Toward Secure Software-Defined Networks Using Machine Learning: A Review, Research Challenges, and Future Directions

Over the past few years,rapid advancements in the internet and communication technologies have led to increasingly intricate and diverse networking systems.As a result,greater intelligence is necessary to effectively manage,optimize,and maintain these systems.Due to their distributed nature,machine learning models are challenging to deploy in traditional networks.However,Software-Defined Networking(SDN)presents an opportunity to integrate intelligence into networks by offering a programmable architecture that separates data and control planes.SDN provides a centralized network view and allows for dynamic updates of flow rules and softwarebased traffic analysis.While the programmable nature of SDN makes it easier to deploy machine learning techniques,the centralized control logic also makes it vulnerable to cyberattacks.To address these issues,recent research has focused on developing powerful machine-learning methods for detecting and mitigating attacks in SDN environments.This paper highlighted the countermeasures for cyberattacks on SDN and how current machine learningbased solutions can overcome these emerging issues.We also discuss the pros and cons of using machine learning algorithms for detecting and mitigating these attacks.Finally,we highlighted research issues,gaps,and challenges in developing machine learning-based solutions to secure the SDN controller,to help the research and network community to develop more robust and reliable solutions.

A Survey: Typical Security Issues of Software-Defined Networking

Software-Defined Networking (SDN) has been a hot topic for future network development, which implements the different layers of control plane and data plane respectively. Despite providing high openness and programmability, the “three-layer two-interface” architecture of SDN changes the traditional network and increases the network attack nodes, which results in new security issues. In this paper, we firstly introduced the background, architecture and working process of SDN. Secondly, we summarized and analyzed the typical security issues from north to south: application layer, northbound interface, control layer, southbound interface and data layer. Another contribution is to review and analyze the existing solutions and latest research progress of each layer, mainly including: authorized authentication module, application isolation, DoS/DDoS defense, multi-controller deployment and flow rule consistency detection. Finally, a conclusion about the future works of SDN security and an idealized global security architecture is proposed.

Multi-Attack Intrusion Detection System for Software-Defined Internet of Things Network

Currently,the Internet of Things(IoT)is revolutionizing communi-cation technology by facilitating the sharing of information between different physical devices connected to a network.To improve control,customization,flexibility,and reduce network maintenance costs,a new Software-Defined Network(SDN)technology must be used in this infrastructure.Despite the various advantages of combining SDN and IoT,this environment is more vulnerable to various attacks due to the centralization of control.Most methods to ensure IoT security are designed to detect Distributed Denial-of-Service(DDoS)attacks,but they often lack mechanisms to mitigate their severity.This paper proposes a Multi-Attack Intrusion Detection System(MAIDS)for Software-Defined IoT Networks(SDN-IoT).The proposed scheme uses two machine-learning algorithms to improve detection efficiency and provide a mechanism to prevent false alarms.First,a comparative analysis of the most commonly used machine-learning algorithms to secure the SDN was performed on two datasets:the Network Security Laboratory Knowledge Discovery in Databases(NSL-KDD)and the Canadian Institute for Cyberse-curity Intrusion Detection Systems(CICIDS2017),to select the most suitable algorithms for the proposed scheme and for securing SDN-IoT systems.The algorithms evaluated include Extreme Gradient Boosting(XGBoost),K-Nearest Neighbor(KNN),Random Forest(RF),Support Vector Machine(SVM),and Logistic Regression(LR).Second,an algorithm for selecting the best dataset for machine learning in Intrusion Detection Systems(IDS)was developed to enable effective comparison between the datasets used in the development of the security scheme.The results showed that XGBoost and RF are the best algorithms to ensure the security of SDN-IoT and to be applied in the proposed security system,with average accuracies of 99.88%and 99.89%,respectively.Furthermore,the proposed security scheme reduced the false alarm rate by 33.23%,which is a significant improvement over prevalent schemes.Finally,tests of the algorithm for dataset selection showed that the rates of false positives and false negatives were reduced when the XGBoost and RF algorithms were trained on the CICIDS2017 dataset,making it the best for IDS compared to the NSL-KDD dataset.

