Secure control plane for SDN using Bayesian Stackelberg games

Zhen-ping LU; Fu-cai CHEN; Guo-zhen CHENG

doi:10.11959/j.issn.2096-109x.2017.00211

您当前的位置：

首页 >

文章列表页 >

Secure control plane for SDN using Bayesian Stackelberg games

Academic paper | 更新时间：2024-06-03

- Secure control plane for SDN using Bayesian Stackelberg games
- Journal of network and information security Vol. 3, Issue 11, Pages: 40-49(2017)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00211
  CLC： TP309
- Online First：2017-11，
  
  Published：15 November 2017
- 稿件说明：
移动端阅览
Zhen-ping LU, Fu-cai CHEN, Guo-zhen CHENG. Secure control plane for SDN using Bayesian Stackelberg games[J]. Journal of network and information security, 2017, 3(11): 40-49.
DOI：

Zhen-ping LU, Fu-cai CHEN, Guo-zhen CHENG. Secure control plane for SDN using Bayesian Stackelberg games[J]. Journal of network and information security, 2017, 3(11): 40-49. DOI： 10.11959/j.issn.2096-109x.2017.00211.

摘要

提出一种基于动态异构冗余的安全控制平面，通过动态地变换异构的控制器以增加攻击者的难度。首先，提出基于贝叶斯−斯坦科尔伯格博弈模型的控制器动态调度方法，将攻击者和防御者作为博弈参与双方，求得均衡解，进而指导调度策略；其次，引入一种自清洗机制，与博弈策略结合形成闭环的防御机制，进一步地提高了控制层的安全增益；最后，实验定量地描述了基于该博弈策略的安全控制层相比与传统部署单个控制器以及采用随机策略调度控制器的收益增益，并且自清洗机制能够使控制平面一直处于较高的安全水平。

Abstract

A dynamic scheduling controller in SDN control layer was proposed by dynamically transform heteroge-neous controlled in order to increase the difficulty of the attacker.Firstly

a dynamic scheduling method based on Bayesian Stackelberg games the attacker and defender were game participation on both sides

obtained the equili-brium

which guided the scheduling strategy.Secondly

introducing a self-cleaning mechanism

it improved the gain of the control layer security combined with game strategy form closed-loop defense mechanism.The experiments described quantitatively based on the game strategy compared with traditional safety control layer to deploy a single controller and adopt the strategy of random scheduling profit gain of the controller

and self-cleaning mechanism could make the control plane to be in a higher level of security.

关键词

Keywords

references

KREUTZ D , RAMOS F M V , VERISSIMO P . Towards secure and dependable software-defined networks [C ] // ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking . 2013 : 55 - 60 .

SHIN S , SONG Y , LEE T , et al . Rosemary:a robust,secure,and high-performance network operating system [C ] // ACM Conference on Computer and Communications Security . 2014 : 78 - 89 .

LENG J , ZHOU Y , ZHANG J , et al . An inference attack model for flow table capacity and usage:exploiting the vulnerability of flow table overflow in software-defined network [J ] . Water Air ＆ Soil Pollution , 2015 , 85 ( 3 ): 1413 - 1418 .

SONCHACK J , AVIV A J , KELLER E . Timing SDN control planes to infer network configurations [C ] // ACM International Workshop on Security in Software Defined Networks ＆ Network Function Virtualization . 2016 .

LEE S , YOON C , SHIN S . The smaller,the shrewder:a simple malicious application can kill an entire SDN environment [C ] // ACM International Workshop on Security in Software Defined Networks＆ Network Function Virtualization . 2016 .

MORZHOV S , ALEKSEEV I , NIKITINSKIY M . Firewall applica-tion for Floodlight SDN controller [C ] // The International Siberian Conference on Control and Communications . 2016 .

SHIN S , SNOS Y , LEE T , et al . Rosemary:a robust,secure,and high-performance network operating system [J ] . 2014 : 78 - 89 .

TOOTOONCHIAN A , GANJALI Y . HyperFlow:a distributed control plane for OpenFlow [C ] // Internet Network Management Conference on Research on Enterprise Networking . 2010 : 3 .

SHERWOOD R , GIBB G , YAP K K , et al . FlowVisor:a network virtualization layer [J ] . 2009 .

YEGANEH S H , GANJALI Y . Kandoo:a framework for efficient and scalable offloading of control applications [C ] // The Workshop on Hot Topics in Software Defined Networks . 2012 : 19 - 24 .

