E‐Replacement: Efficient scanner data collection method in P4‐based software‐defined networks

Yun‐Zhan Cai, Ting‐Yu Lin, Yu‐Ting Wang, Ya‐Pei Tuan and Meng‐Hsun Tsai

International Journal of Network Management, 2021, vol. 31, issue 6

Abstract: Internet of things (IoT) botnets such as Mirai are rampant in the past years. Port scanning is a well‐known behavior of botnets for searching targets in networks. To detect port scanning, a detector requires network statistics with high discriminatory power. In P4‐based software‐defined network (SDN), switches take charge of recording characteristics about scanning behaviors, and controllers pull the statistics from the switches periodically for anomaly detection. Given storage resources in switches are limited, we proposed a scanner data collection method, 0‐Replacement, in P4‐based SDN to efficiently collect scanner data and improve the detection rate. 0‐Replacement, however, does not consider performance degradation caused by the hash collision. In this paper, we combine the conception of Hashpipe with 0‐Replacement and propose a new scanner data collection method named E‐Replacement. By leveraging the conception of Hashpipe, E‐Replacement can mitigate the performance degradation caused by the hash collision. Through simulations, we show that E‐Replacement improves the detection rate by up to 6.73% and 210.82% compared to 0‐Replacement and the traditional sample and hold method, respectively. Besides, E‐Replacement improves the precision by around 528.2% compared to the count‐min sketch and k‐ary sketch methods. The memory usage in E‐Replacement is the same as 0‐Replacement. In simulations, E‐Replacement can detect around 93.4% of scanners in a class B network with only 4.02‐Mb SRAM. After implementing E‐Replacement on a software P4 switch, BMv2, we observe the extra forwarding latency for E‐Replacement is not greater than a millisecond.

Date: 2021
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://doi.org/10.1002/nem.2162

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:wly:intnem:v:31:y:2021:i:6:n:e2162

Access Statistics for this article

More articles in International Journal of Network Management from John Wiley & Sons
Bibliographic data for series maintained by Wiley Content Delivery ().