The need to adaptively manage computer systems and networks so as to offer good Quality of Service (QoS) and Quality of Experience (QoE) with secure operation at relatively low levels of energy consumption is challenged by their sheer complexity and the wide variability of the workloads. A possible way forward is through self-awareness, whereby self-measurement and self-observation, together with on-line control mechanisms, operate adaptively to attain the required performance and QoE. We survey the premises for these ideas arising from cognitive science and active networks and review recent work on self-aware computer systems and networks, including those that propose the use of software-defined networks as a means to implement these concepts. Then we provide some examples from the literature on self-aware systems to illustrate the performance gains that they can provide. Finally, we detail an example system and its working algorithms to allow the reader to understand how such a system may be implemented. Measurements showing how it can react rapidly to changing network conditions regarding QoS and security are presented. Some conclusions and suggestions for further work are listed.

The concept of Security Aware Routing is not widely adopted in current networks. However, the new IoT-centric core networks give possibilities to re-open that field of research. We consider routing to be an addition to existing network security methods, especially in IoT domain. Security-aware routing incorporates the security and safety metrics to the traditional set of metrics (bandwidth, network delay, hop count, path cost, load etc.). The paper shows a new approach in which, based on the Software Defined Networks (SDN) we estimate trust relationships between nodes and flows and use them to create SDN paths, based on the Cognitive Packet Network (CPN) principle. The Random Neural Networks (RNN) supported with cognitive packets are used for making routing decisions. The proposed solution was designed and is being implemented within the SerIoT project to demonstrate secure networks for the Internet of Things (IoT).

It has been proven in research literature that the analysis of encrypted traffic with statistical analysis and machine learning can reveal the type of activities performed by a user accessing the network, thus leading to privacy risks. In particular, different types of traffic (e.g., skype, web access) can be identified by extracting time based features and using them in a classifier. Such privacy attacks are asymmetric because a limited amount of resources (e.g., machine learning algorithms) can extract information from encrypted traffic generated by cryptographic systems implemented with a significant amount of resources. To mitigate privacy risks, studies in research literature have proposed a number of techniques, but in most cases only a single technique is applied, which can lead to limited effectiveness. This paper proposes a mitigation approach for privacy risks related to the analysis of encrypted traffic which is based on the integration of three main components: (1) A machine learning component which proactively analyzes the encrypted traffic in the network to identify potential privacy threats and evaluate the effectiveness of various mitigation techniques (e.g., obfuscation), (2) a policy based component where policies are used to enforce privacy mitigation solutions in the network and (3) a network node profile component based on the Manufacturer Usage Description (MUD) standard to enable changes in the network nodes in the cases where the first two components are not effective in mitigating the privacy risks. This paper describes the different components and how they interact in a potential deployment scenario. The approach is evaluated on the public dataset ISCXVPN2016 and the results show that the privacy threat can be mitigated significantly by removing completely the identification of specific types of traffic or by decreasing the probability of their identification as in the case of VOIP by 50%, Chat by 40% and Browsing by 33%, thus reducing significantly the privacy risk.

Internet of Things is nowadays growing faster than ever before. Operators are planning or already creating dedicated networks for this type of devices. There is a need to create dedicated solutions for this type of network, especially solutions related to information security. In this article we present a mechanism of security-aware routing, which takes into account the evaluation of trust in devices and packet flows. We use trust relationships between flows and network nodes to create secure SDN paths, not ignoring also QoS and energy criteria. The system uses SDN infrastructure, enriched with Cognitive Packet Networks (CPN) mechanisms. Routing decisions are made by Random Neural Networks, trained with data fetched with Cognitive Packets. The proposed network architecture, implementing the security-by-design concept, was designed and is being implemented within the SerIoT project to demonstrate secure networks for the Internet of Things (IoT).

A 2.3Tbps DDoS attack was recently mitigated by Amazon, which is a new record after the 2018 GitHub attack, or the famous 2016 Dyn DNS attack launched from hundreds of thousands of hijacked Internet of Things (IoT) devices. These attacks may disrupt the lives of billions of people worldwide, as we increasingly rely on the Internet. In this paper, we tackle the problem that hijacked IoT devices are often the origin of these attacks. With the goal of protecting the Internet and local networks, we propose Autopolicy: a system that automatically limits the IP traffic bandwidth—and other network resources—available to IoT devices in a particular network. We make use of the fact that devices, such as sensors, cameras, and smart home appliances, rarely need their high-speed network interfaces for normal operation. We present a simple yet flexible architecture for Autopolicy, specifying its functional blocks, message sequences, and general operation in a Software Defined Network. We present the experimental validation results, and release a prototype open source implementation.