DaMask: Cloud DDoS Defense Mechanism Using Software Defined Networking

Size: px

Start display at page:

Download "DaMask: Cloud DDoS Defense Mechanism Using Software Defined Networking"

Silvester Barber
9 years ago
Views:

1 Using Software Defined Networking Mortada Aman Department of Electrical & Computer Engineering Missouri University of Science and Technology 24 March 2016 rev Mortada Aman

Missouri University of Science and Technology

2 Using Software Defined Networking Introduction Model Design Evaluation Conclusion 24 March 2016 Outline 2

3 Using Software Defined Networking Introduction Model Design Evaluation Conclusion 24 March 2016 Outline 3

4 Introduction Cloud Computing: provides remote data storage and computation for low cost Software Defined Networking (SDN): High-level network management The two can be combined to increase the security of Cloud Computing and defend against Distributed Denial of Service (DDoS) attacks 24 March 2016 Cloud Computing and SDN 4

two can be combined to increase the security of Cloud Computing and defend

5 Introduction Existing DDoS defense mechanism assume that the networks are fully controlled by the admins DaMask does not make this assumption since that it is not the case in most networks DaMask is a DDoS attack mitigation architecture using software-defined networking 24 March 2016 DaMask 5

that it is not the case in most networks DaMask is a DDoS attack

6 Using Software Defined Networking Introduction Model Design Evaluation Conclusion 24 March 2016 Outline 6

7 Model Design This paper aims to achieve the following: Enhance the security and DDoS defense by combining cloud computing with SDN Propose a highly scalable and flexible DDoS attack mitigation architecture: DaMask Introduce a model update phase to detect new complex attacks (DaMask-D) Implement the structure and evaluate it using simulation on Amazon EC2 clouds 24 March 2016 Goals 7

architecture: DaMask Introduce a model update phase to detect new complex attacks (DaMask-D)

8 Model Design DaMask analyzes the effectiveness of the defense mechanism on hybrid clouds Cloud computing properties: Cloud providers control the network Resource allocation and virtualization can be used to change the network topology All users share the same network infrastructure Cloud Computing Challenges: Public accessibility Dynamic network allocation 24 March 2016 Cloud Computing Properties 8

be used to change the network topology All users share the same network infrastructure Cloud

9 Model Design 24 March 2016 Cloud Structure 9

10 Model Design SDN separates the control plane from the data plane and allows the network control (application) to take over the control plane SDN important properties: Centralized network control Simplified packet forward Software based network function implementation Virtualized networks 24 March 2016 SDN 10

important properties: Centralized network control Simplified packet forward

11 Model Design Model design s requirements: Effective: Virtualization and slicing Small overhead: reduce communication overhead while speeding up detection Inexpensive: fast re-configuration scheme to avoid disruption DaMask consists of two modules: DaMask-D: Anamoly-based detection system DaMask-M: Attack reaction system 24 March 2016 Architecture 11

re-configuration scheme to avoid disruption DaMask consists of two modules: DaMask-D:

12 Model Design 24 March 2016 Workflow 12

13 Using Software Defined Networking Introduction Model Design Evaluation Conclusion 24 March 2016 Outline 13

14 Setup 24 March 2016 Cloud Topology 14

15 Using Software Defined Networking Overhead Computation Cost: 3 aspects: Offline training process Online testing process Model updating process: local and global Local update is cheaper than global Communication: only related to round trip time between clouds (constant overhead) Overall relatively small Topology change: DaMask can adapt to topology changes caused by virtualization 24 March 2016 Evaluation 15

Communication: only related to round trip time between clouds (constant overhead) Overall relatively

16 Using Software Defined Networking 24 March 2016 Communication Overhead 16

17 Using Software Defined Networking Detection Data shift Solution: three kinds of updates are introduced: basic, local, and global Accuracy: Table 2 for basic, local, and global 24 March 2016 Detection Accuracy 17

introduced: basic, local, and global Accuracy: Table

18 Using Software Defined Networking Introduction Model Design Evaluation Conclusion 24 March 2016 Outline 18

19 Using Software Defined Networking DaMask is a defense mechanism that utilizes SDN to protect a hybrid cloud from DDoS attacks It updates automatically to adapt to new attacks It introduces three kinds of updates depending on need Adapts to topology change Relatively low overhead High detection rate 24 March 2016 Conclusion 19

new attacks It introduces three kinds of updates depending on need Adapts to

20 Using Software Defined Networking Good paper overall They did not explain some of the features clearly (such as basic, local, and global updates) In general, the scheme seems promising 24 March 2016 Thoughts 20

(such as basic, local, and global updates) In

21 References and Further Reading [WZL+2015] Bing Wang, Yao Zheng, Wenjing Lou, and Y. Thomas Hou, DDoS attack protection in the era of cloud computing and Software-Defined Networking, Computer Networks, Volume 81, pp , April March 2016 References 21

22 End of Foils 24 March 2016 End 22

DDoS Attack Protection in the Era of Cloud Computing and Software-Defined Networking

DDoS Attack Protection in the Era of Cloud Computing and Software-Defined Networking Bing Wang Yao Zheng Wenjing Lou Y. Thomas Hou Virginia Polytechnic Institute and State University, Blacksburg, VA, USA