors network traffic for predefined suspicious activity or patterns, and alert system administrators when potential hostile traffic is detected. Commercial NIDS have many differences, but Information Systems departments must face the commonalities that they share such as significant system footprint, complex deployment and high monetary cost. Snort was designed to address these issues. <s> BIB001 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> A. SDN as a Security Solution <s> Cloud computing is becoming a popular paradigm. Many recent new services are based on cloud environments, and a lot of people are using cloud networks. Since many diverse hosts and network configurations coexist in a cloud network, it is essential to protect each of them in the cloud network from threats. To do this, basically, we can employ existing network security devices, but applying them to a cloud network requires more considerations for its complexity, dynamism, and diversity. In this paper, we propose a new framework, CloudWatcher, which provides monitoring services for large and dynamic cloud networks. This framework automatically detours network packets to be inspected by pre-installed network security devices. In addition, all these operations can be implemented by writing a simple policy script, thus, a cloud network administrator is able to protect his cloud network easily. We have implemented the proposed framework, and evaluated it on different test network environments. <s> BIB002 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> A. SDN as a Security Solution <s> Cloud security is one of most important issues that has attracted a lot of research and development effort in past few years. Particularly, attackers can explore vulnerabilities of a cloud system and compromise virtual machines to deploy further large-scale Distributed Denial-of-Service (DDoS). DDoS attacks usually involve early stage actions such as multistep exploitation, low-frequency vulnerability scanning, and compromising identified vulnerable virtual machines as zombies, and finally DDoS attacks through the compromised zombies. Within the cloud system, especially the Infrastructure-as-a-Service (IaaS) clouds, the detection of zombie exploration attacks is extremely difficult. This is because cloud users may install vulnerable applications on their virtual machines. To prevent vulnerable virtual machines from being compromised in the cloud, we propose a multiphase distributed vulnerability detection, measurement, and countermeasure selection mechanism called NICE, which is built on attack graph-based analytical models and reconfigurable virtual network-based countermeasures. The proposed framework leverages OpenFlow network programming APIs to build a monitor and control plane over distributed programmable virtual switches to significantly improve attack detection and mitigate attack consequences. The system and security evaluations demonstrate the efficiency and effectiveness of the proposed solution. <s> BIB003 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> A. SDN as a Security Solution <s> Security has been considered as one of the top concerns in clouds. Intrusion Detection and Prevention Systems (IDPS) have been widely deployed to enhance the cloud security. Using Software-Defined Networking (SDN) approaches to enhance the system security in clouds has been recently presented in [1], [2]. However, none of existing works established a comprehensive IPS solution to reconfigure the cloud networking environment on-the-fly to counter malicious attacks. In this paper, we present an SDN-based IPS solution called SDNIPS that is a full lifecycle solution including detection and prevention in the cloud. We propose a new IDPS architecture based on Snort-based IDS and Open vSwitch (OVS). We also compare the SDN-based IPS solution with the traditional IPS approach from both mechanism analysis and evaluation. Network Reconfiguration (NR) features are designed and implemented based on the POX controller to enhance the prevention flexibility. Finally, evaluations of SDNIPS demonstrate its feasibility and efficiency over traditional approaches. <s> BIB004 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> A. SDN as a Security Solution <s> Network convergence, user mobility and various types of applications all contribute to the inhomogeneity of modern networks. The emergence of new technologies, unfortunately, increases the number of possible security threats to all parts of infrastructure. Therefore, network security protocols and mechanisms have to be able to respond to any security threat without affecting the performance of the network or degrading the quality of service. This paper presents an early stage concept of a transparent intrusion prevention system (TIPS) implemented using a combination of various technologies, most notably Software-Defined Networking (SDN) and poll-mode packet processing, which enables deep packet inspection in high-speed network environments. <s> BIB005 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> A. SDN as a Security Solution <s> While the threats in Internet are still increasing and evolving (like intra multi-tenant data center attacks), protection and detection mechanisms are not fully accurate. Therefore, forensics is vital for recovering from an attack but also to identify the responsible entities. Therefore, this paper focuses on tracing back to the sources of an anomaly in the network. In this paper, we propose a method leveraging the Software Defined Networking (SDN) paradigm to passively identify switches composing the network path of an anomaly. As SDN technologies tend to be deployed in the next generation of networks including in data centers, they provide a helpful framework to implement our proposal without developing dedicated routers like usual IP traceback techniques. We evaluated our scheme with different network topologies (Internet and data centers) by considering distributed attacks with numerous hosts. <s> BIB006
