Software-Defined Networking (SDN) and Distributed Denial of Service (DDoS) Attacks in Cloud Computing Environments: A Survey, Some Research Issues, and Challenges
Software-Defined Networking (SDN) and Distributed Denial of Service (DDoS) Attacks in Cloud Computing Environments: A Survey, Some Research Issues, and Challenges
复制标题
DOI：
10.1109/comst.2015.2487361
复制
发表时间：
2016-01
影响因子：
35.6
通讯作者：
Qiao Yan;F. Yu;Q. Gong;Jianqiang Li
中科院分区：
文献类型：
--
作者：
Qiao Yan;F. Yu;Q. Gong;Jianqiang Li
由于云计算的本质特性，云计算环境中的分布式拒绝服务（DDoS）攻击日益增多。随着软件定义网络（SDN）的最新进展，基于SDN的云计算为我们在云计算环境中抵御DDoS攻击带来了新的机遇。然而，SDN与DDoS攻击之间存在一种矛盾关系。一方面，SDN的能力，包括基于软件的流量分析、集中控制、网络全局视图、转发规则的动态更新，使其更容易检测DDoS攻击并作出反应。另一方面，SDN自身的安全性仍有待解决，并且SDN平台存在潜在的DDoS漏洞。在本文中，我们讨论了云计算中DDoS攻击的新趋势和特点，并对使用SDN抵御DDoS攻击的防御机制进行了全面综述。此外，我们回顾了关于在SDN上发起DDoS攻击的研究，以及针对SDN中DDoS攻击的方法。据我们所知，SDN与DDoS攻击之间的矛盾关系在以往的研究中尚未得到很好的解决。这项工作有助于理解如何充分利用SDN的优势来抵御云计算环境中的DDoS攻击，以及如何防止SDN自身成为DDoS攻击的受害者，这对于基于SDN的云计算在不受DDoS攻击干扰的情况下顺利演进非常重要。
Distributed Denial of Service (DDoS) attacks in cloud computing environments are growing due to the essential characteristics of cloud computing. With recent advances in software-defined networking (SDN), SDN-based cloud brings us new chances to defeat DDoS attacks in cloud computing environments. Nevertheless, there is a contradictory relationship between SDN and DDoS attacks. On one hand, the capabilities of SDN, including software-based traffic analysis, centralized control, global view of the network, dynamic updating of forwarding rules, make it easier to detect and react to DDoS attacks. On the other hand, the security of SDN itself remains to be addressed, and potential DDoS vulnerabilities exist across SDN platforms. In this paper, we discuss the new trends and characteristics of DDoS attacks in cloud computing, and provide a comprehensive survey of defense mechanisms against DDoS attacks using SDN. In addition, we review the studies about launching DDoS attacks on SDN, as well as the methods against DDoS attacks in SDN. To the best of our knowledge, the contradictory relationship between SDN and DDoS attacks has not been well addressed in previous works. This work can help to understand how to make full use of SDN's advantages to defeat DDoS attacks in cloud computing environments and how to prevent SDN itself from becoming a victim of DDoS attacks, which are important for the smooth evolution of SDN-based cloud without the distraction of DDoS attacks.