Keeping Internet users protected from cyberattacks and other threats is one of the most prominent security challenges for network operators nowadays. Among other critical threats, distributed denial-of-service (DDoS) becomes one of the most widespread attacks in the Internet, which is very challenging to mitigate appropriately as DDoS attacks cause the system to stop working by resource exhaustion. Software-defined networking (SDN) has recently emerged as a new networking technology offering unprecedented programmability that allows network operators to configure and manage their infrastructures dynamically. The flexible processing and centralized management of the SDN controller allow flexibly deploying complex security algorithms and mitigation methods. In this paper, we propose a novel DDoS attack mitigation in SDN-based Internet Service Provider (ISP) networks for TCP-SYN and ICMP flood attacks utilizing machine learning approach, i.e., K-Nearest-Neighbor (KNN) and XGBoost. By deploying a testbed, we implement the proposed algorithms, evaluate their accuracy, and address the trade-off between the accuracy and mitigation efficiency. Through extensive experiments, the results show that the algorithms can efficiently mitigate the attack by over 98.0% while benign traffic is not affected.

Software-Defined Networking (SDN) leverages the implementation of reliable, flexible and efficient network security mechanisms which make use of novel techniques such as artificial intelligence (AI) and machine learning (ML). In particular, these techniques -together with SDN -are the key enablers for the design of anomaly detection methods which are based on efficient traffic flow monitoring. In this paper, we tackle this problem by proposing an efficient anomaly detection framework, denoted as DeepGuard, which improves the detection performance of cyberattacks in SDN based networks by adopting a fine-grained traffic flow monitoring mechanism. Specifically, the proposed framework utilizes a deep reinforcement learning technique, i.e., Double Deep Q-Network (DDQN), to learn traffic flow matching strategies maximizing the traffic flow granularity while proactively protecting the SDN data plane from being overloaded. Afterwards, by implementing the learned optimal traffic flow matching control policy, the most beneficial traffic information for anomaly detection is acquired at runtime — thereby improving the cyberattack detection performance. The performance of the proposed framework is validated by extensive experiments, and the results show that DeepGuard yields significant performance improvements compared to existing traffic flow matching mechanisms regarding the level of traffic flow granularity. In the case of distributed denial-of-service (DDoS) attacks, DeepGuard achieves a remarkable attack detection performance while effectively preventing forwarding performance degradation in the SDN data plane.

Distributed Denial of Service (DDoS) attack is one of the most long-lasting problems in network security. Recently, although the DDoS attack mechanisms are widely understood, the problems are becoming more frequent due to the similarity between DDoS attack and normal traffic. In this work, we propose two approaches of DDoS attack detection which are based on the Self-Organizing Map (SOM). The proposed algorithms with their detection architecture are implemented in the Software-Defined Networking (SDN) technology which has the flexibility and programmable abilities. The SDN controller allows us to quickly perform complex classification and detection algorithm. By deploying a testbed environment, we successfully evaluate our proposed algorithms in terms of both accuracy and computational overhead. The experimental results show that these algorithms can reduce the processing time while maintain the suitable accuracy rate.

The implementation of Internet-of-Things (IoT) applications faces several challenges in practice, such as compliance with Quality-of-Service requirements, resource constraints, and energy consumption. In this context, the joint edge–cloud paradigm for IoT applications can resolve some of the issues arising in pure cloud computing scenarios, such as those related to latency, energy, or privacy. Therefore, an edge–cloud environment could be promising for resource and energy-efficient IoT applications that implement virtual network functions (VNFs) bound together into service function chains (SFCs). However, a resource and energy-efficient SFC placement requires smart SFC embedding mechanisms in the edge–cloud environment, as several challenges arise, such as IoT service chain modeling and evaluation, the tradeoff between resource allocation, energy efficiency and performance, and the resource dynamics. In this article, we address issues in modeling resource and energy utilization for IoT applications in edge–cloud environments. A smart traffic monitoring IP camera system is deployed as a use case for a realistic modeling of a service chain. The system is implemented in our testbed, which is designed and developed specifically to model and investigate the resource and energy utilization of SFC embedding strategies. A resource and energy-aware SFC strategy in the edge–cloud environment for IoT applications is then proposed. Our algorithm is able to cope with dynamic load and resource situations emerging from dynamic SFC requests. The strategy is evaluated systematically in terms of the acceptance ratio of SFC requests, resource efficiency and utilization, power consumption, and VNF migrations depending on the offered system load. Results show that our strategy outperforms some existing approaches in terms of resource and energy efficiency, thus it overcomes the relevant challenges from practice and meets the demands of IoT applications.

In this paper, we propose an optimized protection mechanism (OpenFlowSIA) for Software-Defined Networks from flooding attacks (Distributed Denial-of-Service) based on Support Vector Machine and our proposed algorithm called the Idle-timeout Adjustment (IA). Our methodology not only utilizes SVM advantages in classification such as high accuracy and little processing time, but also applies effectively the IA algorithm and coherent policies to protect network from resource exhaustion caused by flooding attacks, particularly for the SDN controller and OpenFlow switches. Through comprehensive experiments, the OpenFlowSIA scheme illustrates that it can be an innovative solution to secure and save the network resources under flooding attacks in the Software-Defined Networks.

To meet the development of Internet of Things (IoT), IETF has proposed IPv6 standards working under low-power and low-cost constraints. In this paper, we provide insights on RPL (routing protocol for low power and lossy networks) under the condition of multiple RPL instances. For the study, we use the Contiki operating system, together with the COOJA simulator. Our work investigates the use of two distinctive objective functions under multiple RPL instances for differentiating QoS at network layer in WSNs. The metrics evaluated include routing tree convergence, latency and packet delivery ratio. The study can also serves as a basis for future enhancement of the use of multiple RPL instances for a plethora of IoT applications.