The various security threats that can be resolved using SDN are summarized in the Table I leave a backdoor for network intrusions through spoofing or so with an aim of compromising or even crashing the targeted devices on a network. For instance, while mapping IP network addresses to the hardware addresses, ARP protocol does not perform authentication on messages, allowing attackers to execute "man-in-themiddle" attacks. 4) Traffic Flooding Attacks: Attacker can generate traffic loads too heavy for the network to overwhelm the overall network resources. These attacks can be easily controlled using SDN. 5) Trojan based Attack: This attack instigates DoS attacks, erase stored data or open back doors to permit system control by outside attackers. There are different defense solutions based on SDN which are discussed below. CloudWatcher has been proposed in BIB002 for controlling the traffic flow in SDN with program logic and efficiently routing it through all security components present in the infrastructure such as Network IDS and firewalls. This prevents the entry of malicious packets that may pose a threat to the network. Network Intrusion detection and Countermeasure sElection in virtual network systems (NICE) has been proposed in BIB003 for both intrusion detection and prevention. NICE has four modules: NICE-A, VM profiling, attack analyzer and a network controller. The NICE-A works as a network IDS, VM profiling stores the complete activities of VMs (including traffic conditions, open ports, vulnerabilities and security alerts etc.), attack analyzer is responsible for analyzing attacks and providing countermeasures, and the network controller helps the analyzer by reporting the complete information of the network conditions. On-path detection and off-path detection approaches have been proposed in  . In on-path detection, the suspicious packets are detected by attaching the IDS system in the path of travel of packets. It is more effective than the off-path detection where the IDS is attached as a separate physical module to the system. The other security feature is the ability of the IDS to report suspicious activities to the controller using alerts/alarms so that the controller can immediately take an action to mitigate the attacks. IDS and IPS have been integrated with SDN in BIB004 , BIB005 , and  to analyze attacks in a network and supply suitable countermeasures for the attacks. The network controller is utilized to gather the required information for the attack analyzer to detect these threats/attacks. SDN is implemented along with a prominent IDS system called Snort BIB001 for the detection of threats in Advanced Metering Infrastructure (AMI) which are popular in smart energy grids. The standalone IDS cannot prevent the malware from entering the system, so SDN is embedded with it to guard and protect the system. Snort detects the malware based on predefined rules. These are different methods of incorporating snort with SDN including mirror implementation and PACKET_IN approach BIB001 . In mirror implementation, Snort is connected to the OpenFlow switch in SDN where all the traffic is made to pass through both OpenFlow switch and snort for detection of suspicious activity. In PACKET_IN approach, snort runs as a background application connected to the OpenFlow controller and only suspicious activity are reported to the controller. The limitation of these methods is that there might be flooding of traffic in the network. The new method for integration is proposed in  where the rules of snort are incorporated into OpenFlow switches and snort comes into play only when there is some suspicious activity in the system. The additional features are also embedded in OpenFlow which includes management server to controller and policy checking agents in switches. Transparent Intrusion Prevention Systems (TIPS) BIB005 has been proposed to prevent intrusion attacks by integrating SDN and poll-mode packet processing BIB005 . SDN-IPS has been proposed in BIB004 to prevent the intrusion attacks in a network with high efficiency. 2) SDN for Anomaly Detection: Anomaly detection (or outlier detection) in a network is the identification of events or observations which do not conform to an expected pattern. These days attacks are becoming more sophisticated which makes it hard to trace the actual origin of the attack. SDN technology gives us a privilege to configure the devices to serve our need. For instance, home router that is configured using SDN works effectively to detect the malware and spyware attacking the system  . A graphical approach has been proposed in BIB006 that relies on OpenFlow based switches to trace-back the origin of attacks where all paths that are vulnerable to anomaly attacks can be determined. With the implementation of SDN, collaborative detection can be implemented through already existing centralized SDN controller where each switch or host reports its attack detection decision to the centralized controller. For binary decision variable d i ∈ {0, 1} of each switch/host i = 1, 2, . . . , N, to make a decision (D) about the attack, SDN controller can use logical AND operation (∪) as or logical OR operation ( ) as Note that the AND operator in (1) says there is an attack when d i = 1, ∀i and thus this approach is more restrictive/conservative. Whereas the OR operator in (2) says there is an attack when any one of d i 's is true making it the least conservative. Thus, alternative approach could be the majority based decision that is given as which could be a more appropriate scheme to enhance the performance of anomaly detection.