Improving Efficiency in Attack Detection through Real-time Processing Monitoring and Machine Learning

Modern networks can benefit immensely from the flexibility and the improvements in delivery of services that Software Defined Networking (SDN) provides. Creating new services for users can be streamlined through some sort of software component, such as a cloud orchestrator. The network configuration and the resource allocation can happen very efficiently using virtual nodes while isolating customer environments.However, in order to ensure that the virtual nodes are truly isolated and that they are not misbehaving, it is essential to build security guards within the SDN infrastructure. Despite the flexibility and programmability benefits associated with cloud, SDN and Network Function Virtualization environments, these virtual paradigms face many security challenges. Such systems are very complex, which open up more attack vectors than traditional IP networks.In this paper, we propose the design and implementation of an SDN security framework that helps in the detection of failures and malicious activities that target virtual network nodes. The framework we are proposing leverages the network-wide visibility of SDN in order to gather operational characteristics of virtual nodes, feed them into machine learning classifiers and determine unusual behavior or counterfeit nodes with high level of confidence.