Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) SDN for Distributed Denial-of-Service (DDoS) Attack Detection and Prevention: <s> developments in this area in recent years. In this article, we present an in-depth study of the denial of service problem in the Internet, and provide a comprehensive survey of attacks and their countermeasures. We investigate various DoS attack mechanisms, derive a more practical taxonomy of attack mechanisms, and summarize the challenges in DoS defense. We critically review the state of the art in DoS defense, analyze the strengths and weaknesses of dierent proposals, and conclude a comprehensive taxonomy of various defense mechanisms. <s> BIB001 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) SDN for Distributed Denial-of-Service (DDoS) Attack Detection and Prevention: <s> The rapid adoption of mobile devices comes with the growing prevalence of mobile malware. Mobile malware poses serious threats to personal information and creates challenges in securing network. Traditional network services provide connectivity but do not have any direct mechanism for security protection. The emergence of Software-Defined Networking (SDN) provides a unique opportunity to achieve network security in a more efficient and flexible manner. In this paper, we analyze the behaviors of mobile malware, propose several mobile malware detection algorithms, and design and implement a malware detection system using SDN. Our system detects mobile malware by identifying suspicious network activities through real-time traffic analysis, which only requires connection establishment packets. Specifically, our detection algorithms are implemented as modules inside the OpenFlow controller, and the security rules can be imposed in real time. We have tested our system prototype using both a local testbed and GENI infrastructure. Test results confirm the feasibility of our approach. In addition, the stress testing results show that even unoptimized implementations of our algorithms do not affect the performance of the OpenFlow controller significantly. <s> BIB002 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) SDN for Distributed Denial-of-Service (DDoS) Attack Detection and Prevention: <s> DDoS attacks mounted by botnets today target a specific service, mobilizing only a small amount of legitimate-looking traffic to compromise the server. Detecting or blocking such clever attacks by only using anomalous traffic statistics has become difficult, and devising countermeasures has been mostly left to the victim server. In this paper, we investigate how a software-defined network (SDN) can be utilized to overcome the difficulty and effectively block legitimate looking DDoS attacks mounted by a larger number of bots. Specifically, we discuss a DDoS blocking application that runs over the SDN controller while using the standard OpenFlow interface. <s> BIB003 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) SDN for Distributed Denial-of-Service (DDoS) Attack Detection and Prevention: <s> In this paper, we investigate the applicability of Software-Defined Networking (SDN), and specifically the use of the OpenFlow protocol as a means to enhance the legacy Remote Triggered Black-Hole (RTBH) routing approach, towards Distributed Denial of Service (DDoS) attack mitigation. More specifically, we exploit the network programmability of OpenFlow to match and handle traffic on a per-flow level, in order to preserve normal operation of the victim, while pushing the mitigation process upstream towards the edge of the network. To this end, we implemented and evaluated a sketch-based anomaly detection and identification mechanism, capable of pinpointing the victim and remotely triggering the mitigation of the offending network traffic. The evaluation is based on the combination of datasets containing real DDoS attacks and normal background traffic from an operational university campus network. Our results demonstrated that the proposed approach succeeds in identifying the victim of the attack and efficiently filtering the malicious sources. <s> BIB004 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) SDN for Distributed Denial-of-Service (DDoS) Attack Detection and Prevention: <s> Although software-defined networking (SDN) brings numerous benefits by decoupling the control plane from the data plane, there is a contradictory relationship between SDN and distributed denial-of-service (DDoS) attacks. On one hand, the capabilities of SDN make it easy to detect and to react to DDoS attacks. On the other hand, the separation of the control plane from the data plane of SDN introduces new attacks. Consequently, SDN itself may be a target of DDoS attacks. In this paper, we first discuss the new trends and characteristics of DDoS attacks in cloud computing environments. We show that SDN brings us a new chance to defeat DDoS attacks in cloud computing environments, and we summarize good features of SDN in defeating DDoS attacks. Then we review the studies about launching DDoS attacks on SDN and the methods against DDoS attacks in SDN. In addition, we discuss a number of challenges that need to be addressed to mitigate DDoS attached in SDN with cloud computing. This work can help understand how to make full use of SDN's advantages to defeat DDoS attacks in cloud computing environments and how to prevent SDN itself from becoming a victim of DDoS attacks. <s> BIB005 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 3) SDN for Distributed Denial-of-Service (DDoS) Attack Detection and Prevention: <s> Distributed Denial of Service attacks (DDoS) have remained as one of the most destructive attacks in the Internet for over two decades. Despite tremendous efforts on the design of DDoS defense strategies, few of them have been considered for widespread deployment due to strong design assumptions on the Internet infrastructure, prohibitive operational costs and complexity. Recently, the emergence of Software Defined Networking (SDN) has offered a solution to reduce network management complexity. It is also believed to facilitate security management thanks to its programmability. To explore the advantages of using SDN to mitigate DDoS attacks, we propose a distributed collaborative framework that allows the customers to request DDoS mitigation service from ISPs. Upon request, ISPs can change the label of the anomalous traffic and redirect them to security middleboxes, while attack detection and analysis modules are deployed at customer side, avoiding privacy leakage and other legal concerns. Our preliminary analysis demonstrates that SDN has promising potential to enable autonomic mitigation of DDoS attacks, as well as other large-scale attacks <s> BIB006
DDoS attacks deny legitimate users to get access to network services. These attacks can cause a significant damage by compromising the entire network BIB005 . Conventional networks have some methods to detect DDoS attacks and protect the networks but do not offer very reliable and flexible defense solutions BIB001 . Due to the programmable features and reconfigurable nature of SDN, flexible and robust approaches can be designed, deployed and evaluated to detect and prevent DDoS attacks. The mobile devices have become more powerful compared to the past and usage of these devices have been exponentially increasing. This increases the chance of attacks including DDoS attacks in the network. Mobile malware detection approach has been proposed in BIB002 where mobile traffic from the access points is directed to the controller attached with a malware detector. Four algorithms for detecting malware are given below. 1) IP Blacklisting: A list of all suspicious IP addresses is maintained in the system. When switches send unmatched packets to OpenFlow controller, it verifies the IP address to see if it is from the blacklist and drops the packet if IP is found in that list. 2) Connection Success Ratio: If the number of unsuccessful connections of the users exceeds the fixed threshold value then the user is identified as malicious one. 3) Throttling Connection: The malicious device/host trying to attack many systems is identified based on the Recently Accessed Host (RAH) list maintained in the system. If the waiting list of the host exceeds a fixed threshold value then the user is identified as a malicious one. 4) Aggregate Analysis: If one host in the network is compromised by malicious activity then security of the other users in the network is also at risk. This algorithm works for detection of other infected hosts based on the similarities (i.e., connection time, destination and single platform). The integration of SDN for the mobile cloud infrastructure has been further explored in BIB005 for designing a sophisticated mechanisms for protecting the network. The prime cause for the occurrence of DDoS attack in system is due to botnets. The protocol for easy recovery from botnet DDoS attacks is developed in BIB003 where the SDN controller is extended with DDoS blocking module. In BIB004 , SDN has been exploited to use Remote Triggered Black Hole (RBTH) approach for the prevention of DDoS attacks. The SDN controller plays a major role in detecting the malicious traffic routed from OpenFlow switch and discards them to prevent further damage to the network. Furthermore, distributed collaborative framework has been proposed in BIB006 to enable autonomic mitigation of DDoS attacks by avoiding privacy leakage and other legal concerns.