软件定义网络中控制器调度时间机制设计与实现

doi:10.11959/j.issn.2096-109x.2018003

Abstract

Abstract:

Introducing multiple controllers to software defined network so that dynamically altering the mapping relationship between controller and the underlying network is an effective method to ease the security threats in control plane.However,little previous work has been done to investigate the economical time in dynamic-scheduling controllers.Firstly,the importance of scheduling-time in dynamic control plane based on security in SDN and dynamic control plane was introduced.Further,this problem was modeled as a renewal reward process and an optimal algorithm in deciding the right time to schedule was proposed.In our experiments,Simulations based on real network attack dataset are conducted and it demonstrate that proposed algorithm outperforms fixed-cycle algorithms and random algorithm.

Key words: software defined network, network security, controller

CLC Number:

TP393

Zhenping LU,Fucai CHEN,Guozhen CHENG. Design and implementation of the controller scheduling-time in SDN[J]. Chinese Journal of Network and Information Security, 2018, 4(1): 36-44.

Figures/Tables 8

References 24

[1]	JAIN S , KUMAR A , MANDAL S ,et al. B4:experience with a globally-deployed software defined wan[J]. Computer Communication Review, 2013,43(4): 3-14.
[2]	KREUTZ D , RAMOS F M V , VERISSIMO P . Towards secure and dependable software-defined networks[C]// ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking. 2013: 55-60.
[3]	LENG J , ZHOU Y , ZHANG J ,et al. An inference attack model for flow table capacity and usage:exploiting the vulnerability of flow table overflow in software-defined network[J]. Water Air ＆ Soil Pollution, 2015,85(3): 1413-1418.
[4]	SONCHACK J , DUBEY A , AVIV A J ,et al. Timing-based reconnaissance and defense in software-defined networks[C]// Conference on Computer Security Applications. 2016: 89-100.
[5]	CUI H , KARAME G O , KLAEDTKE F ,et al. On the fingerprinting of software-defined networks[J]. IEEE Transactions on Information Forensics ＆ Security, 2016,11(10): 2160-2173.
[6]	BERDE P , GEROLA M , HART J ,et al. ONOS:towards an open,distributed SDN OS[C]// The Workshop on Hot Topics in Software Defined Networking. 2014: 1-6.
[7]	MEDVED J , VARGA R , TKACIK A ,et al. OpenDaylight:towards a model-driven SDN controller architecture[C]// International Symposium on a World of Wireless,Mobile and Multimedia Networks. 2014: 1-6.
[8]	LI H , LI P , GUO S ,et al. Byzantine-resilient secure software-defined networks with multiple controllers in cloud[C]// International Conference on Communications. 2014: 695-700.
[9]	ELDEFRAWY K , KACZMAREK T . Byzantine fault tolerant software-defined networking (SDN) controllers[C]// Computer Society International Conference on Computers,Software ＆ Applications. 2016: 208-213.
[10]	WANG T , LIU F , GUO J ,et al. Dynamic SDN controller assignment in data center networks:Stable matching with transfers[C]// The IEEE International Conference on Computer Communications. 2016: 1-9.
[11]	QI C , WU J , HU H ,et al. An intensive security architecture with multi-controller for SDN[C]// Computer Communications Workshops. 2016: 401-402.
[12]	扈红超, 陈福才, 王禛鹏 . 拟态防御 DHR 模型若干问题探讨和性能评估[J]. 信息安全学报, 2016,1(4): 40-51.
	HU H C , CHEN F C , WANG Z P . Discussion and performance evaluation of the proposed DHR model[J]. Journal of Cyber Security, 2016,1(4): 40-51
[13]	QI C , WU J , HU H ,et al. Dynamic-scheduling mechanism of controllers based on security policy in software-defined network[J]. Electronics Letters, 2016,52(23): 1918-1920.
[14]	LU Z P , CHEN F C . Poster:A Secure control plane with dynamic Multi-NOS for SDN[C]// Network and Distributed System Security Symposium (NDSS). 2017.
[15]	ZHUANG R , DELOACH S A , OU X . Towards a theory of moving target defense[C]// ACM Workshop on Moving Target Defense. ACM, 2014: 31-40.
[16]	RUI ZHUANG , ALEXANDRU G ,et al. A theory of cyber attacks a step towards analyzing mtd systems[J].--> In Proceedings of the 2nd ACM Workshop on Moving Target Defense (MTD), 2015.
[17]	BROOKS M , YANG B . A Man-in-the-Middle attack against OpenDayLight SDN control-ler[C]// ACM Conference on Research in Information Technology. ACM, 2015: 45-49.
[18]	ECESSA. What does network downtime ＆ latency cost your business[EB/OL]. .
[19]	ILGUN K , KEMMERER R A , PORRAS P A . State transition analysis:a rule-based intrusion detection approach[J]. IEEE Transactions on Software Engineering, 1995,21(3): 181-199.
[20]	LEE S , YOON C . DELTA:a security assessment framework for software-defined networks[C]// Network and Distributed System Security Symposium. 2017.
[21]	WANG H , LI F , CHEN S . Towards cost-effective moving target defense against DDoS and covert channel attacks[C]// ACM Workshop on Moving Target Defense. 2016: 15-25.
[22]	WANG A , CHANG W , MOHAISEN A ,et al. Delving into internet DDoS attacks by botnets:characterization and analysis[C]// The 45th IEEE International Conference on Dependable Systems and Networks (DSN). 2015.
[23]	MATTHEWS T . INCAPSULA survey :what DDoS attacks really cost businesses[EB/OL]. .
[24]	JAFARIAN J H , AL-SHAER E , QI D . Adversary-aware IP address randomization for proactive agility against sophisticated attackers[C]// The 34th IEEE Conference on Computer Communications (INFOCOM). 2015: 238-276.

