Title
Flowfence: a denial of service defense system for software defined networking
Abstract
Most Denial of Service (DoS) attacks intend to generate a traffic pattern that is indistinguishable from legitimate traffic, making it hard to detect an attack. Conventional defenses for these attacks are not scalable, are slow to react or introduce an overhead to each routed packet. In this paper, we present FlowFence, a lightweight and fast denial of service detection and mitigation system for Software Defined Networking (SDN). The FlowFence architecture includes routers running daemons to monitor the average occupation of their interfaces to detect congestion conditions, and an SDN controller that coordinates bandwidth assignment of controlled links. The controller limits the flow transmission rate along a path to prevent users’ starvation. The mitigation procedure of starvation state allocates an average bandwidth, while flows exceeding the mean are penalized. The penalization is proportional to the difference between the fair limit and the current bandwidth usage. A system prototype was implemented and evaluated in the Future Internet Testbed with Security (FITS). The results show that the proposal avoids users' starvation of network resources without adding much overhead in the network.
Year
DOI
Venue
2015
10.1109/GIIS.2015.7347185
2015 Global Information Infrastructure and Networking Symposium (GIIS)
Keywords
Field
DocType
denial of service defense system,user network resource starvation,FITS,Future Internet Testbed with Security,starvation state mitigation procedure,flow transmission rate,coordinate bandwidth assignment,SDN controller,congestion conditions,routers,FlowFence architecture,denial of service mitigation system,attack detection,traffic pattern,DoS attacks,software defined networking
Denial-of-service attack,Computer science,Computer security,Computer network,Software-defined networking,Network traffic control
Conference
ISSN
Citations 
PageRank 
2150-329X
0
0.34
References 
Authors
9
4