Link-flooding attacks (LFAs) can cut off the Internet connection to selected server targets and are hard to mitigate because adversaries use normal-looking and low-rate flows and can dynamically adjust the attack strategy. Traditional centralized defense systems cannot locally and efficiently suppress malicious traffic. Though emerging programmable switches offer an opportunity to bring defense systems closer to targeted links, their limited resource and lack of support for runtime reconfiguration limit their usage for link-flooding defenses.We present Mew1, a resource-efficient and runtime adaptable link-flooding defense system. Mew can counter various LFAs even when a massive number of flows are concentrated on a link, or when the attack strategy changes quickly. We design a distributed storage mechanism and a lossless state migration mechanism to reduce the storage bottleneck of programmable networks. We develop cooperative defense APIs to support multi-grained co-detection and co-mitigation without excessive overhead. Mew's dynamic defense mechanism can constantly analyze network conditions and activate corresponding defenses without rebooting devices or interrupting other running functions. We develop a prototype of Mew by using real-world programmable switches, which are located in five cities. Our experiments show that the real-world prototype can defend against large-scale and dynamic LFAs effectively.

Zero Trust, as an emerging trend of cybersecurity paradigms in modern infrastructure (e.g., enterprise, cloud, edge, IoT, and 5G), is moving security defenses from static and perimeter-based control systems to focus on users and resources with no assumption of implicit trust. However, the current Zero Trust Architecture (ZTA) mainly focuses on the network security and lacks in-depth considerations on system-level security policies and abstractions, which leaves the realization of the principle incomplete. To bridge the gap, we propose an innovativeprogrammablesystem security framework called SYSFLOW to enable unified, dynamic, and fine-grained Zero Trust security control for system resources. SYSFLOW introduces a novelsystem flowabstraction to modelsystem activitiesacross the entire infrastructure, and provides a system-level data plane and control plane separation and abstraction. The new logically centralized controller accommodates a unifiedprogrammablePolicy Decision Point (PDP) that acquires a holistic view of system behaviors for controlling system resource accesses by translated programmable security policies into system flow rules. The SYSFLOW data plane, acting as Policy Enforcement Point (PEP), enforces translated system flow rules, which can be updated dynamically and facilitate fine-grained responsive actions. Our extensive evaluations demonstrate the effectiveness and scalability of SYSFLOW, which addresses the security issues in various scenarios with a minor performance overhead.

The need of customized network functions for enterprises in Infrastructure-as-a-Service (IaaS) clouds is emerging. However, existing network functions in IaaS clouds are very limited, inflexible, and hard to control by the tenants. Recently, the introduction of Software-Defined Networking (SDN) technology brings the hope of flexible control of network flows and creation of diverse network functions. Unfortunately, enterprises lose access to the SDN controller when they move to clouds. Moreover, the cloud SDN controller is only managed by the provider administrators for security and performance reasons. To allow enterprise tenants to develop and deploy their own SDN apps in the cloud, in this paper, we introduce a new cloud usage paradigm: Bring Your Own Controller (BYOC). BYOC offers each tenant an individual SDN controller, where tenants can deploy SDN apps to manage their network. To manage these tenant SDN controllers, we propose BYOC-Visor, a new SDN-based virtualization platform. BYOC-VISOR addresses several security and performance challenges which are specific to IaaS clouds. We show that BYOC-Visor supports different controller platforms and diverse SDN security applications such as firewall, IDS, and access control. We implement a prototype system and the performance evaluation results show that our system has low overhead.

Software Defined Networking (SDN) is an emerging technology that attracts significant attention from both industry and academia recently. By decoupling the control logic from the closed and proprietary implementations of traditional network devices, it enables researchers and practitioners to design new innovative network functions/protocols in a much more flexible, powerful, and easier way. We believe SDN provides new research opportunities to security, and it can greatly impact network security research in many different ways. However, till today, SDN has not been well recognized by the security community yet. In this systematic survey on SDN security, we investigate how the new features provided by SDN can help enhance network security and information security process. By systematically reasoning the opportunities introduced by SDN to network security, we hope to provide new insights for future research in this important area.

Mobility management is one of the most important research issues in 6LoWPAN, which is a standardizing IP-based Wireless Sensor Networks(IP-WSN) protocol. Since the IP-WSN application domain is expanded to real-time applications such as healthcare and surveillance systems, a fast and seamless handover becomes an important criterion for mobility support in 6LoWPAN. Unfortunately, since existing mobility protocols for 6LoWPAN have not solved how to reduce handover delay, we propose a new fast and seamless mobility protocol to support inter-PAN handover in 6LoWPAN, named inter-MARIO. In our protocol, a partner node, which serves as an access point for a mobile node, preconfigures the future handover of the mobile node by sending mobile node's information to candidate neighbor PANs and providing neighbor PAN information like channel information to the mobile node. Also, the preconfigured information enables the foreign agent to send a surrogate binding update message to a home agent instead of the mobile node. By the preconfiguration and surrogate binding update, inter-MARIO decreases channel scan delay and binding message exchange delay, which are elements of handover delay. Additionally, we define a compression method for binding messages, which achieves more compression than existing methods, by reducing redundant fields. We compare signaling cost and binding message exchange delay with existing mobility protocols analytically and we evaluate handover delay by simulation. Analysis and simulation results indicate that our approach has promising fast, seamless, and lightweight properties.

We investigated the distributions of sea ice using various microwave remote sensing techniques in the part of Drake passage, Antarctica, between the area 45-75/spl deg/W and 55-66/spl deg/S. We used TOPEX/Poseidon (T/P) radar altimeter, ERS-1 altimeter, ERS-2 scatterometer, Nimbus-7 Scanning Multichannel Microwave Radiometer (SMMR), and DMSP Special Sensor Microwave/Imager (SSM/I) data. The sea ice distributions were estimated between May and June 1995 and October and November 1998. The two altimeter measurements (T/P and ERS-1) showed good coherence with the results from the radiometer data in the given period when the ice concentration of 20% and greater was selected. The scatterometer data also showed good correlation with the altimetry-implied sea ice surface. The maximum and minimum values of sea ice distribution appeared in August and February, respectively. In general, the sea ice distributions estimated from radar altimeter, radiometer, and scatterometer are well correlated.