Software Defined Networking (SDN) enables a centralized manageable framework to control network devices and their policies using device-specific flow rules. When administrators deploy flow rules to support business policies, the network controller checks them against existing rules to detect conflicts and ensure consistency, security, and functionality in the data plane. Existing offline conflict detection methods are not scalable due to state explosion and often lead to networking chaos due to inefficiency. This paper presents Waterfall, designed to minimize the number of flow rule-checking operations. We propose a novel Equivalence Class (EC) creation and prioritization technique that simplifies conflict detection by organizing rules with similar patterns and processing them accordingly. Analogous to a multi-stage waterfall, our algorithm optimizes downstream stages by reducing unnecessary comparisons, ensuring efficient conflict detection. Our comprehensive evaluation demonstrates Waterfall’s effectiveness through significant reductions in computation time ($O(mKH)$, where m is the number of matched flow-rules which is far less than the total number of flow-rules, K is the number of attributes (headers) in flow rules, H is the number of hash functions in Bloom filter for attribute matching), making it ideal for real-time flow rule checking and conflict resolution in SDN environments. In our evaluation, Waterfall achieved a remarkable 1.3X improvement in conflict detection and 4.4X improvement for conflict resolution over the state-of-the-art solution for the Stanford topology which is a popular topology to represent real-world networking scenarios. We also evaluate the scalability of the solution using a synthetic dataset containing 15K flow rules that have three virtual network functions. Our solution achieved a$90.53~\mu $s conflict detection and resolution time for the large synthetic dataset. This lightweight approach promises substantial benefits for real-time flow rule checking in SDN environments.

Mobile health apps are a digital era revolution, facilitating direct patient-physician communication, lab and test orders, and medication refills. Despite these benefits, security and privacy issues arise due to handling sensitive data. This paper assesses the security and privacy of Saudi Arabian mobile healthcare apps, gauging compliance with the Personal Data Protection Law (PDPL). Results highlight varied PDPL compliance, underscoring the imperative for enhanced security measures in the digital healthcare landscape.

Unraveled is a novel cybersecurity dataset capturing Advanced Persistent Threat (APT) attacks not available in the public domain. Existing cybersecurity datasets lack coherent information about sophisticated and persistent cyber-attack features, including attack planning and deployment, stealthiness of the attacker(s), longer dorm period between attack activities, etc. Our APT attack scenario in Unraveled is implemented on a real network system established on a cloud platform to emulate an organization’s network system. The new dataset provides a comprehensive network flow and host-level log information about the normal user(s) traffic and the cyber attacks traffic. To emulate realistic network traffic scenarios, Unraveled also includes attacks at different skills reflecting a typical organization’s threat posture, and by utilizing APT attack information from one of the well-known APT attack databases, i.e., MITRE’s APT-group database. Furthermore, we design and develop an Employee Behavior Generation (EBG) model to emulate multiple normal employees’ traffic and activities during a 6-week time period based on their pre-defined business functions. Using well-known machine learning models for anomaly detection, we show that the APT attack activities in Unraveled are hardly detected, indicating the need for more effective solutions that are based on datasets representing real world APT attacks.

Software-Defined Networking (SDN) provides a programmable framework for multi-tenant cloud network management and orchestration. The end-to-end packet processing induced by virtual network functions (VNFs) like stateless firewall, load balancer, intrusion detection, and prevention system (IDPS) in a network involves the processing of network traffic through security policies matching the traffic pattern defined in security rules of individual VNF. The conflicting rules in terms of traffic match and conflicting actions can lead to a) violation of security requirements (authentication and authorization bypass) b) mission requirements - the presence of redundant rules (increased latency, reduced throughput). We present a new object-oriented policy conflict detection and resolution framework (OOPC), which analyzes the rule dependency relationships between the rules of heterogeneous virtual network functions (VNFs) and creates a VNF-Graph. The rules are analyzed using object-oriented dependencies between the address space and actions of VNF rules. OOPC utilizes a compact VNF-Graph, which leads to a reduction in search complexity when analyzing new security policies. Our security policy composition in our framework OOPC achieves 37 percent lower latency in policy graph composition than previous work. The proposed solution performs 20 percent faster security policy conflict detection on a cloud network with 60k OpenFlow rules than prior frameworks that serve a similar purpose.

Different network controllers are utilized in a multi-domain software-defined systems (SDx) to manage the networking resources. However, these controllers operate using a different high-level language (intent). Thus, the admin needs to perform cross-layer translation from the user requirements to the underlying network controller format, increasing human-in-the-loop overhead. There are two primary security and management challenges involved in managing multi-domain controllers. The first challenge is how to design an SDN controller language that can effectively convert human-specified networking policies at the control plane into the network flow rules level at the data plane. The second challenge is how to reduce the complexity of network flow rules conflict checking at the data plane. To address these challenges, we present a new intent-based security policy enforcement solution called INTPOL. First, INTPOL provides a unified intent rules that abstracts the network admin from the underlying network controller’s format. Second, INTPOL develops a networking service solution to use a bounded formal model for network service compliance checking that significantly reduces the complexity of flow rules conflicts checking at the data plane level. Finally, INTPOL is expendable from a single SDN domain to multiple SDN domains and hybrid networks by applying network service function chaining (SFC) for inter-domain policy management.

Security Assessment of large networks is a challenging task. Penetration testing (pentesting) is a method of analyzing the attack surface of a network to find security vulnerabilities. Current network pentesting techniques involve a combination of automated scanning tools and manual exploitation of security issues to identify possible threats in a network. The solution scales poorly on a large network. We propose an autonomous security analysis and penetration testing framework (ASAP) that creates a map of security threats and possible attack paths in the network using attack graphs. Our framework utilizes: (i) state of the art reinforcement learning algorithm based on Deep-Q Network (DQN) to identify optimal policy for performing pentesting testing, and (ii) incorporates domain-specific transition matrix and reward modeling to capture the importance of security vulnerabilities and difficulty inherent in exploiting them. ASAP framework generates autonomous attack plans and validates them against real-world networks. The attack plans are generalizable to complex enterprise network, and the framework scales well on a large network. Our empirical evaluation shows that ASAP identifies non-intuitive attack plans on an enterprise network. The DQN planning algorithm employed scales well on a large network ~ 60 -70(s) for generating an attack plan for network with 300 hosts.

Secure end-to-end communication has become a necessity for many people. In this research paper we survey the most popular and widely used secure anonymous Instant Messaging (IM) services and protocols, study them from a security and anonymity point of view, and investigate how these services or protocols could be compromised.