Defending denial-of-service attacks in SDNFV-enabled cloud computing = SDNFV 기반의 클라우드 컴퓨팅에서 서비스거부공격 방어에 관한 연구

다국어 초록 (Multilingual Abstract)

In my thesis, I propose a novel S2eH scheme to tackle Denial-of-Service (DoS) attacks in the Software-Defined Network Functions Virtualization (SDNFV) cloud computing environment. I firstly introduce a new machine learning hybrid model for DoS attack classification based on Support Vector Machine (SVM) and Self Organizing Map (SOM) algorithms to enhance the performance of classification network traffic. The proposed combination mainly focuses on taking advantages of two classification algorithms by utilizing both algorithm advantages that SVM takes a little time to produce outputs with a high accuracy and SOM makes a reliable prediction based on their neurons. Then, I propose an enhanced History-based IP Filtering scheme (eHIPF) to improve attack detection rate and speed. Finally, I propose a novel mechanism combining both the machine learning hybrid model SVMs-SOM and the eHIPF scheme, called S2eH, to make a DoS attack defender in the SDNFV-enabled cloud computing. The S2eH testbed is implemented in the SDNFV cloud environment with Service Function Chaining. Through practical experiments in this testbed, it is proved that the proposed SVMs-SOM combination and eHIPF scheme outperforms existing mechanisms for DoS attack classification and detection. By analyzing comprehensive experiments conducted with various DoS attack levels, I prove that the novel S2eH mechanism is an effective and innovative approach to defend DoS attacks in the SDNFV-based cloud computing.

국문 초록 (Abstract)

본 논문에서는 Software-Defined Network Functions Virtualization (SDNFV) Cloud computing 환경에서 서비스 거부 공격을 저지하는 새로운 S2eH 스키마를 제안한다. 먼저, DoS 공격 분류를 위해 Network 분류 성능을 높이는 Support Vector Machine (SVM) 과 Self-Organizing Map(SOM) 알고리즘 기반 새로운 Hybrid Machine Learning을 소개한다. 제안된 결합 시스템은 주로 두 가지 분류 알고리즘의 이점을 가져오는데 초점을 둔다. SVM은 짧은 시간에 높은 정확도로 분류를 하고, SOM은 SOM의 신경망기반으로 신뢰성이 높은 예측을 한다. 또한, 공격 탐지 비율과 속도를 개선하기 위해 History 기반 IP Filtering 스키마(eHIPF)를 제안한다. 본 논문에서는 SDNFV가 가능한 Cloud Computing 에서 DoS공격을 방어하기 위해 SVMs-SOM을 결합한 Hybrid Machine Learning 모델과 eHIPF 스키마를 결합한 새로운 메커니즘 S2eH을 제안한다. S2eH testbed는 Service Function Chaining이 가능한 SDNFV Cloud 환경에서 실험했다. 이 testbed에서 실제 실험을 통해 본 논문에서 제안된 SVMs-SOM 결합과 eHIPF 스키마가 DoS공격 분류와 탐지에 다른 메커니즘보다 좋은 결과 가져오는 것을 증명했다. 다양한 DoS공격 레벨로 수행 된 포괄적인 실험을 분석하여 새로운 S2eH메커니즘이 SDNFV기반 Cloud computing에서 DoS 공격을 방어하기 위한 효과적이고 혁신적인 방법임을 증명했다.

목차 (Table of Contents)

• ABSTRACT IN ENGLISH vi
• ABSTRACT IN KOREAN ⅴiii
• CHAPTER 1 Introduction 1
• 1.1 SDNFV Cloud Computing 1
• 1.2 Research Motivation 1
• 1.3 Research Proposal and Contributions 4
• 1.3.1 Research Proposal 4
• 1.3.2 Contributions 5
• 1.4 Thesis Organization 5
• CHAPTER 2 Background Knowledge 6
• 2.1 A Novel Machine Learning Hybrid Model 6
• 2.2 Emerging Cloud Computing Technology 8
• 2.2.1 Software Defined Networking 8
• 2.2.2 Network Functions Virtualization 10
• 2.2.3 SDNFV-enabled Cloud Computing 13
• 2.3 Denial-of-Service attacks in SDNFV-enabled Cloud Computing 13
• CHAPTER 3 Proposed System Analysis and Design 16
• 3.1 System Analysis 16
• 3.2 Proposed System Design 19
• 3.2.1 Raw Data Processing 21
• 3.2.2 Machine Learning Training 22
• 3.2.3 Machine Learning Classification 22
• 3.2.4 System Process Logic 23
• 3.3 Enhanced History-based IP Filtering scheme and Policy Conductor 25
• 3.3.1 Enhanced History-based IP Filtering Database 25
• 3.3.2 Enhanced History-based IP Filtering Scheme (eHIPF) 30
• 3.3.3 Policy Conductor 35
• CHAPTER 4 Experiments 37
• 4.1 eHIPF Scheme Experiment 37
• 4.2 SDNFV-enabled Cloud Implementation 38
• 4.3 S2eH Testing Preparation 39
• 4.4 S2eH Testing Conduction 41
• CHAPTER 5 Performance Evaluation 42
• 5.1 eHIPF Enhancement Comparison 42
• 5.2 S2eH Detection Rate, Accuracy and FAR Enhancements 43
• 5.3 OpenFlow Switch Resource Consumption 45
• 5.3.1 Flow-Entry Occupation 45
• 5.3.2 OpenFlow Switch's CPU Utilization 46
• 5.4 SDN Controller (OpenDaylight) 47
• 5.4.1 SDN Controller's CPU Utilization 47
• 5.4.2 Packet-in Rate and Bandwidth Occupation in Secure Channel 49
• 5.5 Security VNF (Snort) 51
• 5.5.1 Snort's Workload 51
• 5.5.2 Overloaded Time Estimation 52
• 5.6 SFC Quality of Service 53
• 5.6.1 Legitimate Request Delay 53
• 5.6.2 Legal User’s Packet Loss Rate 54
• CHAPTER 6 Related Work and Conclusion 56
• 6.1 Related Work 56
• 6.2 Conclusion 57
• REFERENCES 58