KOPONEN T , CASADO M , GUDE N , et al . Onix:a distributed control platform for large-scale production networks [C ] // Usenix Symposium on Operating Systems Design and Implementa-tion(OSDI 2010) . 2010 : 351 - 364 .

DIXIT A , FANG H , MUKHERJEE S , et al . Towards an elastic distributed SDN controller [C ] // The 1st Workshop on Hot Topics in Software Defined Networking (HotSDN 2013) . 2013 : 7 - 12 .

BERDE P , GEROLA M ,and HART J , et al . ONOS:towards an open,distributed SDN OS [C ] // The Workshop on Hot Topics in Software Defined Networking . 2014 : 1 - 6 .

LI H , LI P , GUO S , et al . Byzantine-resilient secure software-defined networks with multiple controllers in cloud [C ] // 2014 IEEE International Conference on Communications (ICC 2014) . 2014 : 695 - 700 .

ELDEFRAWY K , KACZMAREK T . Byzantine fault tolerant soft-ware-defined networking (SDN) controllers [C ] // IEEE Computer Society International Conference on Computers,Software ＆ Ap-plications . 2016 : 208 - 213 .

LEE C , SHIN S . SHIELD:an automated framework for static analysis of SDN applications [C ] // ACM International Workshop on Security in Software Defined Networks ＆ Network Function Virtu-alization . 2016 : 29 - 34 .

WILCZEWSKI . Security considerations for equipment controllers and SDN [C ] // 2016 IEEE International Telecommunications Energy Conference (INTELEC) . 2016 : 1 - 5 .

AHMAD I , NAMAL S , YLIANTTILA M , et al . Security in soft-ware defined networks:a survey [J ] . IEEE Communications Sur-veys ＆ Tutorials , 2015 , 17 ( 4 ): 1 .

PORRAS P , SHIN S , YEGNESWARAN V , et al . A security en-forcement kernel for OpenFlow networks [C ] // The First Workshop on Hot Topics in Software Defined Networks . 2012 : 121 - 126 .

SONCHACK J , AVIV A J , KELLER E , et al . Enabling practical software-defined networking security applications with OFX [C ] // Network and Distributed System Security Symposium . 2016 .

MEDVED J , VARGA R , TKACIK A , et al . OpenDaylight:towards a model-driven SDN controller architecture [C ] // IEEE International Symposium on World of Wireless,Mobile and Multimedia Net-works . 2014 : 1 - 6 .

WANG T , LIU F , GUO J , et al . Dynamic SDN controller assign-ment in data center networks:Stable matching with transfers [C ] // IEEE Conference on Computer Communications . 2016 : 1 - 9 .

LU Z P , CHEN F C , et al . Poster:a secure control plane with dynamic multi-NOS for SDN [C ] // NDSS Posters . 2017 .

LEE S , YOON C . DELTA:a security assessment framework for software-defined networks [C ] // Network and Distributed System Security Symposium . 2017 .

KIEKINTVELD C , MARECKI J , TAMBE M . Approximation methods for infinite bayesian stackelberg games:Modeling distri-butional payoff uncertainty [C ] // The 10th International Conference on Autonomous Agents and Multiagent Systems . 2011 : 1005 - 1012 .

PARUCHURI P , PEARCE J P . Playing games for security:an efficient exact algorithm for solving bayesian stackelberg games [C ] // The 7th International Joint Conference on Autonomous Agents and Multiagent Systems (AAMAS'08) . 2008 : 985 - 902 .

DAVID Jorm . 44CON LONDON 2015 Presentations [EB/OL ] . https://44con.com/44con-london-2015/44con-london-2015-presentations/ https://44con.com/44con-london-2015/44con-london-2015-presentations/ .

PITA J , JAIN M , TAMBE M , et al . Robust solutions to stackelberg games:addressing bounded rationality and limited observations in human cognition [J ] . Artificial Intelligence , 2010 , 174 ( 15 ): 1142 - 1171 .

Views

2318

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Game model based security strategy of heterogeneous controllers in the cloud

Design and implementation of the controller scheduling-time in SDN

Security scheme for time-critical TRDP message

Secure multidimensional interconnection network for the software defined system on wafer

Overview on industrial Internet honeynet technology

Related Author

Juntai HU

Zhenyu WU

Xiao FU

Yichao WANG

Guozhen CHENG

Fucai CHEN

Zhenping LU

LU Xiang

Related Institution

School of Cyber Security, University of CAS

Institute of Information Engineering, CAS

CRRC Qingdao Sifang Co., Ltd.

Information Engineering University

Engineering Research Center of Smart Energy, Civil Aviation Administration of China

⁰