This document discusses SDN and network security. It proposes an anomaly detection algorithm to identify malicious activity on an SDN network. The algorithm involves collecting switch statistics, processing the data using time-series analysis, making decisions with fuzzy logic, and training the system with short-term and long-term learning modules. It also describes implementing two SDN security applications: TRW-CB for detecting SYN flooding attacks and rate limiting to control bursty traffic. The document concludes that SDN provides opportunities for effective network security through technologies like OpenFlow.

1. BY:-
SUBITH BABU
140303002

2.  SDN
 OpenFlow
 Why security?
 SDN security Algorithms
 Anomaly detection algorithm
 Conclusion
 References

3.  software-defined networks (SDN) offer
researchers unprecedented control over
network infrastructure .
 define a single point of control over the data
flows routing of all network infrastructure.
 OpenFlow protocol is an embodiment of the
software-defined networking paradigm.

4.  the OpenFlow (OF) is the mostly commonly
used SDN communication protocol.
 OpenFlow protocol can offer the flexibility.
 In OpenFlow control plane rules define the
basic instructions for flows that specify
forwarding, changing, or dropping packets that
enter the OF-switch.
 OpenFlow controller contains the logic for
defining,update and adapt of flow rules.

6.  Because the control plane plays a critical
role and changes are typically propagated
throughout the network, ensuring that
applications are authenticated, connections
are securely encrypted, security policies are
properly applied.

7.  Different steps are involved in the algorithm :-
A. Aggregation of parameters and statistics
collection
B. Actions
C. Adapted network operating system software
interface
D. Statistical data processing and calculation of the
characteristics
E. Decision-making based on the calculated
characteristics
F. Training of decision-making system

9.  statistics collection directly on the switch;
 this gives the opportunity to analyze the
traffic and perform actions closer to the
source of malicious activity or destination
host.

10.  Main purpose: pass traffic, traffic filtering by
specific signatures, active response or
checking host.
 These actions are performed by the switch in
accordance with the tables of flows specified
by the controller.

11.  A network operating system of SDN controller
should provide a specialized set of functions for
efficient network security application operation.
 a set of functions to work with the flow rules :
A. Identifying the source of the rules , and
provide a method for signing rules.
B. Detection of conflicts between rules, for
example between the rules issued by the various
applications.
C. Conflict resolution based on the priorities of
the sources of the rules and their signatures.

12.  For processing collected statistical data is
proposed to use time-series analysis methods
like wavelet, spectrum analysis and etc.
 These methods facilitate analysis of time-
frequency traffic characteristics

13.  The main objective of the information security
management system is to detect malicious
activity on the basis of a set of input variables.
 Use the fuzzy logic decision making.

14.  Implementation of the training subsystem
includes short-term and long-term learning
modules.
A. shortterm learning module is implemented
directly in the controller.
B. long-term learning module can be
implemented either directly in the controller,
or in an external device,.

16.  constructed a prototype implementation of the
proposed architecture of protected SDN that
includes statistic collection and processing
module and decisionmaking module.
A. TRW-CB
B. Rate Limit

17.  TRW-CB algorithm was implemented as follows:
1. Assume that the host A sends a TCP SYN packet to the new
host B. Since there are no flows in the switch matching this
packet, the packet is forwarded to the controller.
2. The algorithm instance running on the controller simply
forwards this packet, through the switch, to host B, without
setting any new flows. At the same time, the algorithm adds
host B to the list of hosts that host A tried to contact and
decrements host’s balance.

18. 3. There are two possible answers from host B:
a. If TCP SYNACK packet from B to A is received (switch
again forwards this packet to the controller, because still
no flows matching this packet) then algorithm sets two
flows (from A to B and backwards), and deletes the
request from A host queue, as well as increments balance.
b. If TCP SYNACK packet from B is not received, the
algorithm does standard counters processing for the case
of connection failure without interacting with the switch
and without setting any flows.

20.  Implementation:-
A. Whenever a new connection request arrives to a host
which has recently been successful connected, we set
two flows in either direction between hosts.
B. If new request to connect arrives to a host, which is
not in the working set, we add it into the delay queue.
C. Every d seconds, the new connection requests are
moved from the delay queue to the working set and we
forward these requests through the switch without
installing any flows.
D. When receiving a positive reply, we install a pair of
flows in both directions.

21. package main
import "time"
import "fmt"
func main() {
requests := make(chan int, 5)
for i := 1; i <= 5; i++ {
requests <- i
}
close(requests)
limiter := time.Tick(time.Millisecond * 200)
for req := range requests {
<-limiter
fmt.Println("request", req, time.Now())
}
burstyLimiter := make(chan time.Time, 3)
for i := 0; i < 3; i++ {
burstyLimiter <- time.Now()
}

22. go func() {
for t := range time.Tick(time.Millisecond * 200) {
burstyLimiter <- t
}
}()
burstyRequests := make(chan int, 5)
for i := 1; i <= 5; i++ {
burstyRequests <- i
}
close(burstyRequests)
for req := range burstyRequests {
<-burstyLimiter
fmt.Println("request", req, time.Now())
}
}

23.  Software-defined networks provide a unique
opportunity for effective detection and
containment of network security problems.
 OpenFlow protocol may eventually become
one of the most effective technologies

24.  http://en.wikipedia.org/wiki/OpenFlow
 https://globalconfig.net/software-defined-
networking-vs-traditional/
 http://en.wikipedia.org/wiki/Software-
defined_networking