Metrics

Recommended 0

No Suggested Reading articles found!

符号	描述
ψ	敏感信息参数集合
C_s	调度开销
_Aloss	攻击损耗
S_list	调度时刻序列
t_past	距上次调度已过去的时间
T	计算的下次调度的时间
X_i	代表第i次调度和第i?1次调度之间的的时间间隔
Y_i	第i次调度之后，攻击方攻击成功需要的探测时间
f (x)	攻击历史的概率密度函数
R_i	X_i期间，防御者代价

显著性水平	结果
0.05	108组为正态分布，其余43组不属于任何分布
0.1	几乎全部为正态部分

算法	描述
SCH_rundom	随机地从历史攻击间隔中选取一个时间
SCH_average	历史攻击间隔的平均值
SCH_median	历史攻击间隔的中值
SCH_short	选取历史攻击间隔最小值和中间值之间的中值
SCH_long	选取历史攻击间隔中值和最大值之间的中值
SCHl_ongest	选取历史攻击间隔最大的时间

Design and implementation of the controller scheduling-time in SDN

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 8

References 24

Related Articles 15

Metrics

Recommended 0

[1]	Heli WANG, Qiao YAN. Selfish mining detection scheme based on the characters of transactions [J]. Chinese Journal of Network and Information Security, 2023, 9(2): 104-114.
[2]	Dong LI, Yanni HAO, Shenghui PENG, Ruijie ZI, Ximeng LIU. Network security of the National Natural Science Foundation of China: today and prospects [J]. Chinese Journal of Network and Information Security, 2022, 8(6): 92-101.
[3]	Fukang XING, Zheng ZHANG, Ran SUI, Sheng QU, Xinsheng JI. Qualitative modeling and analysis of attack surface for process multi-variant execution software system [J]. Chinese Journal of Network and Information Security, 2022, 8(5): 121-128.
[4]	Zenan WANG, Jiahao LI, Chaohong TAN, Dechang PI. Design and analysis of intelligent service chain system for network security resource pool [J]. Chinese Journal of Network and Information Security, 2022, 8(4): 175-181.
[5]	Shijie TANG, Fang YUAN, Jun LI, Yong DING, Huiyong WANG. Review on security risks of key components in industrial control system [J]. Chinese Journal of Network and Information Security, 2022, 8(3): 1-17.
[6]	Xinya WANG, Guang HUA, Hao JIANG, Haijian ZHANG. Survey on intellectual property protection for deep learning model [J]. Chinese Journal of Network and Information Security, 2022, 8(2): 1-14.
[7]	Yang WANG, Guangming TANG, Shuo WANG, Jiang CHU. Defense mechanism of SDN application layer against DDoS attack based on API call management [J]. Chinese Journal of Network and Information Security, 2022, 8(2): 73-87.
[8]	Weizhen HE, Fucai CHEN, Jie NIU, Jinglei TAN, Shumin HUO, Guozhen CHENG. Research progress on dynamic hopping technology for network layer [J]. Chinese Journal of Network and Information Security, 2021, 7(6): 44-55.
[9]	Tao WANG, Hongchang CHEN. Multi-objective optimization placement strategy for SDN security controller considering Byzantine attributes [J]. Chinese Journal of Network and Information Security, 2021, 7(3): 72-84.
[10]	Pu ZHAO, Wentao ZHAO, Zhangjie FU, Qiang LIU. SDN self-protection system based on Renyi entropy [J]. Chinese Journal of Network and Information Security, 2021, 7(3): 85-94.
[11]	Chenglei ZHANG, Yulong FU, Hui LI, Jin CAO. Research on security scenarios and security models for 6G networking [J]. Chinese Journal of Network and Information Security, 2021, 7(1): 28-45.
[12]	Qi WU,Hongchang CHEN. Low failure recovery cost controller placement strategy in software defined networks [J]. Chinese Journal of Network and Information Security, 2020, 6(6): 97-104.
[13]	Wei HUANG, Ran LU, Cuncai LIU, Sibo QI. QoS routing algorithm based on multiple domain architecture of SDN [J]. Chinese Journal of Network and Information Security, 2019, 5(5): 21-31.
[14]	Yang WANG,Guangming TANG,Cheng LEI,Dong HAN. Multidimensional detection and dynamic defense method for link flooding attack [J]. Chinese Journal of Network and Information Security, 2019, 5(4): 80-90.
[15]	QIN Yuhai,LIU Luyuan,GAO Haohang,LIU Shengqiao,DONG Han. Innovative professional skills competition to create a police practice talents [J]. Chinese Journal of Network and Information Security, 2019, 5(3): 75-80.