Ali, A. F. T., Cziva, R., Jouet, S. and Pezaros, D. (2017) SDNFV-based DDoS detection and remediation in multi-tenant, virtualized infrastructures. In: Zhu, S., Scott-Hayward, S., Jacquin, L. and Hill, R. (eds.) Guide to Security in SDN and NFV: Challenges, Opportunities, and Applications. Series: Computer communications and networks. Springer: Cham, pp. 171-1896. ISBN 9783319646527 (doi: 10.1007/978-3-319-64653-4_7)
Full text not currently available from Enlighten.
Abstract
As ICT resources are increasingly hosted over Cloud Data Center infrastructures, Distributed Denial of Service (DDoS) attacks are becoming a major concern for Cloud service providers and tenants. The lack of physical resource isolation over a Cloud environment exposes non-targeted tenants to indirect performance degradation while it is increasingly challenging to distinguish between safe (e.g., internal, DMZ) and external zones. Traditional DDoS detection and prevention systems employ high-performance and high-cost bespoke appliances (middleboxes) in fixed locations of the physical infrastructure. However, this limits their provisioning abilities to a static specification, hindering extensible functionality and resulting in vendor lock-in. In this chapter, we propose a softwarised orchestration framework for DDoS detection and mitigation in the cloud. We exploit latest advances in Network Function Virtualization (NFV) to devise a modular security framework through the dynamic deployment of lightweight network functions where and when required to protect the infrastructure at the onset of DDoS attacks. We rely on the networkwide, logically-centralised management of traffic and network services provided by Software-Defined Networking (SDN) for the placement of NFs and to (re-)route traffic to them. Using an example of a DDoS remediation service, we demonstrate the benefits of an extensible and reconfigurable DDoS security system that uses dynamic security module duplication and placement to remediate the performance impact of the attack on the underlying infrastructure.
| Item Type: | Book Sections |
|---|---|
| Status: | Published |
| Glasgow Author(s) Enlighten ID: | JOUET, SIMON and Pezaros, Professor Dimitrios and Cziva, Mr Richard and Ali, Abeer Farouk Tawfeek |
| Authors: | Ali, A. F. T., Cziva, R., Jouet, S., and Pezaros, D. |
| College/School: | College of Science and Engineering > School of Computing Science |
| Publisher: | Springer |
| ISBN: | 9783319646527 |
| Published Online: | 12 November 2017 |
University Staff: Request a correction | Enlighten Editors: Update this record
Funder and Project Information
Funder and Project Information