Abstract:By decoupling the control plane and data plane in the software-defined network (SDN), the controller gains a comprehensive global view of the network. The SDN controller samples traffic from all switches to effectively manage data plane traffic. The sampling rate of flow traffic significantly impacts the accuracy of the controller's decisions. While increasing the sampling rate is desirable for improved detection accuracy, it also escalates resource consumption on both switches and the controller. Hence, it is crucial to carefully manage sampling on switches to fine-tune anomaly detection accuracy. Existing flow sampling solutions often struggle to strike a balance between detection accuracy, sampling rate, and overhead. To address this challenge, we propose a robust cybersecurity framework for anomaly detection on SDNs through traffic flow inspection. Our proposed framework, Cyber-AnDe, integrates adaptive distributed sampling (ADS) with a Reinforcement Learning (RL) agent to enhance anomaly detection accuracy while minimizing the increase in controller overhead. In our framework, the controller leverages information gathered from each sampled traffic flow to determine whether the flow's state is malicious, suspicious, or benign based on underlying anomaly detection algorithms. Once the flow state is determined, the controller takes the appropriate action with the help of the RL agent. Through extensive simulations and SDN test-bed experiments, we confirm a significant improvement of up to 93% in network traffic-based anomaly detection compared to existing solutions.

An Aware-Scheduling Security Architecture with Priority-Equal Multi-Controller for SDN

An Intensive Security Architecture With Multi-Controller For Sdn

DMSSM: A Decision-Making Scheme of Switch Migration for SDN Control Plane

Controller Placement Based on Hierarchical Multi-center SDN

Dynamic-Scheduling Mechanism of Controllers Based on Security Policy in Software-Defined Network

Safe Reconfiguring Data Plane Via Supervision over Resource and Flow States

A Multipath Resource Updating Approach for Distributed Controllers in Software-Defined Network

SDN Oriented Software-Defined Security Architecture

Blockchain-Based Control Plane Attack Detection Mechanisms for Multi-Controller Software-Defined Networks

Democratic Supervision Makes Controls in Software-Defined Networks More Secure

SDN-Empowered Reliable and Dynamic Scheduling Scheme for Security Resources.

SDN-ESRC: A Secure and Resilient Control Plane for Software-Defined Networks

Controller placement with critical switch aware in software-defined network (CPCSA)

Adaptive Suspicious Prevention for Defending DoS Attacks in SDN-Based Convergent Networks

Exploring Security Dynamics in SDN Controller Architectures: Threat Landscape and Implications

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

MNOS: a Mimic Network Operating System for Software Defined Networks.

An Efficient Scheme to Defend Data-to-Control-Plane Saturation Attacks in Software-Defined Networking

CCS: A Cross-Plane Collaboration Strategy to Defend Against LDoS Attacks in SDN

Security Control of Multiagent Systems Under Denial-of-Service Attacks

Cyber-AnDe: Cybersecurity Framework With Adaptive Distributed Sampling for Anomaly Detection on SDNs