Digital forensics framework for intent-based networking over software-defined networks

Muhammad Faraz Hyder (), Tasbiha Fatima () and Saadia Arshad ()
Additional contact information
Muhammad Faraz Hyder: NED University of Engineering and Technology
Tasbiha Fatima: NED University of Engineering and Technology
Saadia Arshad: NED University of Engineering and Technology

Telecommunication Systems: Modelling, Analysis, Design and Management, 2024, vol. 85, issue 1, No 2, 27 pages

Abstract: Abstract Intent-based networking (IBN) is an evolutionary paradigm. Its recent adaptation has been increased substantially by Cloud Service Providers, Telecom, and network operators due to its automation capabilities. However, there are certain challenges specifically related to security. One of the core challenges is the lack of a forensic framework for identifying different incidents inside IBN. In this paper, we have proposed a framework to perform the forensics investigation of an IBN inside a software defined networking (SDN) environment. This framework is based on the steps of the forensics investigation process and consists of four modules: Identification, Collection, Analysis, and Reporting. Identification includes logs searching for specific events. Logs are searched through keywords, Time, Date, and Event ID. Pieces of evidence are collected from the Application, Control, and Infrastructure Layers of SDN by exploiting the default log file of ONOS and third-party tools. The analysis is performed using manual analysis of the raw log entries and third-party tools such as Loki/Grafana. This framework is implemented by utilizing ONOS as an SDN controller. The emulator used for creating the experimental network is Mininet on two different use cases: Normal Traffic Routing and Redirection of Attack Traffic, to analyze the difference in log files generated by the SDN controller. These files are manually analyzed and sent to the Loki–Grafana server for better analysis, visualization, and real-time monitoring of IBN logs. Assessment of the obtained experimental results is based on the states defined in the Intent Framework of ONOS.

Keywords: Distributed denial of service attacks; Intent-based networking; IBN forensics; Software defined networking; SDN forensics (search for similar items in EconPapers)
Date: 2024
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
http://link.springer.com/10.1007/s11235-023-01064-8 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:telsys:v:85:y:2024:i:1:d:10.1007_s11235-023-01064-8

Ordering information: This journal article can be ordered from
http://www.springer.com/journal/11235

DOI: 10.1007/s11235-023-01064-8

Access Statistics for this article

Telecommunication Systems: Modelling, Analysis, Design and Management is currently edited by Muhammad Khan

More articles in Telecommunication Systems: Modelling, Analysis, Design and Management from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().