Information security through controlled quantum teleportation networks

Information security is the backbone of current intelligent systems,such as the Internet of Things(IoT),smart grids,and Machine-to-Machine(M2M)communication.The increasing threat of information security requires new models to ensure the safe transmission of information through such systems.Recently,quantum systems have drawn much attention since they are expected to have a significant impact on the research in information security.This paper proposes a quantum teleportation scheme based on controlled multi-users to ensure the secure information transmission among users.Quantum teleportation is an original key element in a variety of quantum information tasks as well as quantum-based technologies,which plays a pivotal role in the current progress of quantum computing and communication.In the proposed scheme,the sender transmits the information to the receiver under the control of a third user or controller.Here,we show that the efficiency of the proposed scheme depends on the properties of the transmission channel and the honesty of the controller.Compared with various teleportation scheme presented recently in the literature,the most important difference in the proposed scheme is the possibility of suspicion about the honesty of the controller and,consequently,taking proper precautions.

Economical quantum secure direct communication network with single photons

In this paper a scheme for quantum secure direct communication （QSDC） network is proposed with a sequence of polarized single photons. The single photons are prepared originally in the same state （0） by the servers on the network, which will reduce the difficulty for the legitimate users to check eavesdropping largely. The users code the information on the single photons with two unitary operations which do not change their measuring bases. Some decoy photons, which are produced by operating the sample photons with a Hadamard, are used for preventing a potentially dishonest server from eavesdropping the quantum lines freely. This scheme is an economical one as it is the easiest way for QSDC network communication securely.

A backdoor attack against quantum neural networks with limited information

Backdoor attacks are emerging security threats to deep neural networks.In these attacks,adversaries manipulate the network by constructing training samples embedded with backdoor triggers.The backdoored model performs as expected on clean test samples but consistently misclassifies samples containing the backdoor trigger as a specific target label.While quantum neural networks(QNNs)have shown promise in surpassing their classical counterparts in certain machine learning tasks,they are also susceptible to backdoor attacks.However,current attacks on QNNs are constrained by the adversary's understanding of the model structure and specific encoding methods.Given the diversity of encoding methods and model structures in QNNs,the effectiveness of such backdoor attacks remains uncertain.In this paper,we propose an algorithm that leverages dataset-based optimization to initiate backdoor attacks.A malicious adversary can embed backdoor triggers into a QNN model by poisoning only a small portion of the data.The victim QNN maintains high accuracy on clean test samples without the trigger but outputs the target label set by the adversary when predicting samples with the trigger.Furthermore,our proposed attack cannot be easily resisted by existing backdoor detection methods.

Bidirectional Quantum Secure Direct Communication Network Protocol with Hyperentanglement

We propose a bidirectional quantum secure direct communication(QSDC) network protocol with the hyperentanglment in both the spatial-mode ad the polarization degrees of freedom of photon pairs which can in principle be produced with a beta barium borate crystal.The secret message can be encoded on the photon pairs with unitary operations in these two degrees of freedom independently.Compared with other QSDC network protocols,our QSDC network protocol has a higher capacity as each photon pair can carry 4 bits of information.Also,we discuss the security of our QSDC network protocol and its feasibility with current techniques.

OTP-Based Software-Defined Cloud Architecture for Secure Dynamic Routing

In the current era,anyone can freely access the Internet thanks to the development of information and communication technology.The cloud is attracting attention due to its ability to meet continuous user demands for resources.Additionally,Cloud is effective for systems with large data flow such as the Internet of Things(IoT)systems and Smart Cities.Nonetheless,the use of traditional networking technology in the cloud causes network traffic overload and network security problems.Therefore,the cloud requires efficient networking technology to solve the existing challenges.In this paper,we propose one-time password-based software-defined cloud architecture for secure dynamic routing to mitigating the above-mention issues.The proposed cloud architecture provides a secure data path through dynamic routing using One-Time Internet Protocol(OTIP)algorithm between each layer.On the network side,we use software-defined technology to provide efficient network management and data security.We introduce a software-defined cloud architecture that applies OTIP algorithms for secure dynamic routing.We conduct a comparative analysis between general IP communication and proposed OTIP communication architecture.It evaluates the performance of OTIP algorithms.Finally,we examine the proposed software-defined cloud architecture,including how to apply OTIP in secure dynamic routing according to the results of the comparative analysis.

美国量子网络技术研究进展及军事应用展望

详细综述美国量子网络的主要发展历程和国家战略蓝图,总结美国军方量子网络资助情况和研究现状,以及量子网络相关的军事应用构想,对量子网络的发展趋势进行展望。量子通信是一种利用量子叠加和量子纠缠等量子特性,以量子态为载体进行信息传输的新型通信技术。量子网络以量子通信技术为基础,在军事信息安全通信和协同作战等方面具有重要的潜在应用价值。随着美国量子网络技术的发展,以对微观体系量子特性主动精确操纵技术为核心的“第二次量子革命”正在重塑战争形态和作战样式。

