Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization最新文献

SHIELD: An Automated Framework for Static Analysis of SDN Applications SHIELD:用于SDN应用静态分析的自动化框架

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876026

Chanhee Lee, Seungwon Shin

{"title":"SHIELD: An Automated Framework for Static Analysis of SDN Applications","authors":"Chanhee Lee, Seungwon Shin","doi":"10.1145/2876019.2876026","DOIUrl":"https://doi.org/10.1145/2876019.2876026","url":null,"abstract":"Software-Defined Network (SDN) is getting popular and increasingly deployed in both of academia and industry. As a result of which, its security issue is being magnified as a critical controversy, and some pioneering researchers have investigated the vulnerabilities of SDN to discover the feasibility of compromising SDN networks. Especially, they prove that a simple malicious/buggy SDN application running on an SDN controller can kill an SDN control plane because it usually has a right to access the resources of SDN controller. To address this issue, we focus on the malicious SDN application themselves (i.e., how to understand if an SDN application is malicious). In this context, we consider analyzing SDN applications before running in a static manner. We present SHIELD, a new automated framework for static analysis of SDN applications carefully considering SDN abilities. SHIELD provides the Control-Flow Graph (CFG) and critical flows of SDN applications. We evaluate the effectiveness of SHIELD with 33 real world applications (both benign and malicious applications), and from the results, we define 10 malicious behaviors of SDN applications.","PeriodicalId":107409,"journal":{"name":"Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127261699","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 22

Taking the Surprise out of Changes to a Bro Setup 从兄弟设置的变化中获得惊喜

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876031

Matthew Monaco, Alex Tsankov, Eric Keller

引用次数: 0

vTC: Machine Learning Based Traffic Classification as a Virtual Network Function 基于机器学习的流量分类作为虚拟网络功能

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876029

Lu He, Chen Xu, Yan Luo

引用次数: 30

The Smaller, the Shrewder: A Simple Malicious Application Can Kill an Entire SDN Environment 越小越精明:一个简单的恶意应用程序可以杀死整个SDN环境

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876024

Seungsoo Lee, Changhoon Yoon, Seungwon Shin

引用次数: 45

Leveraging SDN to Improve the Security of DHCP 利用SDN提高DHCP的安全性

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876028

Jacob H. Cox, R. Clark, H. Owen

{"title":"Leveraging SDN to Improve the Security of DHCP","authors":"Jacob H. Cox, R. Clark, H. Owen","doi":"10.1145/2876019.2876028","DOIUrl":"https://doi.org/10.1145/2876019.2876028","url":null,"abstract":"Current State of the art technologies for detecting and neutralizing rogue DHCP servers are tediously complex and prone to error. Network operators can spend hours (even days) before realizing that a rogue server is affecting their network. Additionally, once network operators suspect that a rogue server is active on their network, even more hours can be spent finding the server's MAC address and preventing it from affecting other clients. Not only are such methods slow to eliminate rogue servers, they are also likely to affect other clients as network operators shutdown services while attempting to locate the server. In this paper, we present Network Flow Guard (NFG), a simple security application that utilizes the software defined networking (SDN) paradigm of programmable networks to detect and disable rogue servers before they are able to affect network clients. Consequently, the key contributions of NFG are its modular approach and its automated detection/prevention of rogue DHCP servers, which is accomplished with little impact to network architecture, protocols, and network operators.","PeriodicalId":107409,"journal":{"name":"Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization","volume":"2013 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125674645","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 16

HoneyMix: Toward SDN-based Intelligent Honeynet HoneyMix:迈向基于sdn的智能蜜网

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876022

Wonkyu Han, Ziming Zhao, Adam Doupé, Gail-Joon Ahn

引用次数: 52

Timing SDN Control Planes to Infer Network Configurations 定时SDN控制平面来推断网络配置

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876030

J. Sonchack, Adam J. Aviv, Eric Keller

引用次数: 26

S-NFV: Securing NFV states by using SGX S-NFV:通过使用SGX保护NFV状态

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876032

Ming-Wei Shih, Mohan Kumar, Taesoo Kim, Ada Gavrilovska

引用次数: 108

HogMap: Using SDNs to Incentivize Collaborative Security Monitoring HogMap:使用sdn激励协同安全监控

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876023

Xiang Pan, V. Yegneswaran, Yan Chen, Phillip A. Porras, Seungwon Shin

{"title":"HogMap: Using SDNs to Incentivize Collaborative Security Monitoring","authors":"Xiang Pan, V. Yegneswaran, Yan Chen, Phillip A. Porras, Seungwon Shin","doi":"10.1145/2876019.2876023","DOIUrl":"https://doi.org/10.1145/2876019.2876023","url":null,"abstract":"Cyber Threat Intelligence (CTI) sharing facilitates a comprehensive understanding of adversary activity and enables enterprise networks to prioritize their cyber defense technologies. To that end, we introduce HogMap, a novel software-defined infrastructure that simplifies and incentivizes collaborative measurement and monitoring of cyber-threat activity. HogMap proposes to transform the cyber-threat monitoring landscape by integrating several novel SDN-enabled capabilities: (i) intelligent in-place filtering of malicious traffic, (ii) dynamic migration of interesting and extraordinary traffic and (iii) a software-defined marketplace where various parties can opportunistically subscribe to and publish cyber-threat intelligence services in a flexible manner. We present the architectural vision and summarize our preliminary experience in developing and operating an SDN-based HoneyGrid, which spans three enterprises and implements several of the enabling capabilities (e.g., traffic filtering, traffic forwarding and connection migration). We find that SDN technologies greatly simplify the design and deployment of such globally distributed and elastic HoneyGrids.","PeriodicalId":107409,"journal":{"name":"Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132920169","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 17

UNISAFE: A Union of Security Actions for Software Switches UNISAFE:软件交换机的安全行动联盟

Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization Pub Date : 2016-03-11 DOI: 10.1145/2876019.2876025

Taejune Park, Yeonkeun Kim, Seungwon Shin

{"title":"UNISAFE: A Union of Security Actions for Software Switches","authors":"Taejune Park, Yeonkeun Kim, Seungwon Shin","doi":"10.1145/2876019.2876025","DOIUrl":"https://doi.org/10.1145/2876019.2876025","url":null,"abstract":"As Software-defined architectures, such as Software-Defined Networking (SDN) and Network Function Virtualization (NFV), are getting popular, the necessity of software-based switch (a.k.a., software switch) is also increasing because it can adopt new functions/features without much difficulty compared with hardware-based switches. Nowadays we can easily observe that researchers devise new network functions and embed them into a software switch. However, most those proposals are highly biased at network communities, and thus it is hard to find some trials of leveraging the abilities of a software switch for security. In this paper, we consider that how we can enrich security functions/features in software-defined environments, and in this context we propose a new software switch architecture - with the name of UNISAFE - that can enable diverse security actions. Furthermore, UNISAFE provides action clustering which joins UNISAFE actions of multiple-flows together. It makes that UNISAFE can check flows synthetically, and thus a user can establish effective security policies and save system resources. In addition, we describe the design and implementation of UNISAFE and suggest some use-cases for how UNISAFE works.","PeriodicalId":107409,"journal":{"name":"Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131356046","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 13