Um ambiente flexível para detecção e prevenção flexível de ataques em redes OpenFlow/SDN

Abstract

Software Defined Networking (SDN) paradimg decouples control plane and of data plane, providing high programmability and a global view of the network. The adoption of this approach is growing in business networks, data centers and critical infrastructures such as smart grids. However, it is a challenge not only to provide security in these new generation networks but also to allow a network attack to be susceptible to an incident handling and forensic expertise procedure. In this way, this master’s degree dissertation proposes the implementation of a Environment for Flexible Attacks Detection and Prevention in OpenFlow/SDN Networks, which includes the setup of a real OpenFlow/SDN Testbed environment and implemented mechanisms for detection and response to threats capable of providing resources for intrusion and attack analysis. These mechanisms were implemented with the goal of providing security event monitoring and treatment in a flexible way, by categorizing the attack types and associated with whitelist and blacklist resources, exploiting one of the main characteristics of the OpenFlow network controller to be Extensible and programmable. The validation of the environment was done through simulation based on 5 (five) different scenarios and the obtained results demonstrate that the different classes of network attacks were identified and treated according to the defined strategy. Also, the mechanisms of protection and analysis of the intrusion into the OpenFlow/SDN network Testbed environment were effective and had the expected behavior according to each class of traffic defined in the proposal.