In modern network infrastructure, Distributed Denial of Service (DDoS) attacks are considered as severe network security threats. For conventional network security tools it is extremely difficult to distinguish between the higher traffic volume of a DDoS attack and large number of legitimate users accessing a targeted network service or a resource. Although these attacks have been widely studied, there are few works which collect and analyse truly representative characteristics of DDoS traffic. The current research mostly focuses on DDoS detection and mitigation with predefined DDoS data-sets which are often hard to generalise for various network services and legitimate users’ traffic patterns. In order to deal with considerably large DDoS traffic flow in a Software Defined Networking (SDN), in this work we proposed a fast and an effective entropy-based DDoS detection. We deployed generalised entropy calculation by combining Shannon and Renyi entropy to identify distributed features of DDoS traffic—it also helped SDN controller to effectively deal with heavy malicious traffic. To lower down the network traffic overhead, we collected data-plane traffic with signature-based Snort detection. We then analysed the collected traffic for entropy-based features to improve the detection accuracy of deep learning models: Stacked Auto Encoder (SAE) and Convolutional Neural Network (CNN). This work also investigated the trade-off between SAE and CNN classifiers by using accuracy and false-positive results. Quantitative results demonstrated SAE achieved relatively higher detection accuracy of 94% with only 6% of false-positive alerts, whereas the CNN classifier achieved an average accuracy of 93%.

Software Defined Networks (SDN) with OpenFlow (OF) based protocol tend to transform traditional network architecture to vendor independent architecture with data-plane and control-plane programmability. This programmability provides a rich functionality in central traffic management, switch configuration, Intrusion Detection System (IDS) integration and global view of entire deployed infrastructure. The SDN network comprises single point failure vulnerability mainly at central controller unit, the deployment of standalone legacy IDS sensors cannot guarantee for safeguard against intruders. Therefore, in the first stage of proposed work, a signature-based Snort IDS is implemented for malicious activity detection and traffic monitoring with traffic mirroring in Open vSwitch (OVS), then store in csv log file of Barnyard 2. In second stage, for the purpose of effective attack detection in the test-bed, a flowbased anomaly detection is deployed with Deep Neural Networks (DNN) to improve the signature-based IDS limitation with higher detection rate with low false-positive triggers. To assess the efficacy of our proposed collaborative detection technique, a testbed is developed to simulate malicious and benign traffic. From the simulation results, our collaborative detection mechanism achieved more than 90% true positive rate with less than 5% of false alarms for all TCP, UDP and ICMP attacks in general, demonstrating effective malicious traffic detection method as compared to conventional signature based methodologies.

Due to the rapid increment of the cyber attacks, intrusion detection system (IDS) is shifting towards collaborative approaches. There is a huge demand for securing larger networking environments for providing a safeguard against threats. In order to optimize the feasible detection performance, Collaborative Intrusion Detection Networks (CIDN) approaches have been adopted in practical scenarios, which enables a group of IDS nodes to mutually share and exchange mandatory information with each other, for example, IDS-signatures, attacks alarms. However, CIDN networks are distributed in nature, such networks still face plenty of implementation problems, especially, insider intruder can easily dominate any of security node and leave the entire security system vulnerable. To achieve the trust-based communication between each of IDS node, the recent advancement in blockchain applications is considered as a good fit to create trust-based communication in CIDN networks. This work converges CIDN network and blockchain in SDN context. Firstly, we investigated existing related work and highlighted challenges and research gap towards blockchain in CIDN networks. Secondly, we utilised three collaborated Snort IDS to receive the latest signature update from Ryu and then to securely share such signatures updates to all other Snort nodes within test-bed. Our work is motivated to detect seven types of common attacks with collaborated signature-based IDS, which feasibly processes more packets to achieve satisfactory detection results. Overall the evaluation results show that with the adoption of blockchain protocols, the proposed CIDN network achieves 96% of TP rate detection rate for TCP, UDP and ICMP packets.

The internet of things (IoT) is becoming more significant in everyday life as a mechanism for making major decisions in different fields as smart devices and data in real time are connected and updated. IoT is being used in a variety of ways to provide digital services to the public. Online payment, property purchase, and sailing are just a few examples. On the other hand, users' complaints about the safety and privacy of their personal information are growing. The internet of things (IoT) is becoming more popular and significantly enhances e-government. This chapter primarily focuses on how potential users can obtain information to use the internet of things and its related services within the e-government sectors. There are several technological, administrative, and political challenges to IoT adoption problems in e-government and legal problems that must be solved to develop effective and required applications. It's crucial to explore these problems and potential solutions. Request access from your librarian to read this chapter's full text.