Securing devices using network traffic analysis and software-defined networking (SDN)
View Patent ↗Systems and methods for securing devices using traffic analysis and Software-Defined Networking (SDN). In some embodiments, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory including program instructions stored thereon that, upon execution by the processor, cause the IHS to: receive traffic in a Software-Defined Network (SDN) network; identify, based upon the received traffic, a security threat; and initiate a remediation measure with respect to the security threat.
1. An Information Handling System (IHS), comprising:
one or more processors; and
a memory coupled to the one or more processors, the memory having program instructions stored thereon that, upon execution by the one or more processors, cause the IHS to:
receive traffic in a Software-Defined Network (SDN) network;
identify, based upon the received traffic, a security threat as a slow Denial-of-Service (DoS) attack targeting a legacy hardware device coupled to the SDN via a hub or adaptor by:
(i) multiplying a number of response timeouts by a first weight to calculate a first metric,
(ii) multiplying a resource utilization by a second weight to calculate a second metric,
(iii) calculating a weighted average (R) of the first and second metrics, and
(iv) determining that the weighted average (R) is greater than a threshold (T); and
initiate a remediation measure with respect to the security threat,
wherein the remediation measure comprises Internet Protocol (IP) blocking, port blocking, or traffic rate limiting.
2. The IHS of claim 1 , wherein the legacy hardware device lacks one or more capabilities necessary for identifying or remediating the security threat, and wherein the capabilities are selected from the group consisting of: processing power, memory space, and security software.
3. The IHS of claim 2 , wherein to receive the traffic, the program instructions, upon execution by the one or more processors, further cause the IHS to receive Transmission Control Protocol (TCP) data from an SDN-capable switch or router.
4. The HIS of claim 1 , wherein to initiate the remediation measure, the program instructions, upon execution by the one or more processors, further cause the HIS to update one or more entries in a flow table used by the SDN-capable switch or router.
5. The IHS of claim 4 , wherein to update the one or more entries in the flow table, the program instructions, upon execution by the one or more processors, further cause the IHS to use a representational state transfer (REST) Application Programming Interface (API).
6. The IHS of claim 3 , wherein the program instructions, upon execution by the one or more processors, further cause the IHS to receive a definition of the security threat from a main IoT Gateway Controller in the SDN network.
7. The IHS of claim 3 , wherein the IoT device comprises an analog sensor coupled to the SDN network via an adaptor or hub and wherein the plurality of requests comprise requests for the adaptor or hub to transmit, to the server, an indication of an analog voltage or current signal read by the analog sensor.
8. A hardware memory device having program instructions stored thereon that, upon execution by an Information Handling System (IHS), cause the IHS to:
receive traffic in a Software-Defined Network (SDN) network, wherein at least a portion of the traffic is directed to or originated from an of Internet-of-Things (IoT) device, wherein the IoT device lacks one or more capabilities necessary for identifying the security threat, and wherein the capabilities are selected from the group consisting of: processing power, memory space, and security software;
identify a security threat as a slow Denial-of-Service (DoS) attack based upon the received traffic by:
(i) multiplying a number of response timeouts by a first weight to calculate a first metric,
(ii) multiplying a resource utilization by a second weight to calculate a second metric,
(iii) calculating a weighted average (R) of the first and second metrics, and
(iv) determining that the weighted average (R) is greater than a threshold (T); and
initiate a remediation measure with respect to the security threat,
wherein the remediation measure comprises Internet Protocol (IP) blocking, port blocking, or traffic rate limiting.
9. The hardware memory device of claim 8 , wherein to receive the traffic, the program instructions, upon execution by the IHS, further cause the IHS to receive Transmission Control Protocol (TCP) data from an SDN-capable switch or router.
10. The hardware memory device of claim 8 , wherein to initiate the remediation measure, the program instructions, upon execution by the one or more processors, further cause the IHS to update one or more entries in a flow table used by the SDN-capable switch or router.
11. A method, comprising:
receiving Transmission Control Protocol (TCP) data in a Software-Defined Network (SDN) network from an SDN-capable switch or router, wherein at least a portion of the traffic is directed to a server and originated from an of Internet-of-Things (IoT) device;
identifying a security threat as a slow Denial-of-Service (DoS) based upon the received traffic by:
(i) multiplying a number of response timeouts by a first weight to calculate a first metric,
(ii) multiplying a resource utilization by a second weight to calculate a second metric,
(iii) calculating a weighted average (R) of the first and second metrics, and
(iv) determining that the weighted average (R) is greater than a threshold (T); and
initiating a remediation measure with respect to the security threat,
wherein the remediation measure comprises Internet Protocol (IP) blocking, port blocking, or traffic rate limiting.
12. The method of claim 11 , wherein initiating the remediation measure comprises updating one or more entries in a flow table used by the SDN-capable switch or router.