基於OpenFlow之協同式雲端網路入侵防禦系統

軟體定義網路（SDN）是一種新興網路架構，它可以用來解決現今網路因高頻寬和多樣性所帶來的問題。在此架構中，控制平面與資料平面分開運作。許多文獻曾探討過怎樣用SDN來解決傳統網路中最為棘手的安全問題，但是鮮有觸及雲端安全威脅，尤其是殭屍網絡和惡意程式的偵測，以及雲端內部的攻擊問題。因此本文提出以SDN為解法的雲端網路入侵防禦系統。本文提出的系統，有賴SDN架構的集中控制，可程式化和虛擬化的性質。系統分為兩個不同的階段，它們之間透過預先定義的應用程式介面（APIs）來溝通。在偵測階段中，偵測程式可以是像Snort那樣的開放原始碼軟體或是本文提出的輕量級掃描過濾程式。控制階段由控制器（控制平面）和OpenFlow交換機（資料平面）構成，根據定義好的應用模組來事先決定flow的插入。殭屍網路及惡意程式阻隔，掃描過濾和蜜罐機制的實作可以確保協同式防禦。惡意流量被阻隔的同時會產生深度事件預警訊息，可以有效移除私有雲端內部感染成肉雞的虛擬機器；因掃描行徑會被盡早阻隔，虛擬機器本身的漏洞難以被攻破；蜜罐機制用來誘捕攻擊者。實驗結果證實了系統的高偵測率，防禦精準度和低弱點性。

關鍵字

雲端運算；軟體定義網路；網路安全；入侵防禦

並列摘要

Software-Defined Networking (SDN) is an emerging architecture that is ideal for the high-bandwidth, dynamic nature of today's network environments. In this architecture, the control and data planes are decoupled. Although much research has been done about how SDN can resolve some of traditional networking's most-glaring security issues, less has touched the cloud security threats, especially the issues of botnet/malware detection and in-cloud attacks. In this thesis, an intrusion prevention system for cloud networking with SDN solutions is proposed. The proposed system benefits from the key attributes of logically centralized intelligence, programmability, and abstraction of SDN architecture. The system consists of two distinct phases that are accessible through pre-defined Application Programming Interfaces (APIs). Within the detection phase, the detector can be whether existing detection software like the open-source Snort IDS or the designed lightweight scan-filtering program. The control phase is composed of the controller (the control plane) and the OpenFlow-based switch (the data plane), which deals with the flow insertion proactively according to the defined application module. In order to achieve collaborative defense, the mechanisms of botnet/malware blocking, scan filtering and honeypot are implemented. Malicious traffic is isolated with in-depth incident reporting information designed to remove bot-infected VMs from the private cloud effectively and efficiently. The scanning behavior can be filtered at very early stage which makes the VMs less exploitable. A honeypot mechanism is also deployed to trap the attackers. Experimental results show the high detection rate, exact prevention accuracy and low vulnerability of the proposed system.

並列關鍵字

Cloud Computing ； SDN ； Network Security ； IPS

參考文獻

[7] Amazon EC2, available at: http://aws.amazon.com/cn/ec2/

[12] S. Shin, P.A. Porras, V. Yegneswaran, M.W. Fong, G. Gu, M. Tyson, "FRESCO: Modular Composable Security Services for Software-Defined Networks," in Proceedings of the ISOC Network and Distributed System Security Symposium, San Diego, CA, February 2013.

[15] Giotis, K., et al. "Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments." Computer Networks 62(0): 122-136, 2014.

[17] D. Huang, L. Xu, C. Chung T. Xing, "SnortFlow: A openflow-based Intrusion Prevention System in Cloud Environment," Second GENI Research and Educational Experiment Workshop, pp. 89-92, 2013.

[20] Floodlight. Available: http://www.projectfloodlight.org/

國際替代計量

基於OpenFlow之協同式雲端網路入侵防禦系統

全文下載

主題瀏覽