S-Pot: A Smart Honeypot Framework with Dynamic Rule Configuration for SDN

Enterprise networks are becoming increasingly heterogeneous where enterprise devices and IoT devices coexist, requiring tools for effective management and security. Software Defined Networking (SDN) has emerged in response to such needs of modern networks. SDN lacks adequate security features and Intrusion Detection and Protection Systems (IDPS) have been used to protect SDN from attacks. However, they have limited knowledge of zero day attacks. Machine Learning (ML) has become a valuable tool against these limitations and improve (SDN) network security. However, the solutions that solely rely on ML can struggle to discriminate benign traffic from malicious, and suffer from false negatives. To solve these problems and improve security of SDN-based enterprise networks, we propose S-Pot, an open-source smart honeypot framework. S-Pot uses enterprise and IoT honeypots to attract attackers, learns from attacks via ML classifiers, and dynamically configures the rules of SDN. Since honeypots generally receive only malicious traffic, S-Pot can learn from the received malicious traffic and minimize the false positives of an SDN network. In addition, S-Pot can detect the new attacks using ML classifiers, thus can help to minimize the false negatives. Our performance evaluation of S-Pot in detecting attacks using various ML classifiers show that it can detect attacks with 97% accuracy using J48 algorithm. In addition, we evaluated the effectiveness of S-Pot in improving the security of an enterprise SDN testbed network. Our results demonstrate that, compared to the without S-Pot case, S-Pot can improve the security of the SDN networks by detecting attacks with better performance, greater accuracy, effectively generating rules, and dynamically configuring the network.