基于BB84协议的量子保密通信在城市轨道交通的应用分析

[目的]城市轨道交通关键信息系统通常采用经典密码学算法进行数据加密。量子信息学的发展对经典密码学的信息安全性造成了极大的威胁,因此有必要对量子保密通信在城市轨道交通场景下的应用进行研究。[方法]介绍了量子保密通信的基本原理及基于BB84协议的量子密钥分发原理。基于BB84协议的密钥分发流程,构建了基于城市轨道交通的量子保密通信的基本结构,对有无监听2种情况下密钥的生成过程进行了举例说明。提出了2种适用于城市轨道交通量子保密通信的组网方案,并分析在城市轨道交通场景下量子保密通信应用中需要注意的问题。[结果及结论]基于BB84协议的量子保密通信体系适用于城市轨道交通关键信息系统的数据加密。该技术应用于城市轨道交通时,选择分散加密还是集中加密方式,应结合被加密系统的数据流量及流向予以确定。需重点关注量子保密通信系统的成码率、设备可靠性、鲁棒性。

2023年网络安全热点技术领域全景扫描

网络安全离不开防火墙、通信加密和身份识别等技术的支撑,而网络安全技术的每一次迭代升级,都可能因技术优势易手而引起全球网络格局的重新洗牌。正因如此,近年来各国都在积极开发和运用与网络安全有关的新兴技术,以利用先进的网络技术来为军事、经济和舆论等领域的竞争提供助力。对此,分别阐述了人工智能、零信任、云环境、太空网络和量子信息技术这5个网络安全热点技术领域在2023年的发展态势,并分析研判了新兴技术在网络安全应用领域的未来趋势。

基于改进Markov算法的电力线载波通信网络安全态势感知仿真研究

针对电力线载波通信网络安全态势感知单位运算时间较长且误差较大等问题,基于改进Markov算法研究一种新型通信网络安全态势感知方法。采用分区采集与降维运算数据预处理,去除电力线载波信号干扰因素。利用隶属关联矩阵挖掘网络安全要素特征,构建层次化Markov网络安全态势感知模型。利用BW算法寻找目标参数最优解,来确定感知目标点位置,缩短挖掘时间,提高感知精准度。经过试验验证,所提方法单位感知时间只有60~90 ms,多组并行感知均方误差不超过2%,表明所提方法能够满足电力线载波通信网络安全态势感知应用需求。

迈向量子安全:后量子密码迁移研究与思考

量子科技的飞速发展使得大规模量子计算机的实现只是时间问题,一些量子算法的提出(如Shor、Grover、Simon)使得对现代密码体制(公钥密码和对称密码)实施量子计算攻击成为可能,从而严重威胁经典密码的安全。为提升密码系统抵抗量子计算攻击的能力,以格密码为代表的后量子密码(PQC)算法得到广泛关注和研究。从经典密码算法到PQC的迁移是密码系统实现量子安全的有效路径。首先,该文调研了NIST,ETSI及其他组织和学者提出的PQC迁移路线,总结起来,就是以NIST为代表的替换方案、以ETSI为代表的二次加密方案以及其他混合加密方案三种迁移路线;其次,针对PQC迁移过程,从迁移目标、迁移准备、迁移实施三个环节介绍了迁移策略;此外,为了促进PQC迁移的顺利高效实施,提出了需要考虑的迁移评估要素,包括资源投入、时间成本、业务风险、维护成本、用户体验、商业影响六个方面;最后,提出PQC迁移下一步研究方向。总之,文中工作将为PQC迁移的方案设计和高效实施提供有益参考。

工控网络安全新兴理念及发展态势分析

随着数字技术的泛在化和网络攻击的与日俱增,加之AI和量子计算等颠覆性技术开始应用,常规网络安全防护理念及技术已不能满足新形势下关键基础设施工控网络安全的需求。本文描述了九位一体安全深度防护、设计安全、默认安全等新兴安全理念的概念、模型结构、特性及应用,并简要分析了边缘计算、AI、量子计算、分布式账簿、去中心化网络安全管理等新兴技术方面的发展态势。

Preserving Privacy of Software-Defined Networking Policies by Secure Multi-Party Computation

In software-defined networking(SDN),controllers are sinks of information such as network topology collected from switches.Organizations often like to protect their internal network topology and keep their network policies private.We borrow techniques from secure multi-party computation(SMC)to preserve the privacy of policies of SDN controllers about status of routers.On the other hand,the number of controllers is one of the most important concerns in scalability of SMC application in SDNs.To address this issue,we formulate an optimization problem to minimize the number of SDN controllers while considering their reliability in SMC operations.We use Non-Dominated Sorting Genetic Algorithm II(NSGA-II)to determine the optimal number of controllers,and simulate SMC for typical SDNs with this number of controllers.Simulation results show that applying the SMC technique to preserve the privacy of organization policies causes only a little delay in SDNs,which is completely justifiable by the privacy obtained.

