An ecosystem for anomaly detection and mitigation in software-defined networking

作者：Carvalho Luiz Fernando; Abrao Taufik; Mendes Leonardo de Souza; Proenca Mario Lemes Jr^*

来源：Expert Systems with Applications, 2018, 104: 121-133.

DOI：10.1016/j.eswa.2018.03.027

• Anomaly detection
• Software-defined networking (SDN)
• OpenFlow
• Multinomial logistic regression

Along with the rapid growth of computer networks comes the need for automating management functions to prevent errors in decision-making and reduce the cost of ordinary operations. Software-defined networking (SDN) is an emergent paradigm that aims to support next-generation networks through its flexible and powerful management mechanisms. Although SDN provides greater control over traffic flow, its security and availability remain a challenge. The major contribution of this paper is to present an SDN-based ecosystem that monitors network traffic and proactively detects anomalies which may impair proper network functioning. When an anomalous event is recognized, the proposal conducts a more active analysis to inspect irregularities at the network traffic flow level. Detecting such problems quickly is essential to take appropriate countermeasures. In this manner, the potential for centralized network monitoring based on SDN with OpenFlow is addressed in order to evaluate mitigation policies against threats. Experimental results demonstrate the proposed ecosystem succeeds in achieving higher detection rates compared to other approaches. In addition, the performance analysis shows that our approach can efficiently contribute to the network's resilience.

• 出版日期2018-8-15