Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 2) Anomaly Attacks in SDN: <s> Worm detection and response systems must act quickly to identify and quarantine scanning worms, as when left unchecked such worms have been able to infect the majority of vulnerable hosts on the Internet in a matter of minutes [9]. We present a hybrid approach to detecting scanning worms that integrates significant improvements we have made to two existing techniques: sequential hypothesis testing and connection rate limiting. Our results show that this two-pronged approach successfully restricts the number of scans that a worm can complete, is highly effective, and has a low false alarm rate. <s> BIB001 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 2) Anomaly Attacks in SDN: <s> We develop a behavior-based anomaly detection method that detects network anomalies by comparing the current network traffic against a baseline distribution. The Maximum Entropy technique provides a flexible and fast approach to estimate the baseline distribution, which also gives the network administrator a multi-dimensional view of the network traffic. By computing a measure related to the relative entropy of the network traffic under observation with respect to the baseline distribution, we are able to distinguish anomalies that change the traffic either abruptly or slowly. In addition, our method provides information revealing the type of the anomaly detected. It requires a constant memory and a computation time proportional to the traffic rate. <s> BIB002 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 2) Anomaly Attacks in SDN: <s> The behavior of a Software-Defined Network is controlled by programs, which like all software, will have bugs - but this programmatic control also enables new ways to debug networks. This paper introduces ndb, a prototype network debugger inspired by gdb, which implements two primitives useful for debugging an SDN: breakpoints and packet backtraces. We show how ndb modifies forwarding state and logs packet digests to rebuild the sequence of events leading to an errant packet, providing SDN programmers and operators with a valuable tool for tracking down the root cause of a bug. <s> BIB003 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 2) Anomaly Attacks in SDN: <s> OpenFlow is an open standard that has gained tremendous interest in the last few years within the network community. It is an embodiment of the software-defined networking paradigm, in which higher-level flow routing decisions are derived from a control layer that, unlike classic network switch implementations, is separated from the data handling layer. The central attraction to this paradigm is that by decoupling the control logic from the closed and proprietary implementations of traditional network switch infrastructure, researchers can more easily design and distribute innovative flow handling and network control algorithms. Indeed, we also believe that OpenFlow can, in time, prove to be one of the more impactful technologies to drive a variety of innovations in network security. OpenFlow could offer a dramatic simplification to the way we design and integrate complex network security applications into large networks. However, to date there remains a stark paucity of compelling OpenFlow security applications. In this paper, we introduce FRESCO, an OpenFlow security application development framework designed to facilitate the rapid design, and modular composition of OF-enabled detection and mitigation modules. FRESCO, which is itself an OpenFlow application, offers a Click-inspired [19] programming framework that enables security researchers to implement, share, and compose together, many different security detection and mitigation modules. We demonstrate the utility of FRESCO through the implementation of several well-known security defenses as OpenFlow security services, and use them to examine various performance and efficiency aspects of our proposed framework. <s> BIB004 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 2) Anomaly Attacks in SDN: <s> We provide a brief overview of the vulnerabilities present in the OpenFlow protocol as it is currently deployed by hardware and software vendors. We identify a widespread failure to adopt TLS for the OpenFlow control channel by both controller and switch vendors, leaving OpenFlow vulnerable to man-in-the-middle attacks. We also highlight the classes of vulnerabilities that emerge from the separation and centralization of the control plane in OpenFlow network designs. Finally, we offer suggestions for future work to address these vulnerabilities in a systematic fashion. <s> BIB005 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 2) Anomaly Attacks in SDN: <s> Software-defined network (SDN) has become one of the most important architectures for the management of largescale complex networks, which may require repolicing or reconfigurations from time to time. SDN achieves easy repolicing by decoupling the control plane from data plane. Thus, the network routers/switches just simply forward packets by following the flow table rules set by the control plane. Currently, OpenFlow is the most popular SDN protocol/standard and has a set of design specifications. Although SDN/OpenFlow is a relatively new area, it has attracted much attention from both academia and industry. In this paper, we will conduct a comprehensive survey of the important topics in SDN/OpenFlow implementation, including the basic concept, applications, language abstraction, controller, virtualization, quality of service, security, and its integration with wireless and optical networks. We will compare the pros and cons of different schemes and discuss the future research trends in this exciting area. This survey can help both industry and academia R&D people to understand the latest progress of SDN/OpenFlow designs. <s> BIB006
Anomaly attacks are involved with many risks such as unauthorized access, malicious application injection etc. which can affect the security of both applications and networks. Furthermore, these attacks are one of the most dangerous attacks that can occur in any layer of the network and are untraceable and hard to detect. Four anomaly detection techniques are proposed in  which are discussed below. 1) Threshold Random Walk with Credit-Based (TRW-CB) Algorithm BIB001 considers the user to be suspicious if the probability value (i.e., ratio of the number of unsuccessful connection and attempts made by the user) is greater than the fixed threshold value. 2) Rate Limiting Algorithm  considers the user to be suspicious if the user tries to establish communication with multiple devices in a given time above the threshold value. 3) Maximum Entropy Detection BIB002 provides the operator with complete view of network from all dimensions. It is two staged process in which it first categorizes the packets into various classes based on destination and then detects the anomalies based of rapidly varying traffic patterns. 4) Network Advertisement (NETAD)  is a two staged process. In the first stage, it filters out all unnecessary data such as non IP packets, leaving flows, etc. In the second stage, it monitors the network and detects rarely occurring events and then reports to the controller. The programmability features of SDN make it convenient to debug the errors as well as attract the attackers BIB003 . Similarly, No bugs In the Controller Execution (NICE) has been proposed in  which is a debugging tool in OpenFlow networks that monitors the condition of the complete system frequently and determines eleven kinds of bugs such as host unreachable after moving, delayed direct path, excess flooding, next TCP packet always dropped after reconfiguration, TCP packet dropped after reconfiguration, ARP packets forgotten during address resolution, duplicate SYN packets during transitions, packets of a new flow are dropped, packets drop when the load reduces etc. NICE approach provides a report of the policy violations and origin of attack helping the system to retrieve back from these bugs. FRESCO-DB has been developed in BIB004 from the click router  which contains two important modules that are embedded in NOX controller to detect and countermeasure the suspicious threats. The API module creates different schemes to counter attack the malware using IDS and other antimalware applications. Security Enforcement Kernel (SEK) module is used for the enforcement of the security related applications specified by the controller. The confidentiality and authenticity of applications in SDN can be protected by the method of encryption and cryptography  , BIB005 . Z3 prover method uses a high level programming language to distinguish a legitimate application from malicious applications for protecting confidentiality and integrity of applications BIB006 ,  .