Route Guardian: Constructing Secure Routing Paths in Software-Defined Networking

Software-Defined Networking（SDN） decouples the control plane and the data plane in network switches and routers, which enables the rapid innovation and optimization of routing and switching configurations. However,traditional routing mechanisms in SDN, based on the Dijkstra shortest path, do not take the capacity of nodes into account, which may lead to network congestion. Moreover, security resource utilization in SDN is inefficient and is not addressed by existing routing algorithms. In this paper, we propose Route Guardian, a reliable securityoriented SDN routing mechanism, which considers the capabilities of SDN switch nodes combined with a Network Security Virtualization framework. Our scheme employs the distributed network security devices effectively to ensure analysis of abnormal traffic and malicious node isolation. Furthermore, Route Guardian supports dynamic routing reconfiguration according to the latest network status. We prototyped Route Guardian and conducted theoretical analysis and performance evaluation. Our results demonstrate that this approach can effectively use the existing security devices and mechanisms in SDN.

A secure and high-performance multi-controller architecture for software-defined networking

Controllers play a critical role in software-defined networking(SDN).However,existing singlecontroller SDN architectures are vulnerable to single-point failures,where a controller's capacity can be saturated by flooded flow requests.In addition,due to the complicated interactions between applications and controllers,the flow setup latency is relatively large.To address the above security and performance issues of current SDN controllers,we propose distributed rule store(DRS),a new multi-controller architecture for SDNs.In DRS,the controller caches the flow rules calculated by applications,and distributes these rules to multiple controller instances.Each controller instance holds only a subset of all rules,and periodically checks the consistency of flow rules with each other.Requests from switches are distributed among multiple controllers,in order to mitigate controller capacity saturation attack.At the same time,when rules at one controller are maliciously modified,they can be detected and recovered in time.We implement DRS based on Floodlight and evaluate it with extensive emulation.The results show that DRS can effectively maintain a consistently distributed rule store,and at the same time can achieve a shorter flow setup time and a higher processing throughput,compared with ONOS and Floodlight.

基于车端量子密钥的车联网数据访问控制研究

为实现车联网相关数据的安全传输和隐私保护,提出了一种基于车端量子密钥的车联网数据访问控制方案。设计了基于预充注量子密钥的身份认证和密钥协商机制,提出了基于量子随机数发生器的车辆数据访问控制方案,在车载通信终端集成量子随机数发生器以生成量子加密密钥,并由车辆所有者对来自外部设备的车联网数据访问请求进行管控,以防止非授权访问、高权限人员恶意侵入和车辆隐私数据的不当开放。最后,对提出的方案进行了安全性和性能分析,结果表明,该方案具有较强的安全性,具有比其他主要方案更小的计算开销(0.395 ms)和通信开销(420 B)。

量子密钥分发网络架构、进展及应用

近年来,随着网络通信攻击手段的层出不穷,只依赖传统计算困难程度的密钥分发的安全性受到了严重威胁。量子密钥分发技术由于其无条件安全性的优势,与光网络结合,在信息的保密性和传递效率方面具有突出的表现。利用量子密钥分发技术组建的量子密钥分发网络也在全球范围内得到逐步应用并且不断发展。重点总结了量子密钥分发各项协议及量子密钥分发网络的发展历程,以量子密钥分发网络所面临的生存性和连通性,以及中继节点的布置问题为切入点,分析了量子密钥分发网络目前存在的不足及现有的各种解决方案。最后,从实际的角度出发,分析和总结了量子密钥分发网络的应用现状,通过量子密钥分发在线与离线相结合的方式,使量子密钥分发网络的可推广性变得更强,同时,边缘网关到物联网终端设备的量子密钥分发也大大促进了量子密钥分发网络与现有物联网设备的结合应用。

计算机网络安全态势感知研究

经过分析当前网络安全态势数据,能够指导今后的网络安全态势预测,对于增强网络安全态势认知的主动性和可信度具有重要作用,因此制定基于量子遗传算法的网络安全态势感知方案。一方面,可以利用属性的相似度函数统计网络和安全状态信号的相似程度;另一方面,可以根据报警相似度函数求解报警信号的相似性关系。本次采用CICIDS2017执行模拟,实验结果显示,新提出的基于量子遗传算法的网络安全态势感知具有更高的准确度和稳定性。