Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 1) DDoS and DoS Attacks in SDN: <s> Distributed denial-of-service (DDoS) is a rapidly growing problem. The multitude and variety of both the attacks and the defense approaches is overwhelming. This paper presents two taxonomies for classifying attacks and defenses, and thus provides researchers with a better understanding of the problem and the current solution space. The attack classification criteria was selected to highlight commonalities and important features of attack strategies, that define challenges and dictate the design of countermeasures. The defense taxonomy classifies the body of existing DDoS defenses based on their design decisions; it then shows how these decisions dictate the advantages and deficiencies of proposed solutions. <s> BIB001 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 1) DDoS and DoS Attacks in SDN: <s> One recent trend in network security attacks is an increasing number of indirect attacks which influence network traffic negatively, instead of directly entering a system and damaging it. In future, damages from this type of attack are expected to become more serious. In addition, the bandwidth consumption by these attacks influences the entire network performance. This paper presents an abnormal network traffic detecting method and a system prototype. By aggregating packets that belong to the identical flow, we can reduce processing overhead in the system. We suggest a detecting algorithm using changes in traffic patterns that appear during attacks. This algorithm can detect even mutant attacks that use a new port number or changed payload, while signature-based systems are not capable of detecting these types of attacks. Furthermore, the proposed algorithm can identify attacks that cannot be detected by examining only single packet information. <s> BIB002 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 1) DDoS and DoS Attacks in SDN: <s> Traditional Network Intrusion Detection Systems (NIDSs) rely on either specialized signatures of previously seen attacks, or on expensive and difficult to produce labeled traffic datasets for user-profiling to hunt out network attacks. Despite being opposite in nature, both approaches share a common downside: they require the knowledge provided by an external agent, either in terms of signatures or as normal-operation profiles. In this paper we present UNIDS, an Unsupervised Network Intrusion Detection System capable of detecting unknown network attacks without using any kind of signatures, labeled traffic, or training. UNIDS uses a novel unsupervised outliers detection approach based on Sub-Space Clustering and Multiple Evidence Accumulation techniques to pin-point different kinds of network intrusions and attacks such as DoS/DDoS, probing attacks, propagation of worms, buffer overflows, illegal access to network resources, etc. We evaluate UNIDS in three different traffic datasets, including the well-known KDD99 dataset as well as real traffic traces from two operational networks. We particularly show the ability of UNIDS to detect unknown attacks, comparing its performance against traditional misuse-detection-based NIDSs. In addition, we also evidence the supremacy of our outliers detection approach with respect to different previously used unsupervised detection techniques. Finally, we show that the algorithms used by UNIDS are highly adapted for parallel computation, which permits to drastically reduce the overall analysis time of the system. <s> BIB003 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 1) DDoS and DoS Attacks in SDN: <s> SUMMARY ::: ::: Network flow monitoring is currently a common practice in mid- and large-size networks. Methods of flow-based anomaly detection are subject to ongoing extensive research, because detection methods based on deep packets have reached their limits. However, there is a lack of comprehensive studies mapping the state of the art in this area. For this reason, we have conducted a thorough survey of flow-based anomaly detection methods published on academic conferences and used by the industry. We have analyzed these methods using the perspective of similarity which is inherent to any anomaly detection method. Based on this analysis, we have proposed a new taxonomy of network anomalies and a similarity-oriented classification of flow-based detection methods. We have also identified four issues requiring further research: the lack of flow-based evaluation datasets, infeasible benchmarking of proposed methods, excessive false positive rate and limited coverage of certain anomaly classes. Copyright © 2014 John Wiley & Sons, Ltd. <s> BIB004 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 1) DDoS and DoS Attacks in SDN: <s> Software Defined Networking (SDN) is a new networking architecture that aims to provide better decoupling between network control (control plane) and data forwarding functionalities (data plane). This separation introduces several benefits, such as a directly programmable and (virtually) centralized network control. However, researchers showed that the required communication channel between the control and data plane of SDN creates a potential bottleneck in the system, introducing new vulnerabilities.Indeed, this behavior could be exploited to mount powerful attacks, such as the control plane saturation attack, that can severely hinder the performance of the whole network. In this paper we present LineSwitch, an efficient and effective solution against control plane saturation attack. LineSwitch combines SYN proxy techniques and probabilistic blacklisting of network traffic. We implemented LineSwitch as an extension of OpenFlow, the current reference implementation of SDN, and evaluate our solution considering different traffic scenarios (with and without attack). The results of our preliminary experiments confirm that, compared to the state-of-the-art, LineSwitch reduces the time overhead up to 30%, while ensuring the same level of protection. <s> BIB005
The SDN controller plays a crucial role in determining the functionality of SDN architecture, thus the controller has become one of the main targets for DDoS/DoS attacks. Some vulnerabilities in FloodLight based controllers lure DDoS/DoS attacks BIB005 ,  . The links between switches and controller is the point of interest for conducting these attacks. These attacks can be mitigated by enabling strict Transport Layer Security (TLS) authentication mechanisms in communication links between switches and controllers and also prioritizing the pre-existing connections over the new connection. Note that DDoS attacks can be detected using techniques proposed for conventional network, however same defense techniques proposed for traditional networks cannot be implemented directly in SDN due to the differences in the architecture. Ideas proposed for traditional networks can be borrowed while designing attack detection techniques for SDN. Typical DDoS attacks are untraceable as they are carried out by botnets with automated actions. To discover the DDoS attacks, there are different approaches BIB001 , BIB004 which could easily detect botnets. Protocols and IP addresses can be verified to detect DDoS attacks, however botnets can spoof the identity by faking legit addresses. In this case, the detection system might not be able to detect attacks since protocols and IP addresses are faked by attacker that seem legitimate for malicious legitimate users or botnets. Furthermore, DDoS attacks could occur at random interval and random time, and they are persistent. Important DDoS attack defense solutions are briefly discuss below. 1) Attack Pattern Recognition BIB002 : If the attack is happening at particular intervals, such as at any given date and time and repeating within similar intervals such as year or months, then the pattern of attack can be recognized. We can also gauge the duration of attacks and how long these attacks last. The nature of attack and the packets of attacks can give us a hint of what kind of attack is being carried out. If these information can be logged to create a database from the prior experiences of attack to generate the statistics, pattern of attack can be recognized. 2) System Clustering for Added Security BIB003 : For the provided system, DDoS can be nullified or made complicated to achieve by clustering the system. For each cluster created, user authentication can be added. With user authentication requirement, further credibility is necessary to penetrate and cause havoc. Therefore, clustering of system can provide added layer of security to be able to filter out attacks. Moreover, if an attack is carried out on one cluster of the system, rest of the cluster might be safe and not whole system is prone to DDoS attacks.