Denial of Service Attacks Detection in Software-Defined Wireless Sensor Networks
Gustavo A. Nunez Segura Sotiris Skaperas Arsenia Chorti Lefteris Mamatas Cintia Borges Margi
cs.CR cs.NI





























































Denial of Service Attacks Detection in Software-Defined Wireless Sensor Networks

    Gustavo A. Nunez Segura1,
Sotiris Skaperas2, Arsenia Chorti3, 
 Lefteris Mamatas2 and Cintia Borges Margi1
1Escola Politécnica, Universidade de São Paulo, São Paulo, Brazil 
2Department of Applied Informatics, University of Macedonia, Thessaloniki, Greece
3ETIS UMR8051, CY Université, ENSEA, CNRS, F-95000, Cergy, France
Email: {gustavoalonso.nunez, cintia}@usp.br,
        arsenia.chorti@ensea.fr,
        {sotskap, emamatas}@uom.edu.gr

    December 30, 2023
===========================================================================================================================================================================================================================================================================================================================================================================================================================================================




Software-defined networking (SDN) is a promising technology to overcome many challenges in wireless sensor networks (WSN), particularly  with respect to flexibility and reuse. Conversely, the centralization and the planes' separation turn SDNs vulnerable to new security threats in the general context of distributed denial of service (DDoS) attacks. State-of-the-art approaches to identify DDoS do not always take into consideration restrictions in typical WSNs e.g., computational complexity and power constraints, while further performance improvement is always a target. The objective of this work is to propose a lightweight but very efficient DDoS attack detection approach using change point analysis. Our approach has a high detection rate and linear complexity, so that it is suitable for WSNs. We demonstrate the performance of our detector in software-defined WSNs of 36 and 100 nodes with varying attack intensity (the number of attackers ranges from 5% to 20% of nodes). We use change point detectors to monitor anomalies in two metrics: the data packets delivery rate and the control packets overhead.  Our results show that with increasing intensity of attack, our approach can achieve a detection rate close to 100% and that the type of attack can also be inferred.



Software-defined networking, intrusion detection, wireless sensor networks





§ INTRODUCTION
 

Software-defined networking (SDN) is a paradigm that was devised to simplify network management, avoid configuration errors and automate infrastructure sharing in wired networks <cit.>. 
The aforementioned benefits motivated the discussion of combining SDN and wireless sensor networks (WSNs) as a solution to many WSN challenges, in particular concerning flexibility and resource reuse <cit.>. This combination is referred to as software-defined wireless sensor networks (SDWSN).
The SDWSN approach decouples the control plane from the data plane and centralizes the control decisions; its main characteristic is the ability to program the network operation dynamically <cit.>. Recent results show that SDWSNs can perform as well as RPL <cit.>. 

On the other hand, the SDN centralization and the planes' separation turn the network vulnerable to new security threats (explained in Section <ref>), a property that is inadvertently passed on to SDWSNs. Shielding SDNs from these vulnerabilities has already attracted a lot of attention in the literature. 
There are proposals to implement attack detection in Internet of things (IoT) networks using SDN. Sankar and Gurusamy <cit.> proposed softhings, an SDN-based IoT framework with security support. The framework was developed for OpenFlow <cit.>, which however, limits its use in networks composed of low-end nodes. The use of support vector machines (SVM) was proposed to detect control plane attacks; it was shown that a detection rate of around 96% and 98% could be achieved. The algorithm was tested in Mininet, simulating scenarios with only five 5 nodes and considering one node as attacker.   

Yin et al. <cit.> developed the framework SD-IoT, which includes a security system for DDoS attacks detection, based on the difference of packets received by the controller. The difference is calculated using the cosine similarity method. This mechanism was devised for networks where all the nodes have periodic communication with the controller, which could be not optimal for very “restricted” networks with low-end nodes. Authors tested their proposal through simulations using Mininet. The network size is not explicitly specified, but is inferred to be around 50 to 60 nodes.

Overall, in the case of SDWSNs, due to the resource constraints of the nodes, most of the security mechanisms designed for non-resource constrained SDNs have to be adapted or redesigned. This is one of the major challenges for SDWSN security. Wang et al. <cit.> proposed an SDWSN trust management and routing mechanism. They compared their proposal to SDN-WISE when both networks are under attack. The focus of the work is on the selective forwarding attacks and new flow requests. The first attack applies to any type of WSNs, while the second is specific to SDN. The mechanism was tested in simulations with 100 nodes, varying the number of attackers between 5 and 20. Their results show an attack detection rate between 90% and 96% when 5 nodes are attackers, and between 60% and 79% when 20 nodes are attackers.

Considering the limitations of previous works, our main objective is to propose a mechanism for DDoS detection with, i) a high detection rate, and, ii) low complexity, so that it would be suitable for “restricted” networks. To this end, we propose the employment of change of point analysis <cit.><cit.>. We study two DDoS attacks: a false data flow forwarding (FDFF) attack, and a false neighbor information (FNI) attack, chosen to illustrate the proposed algorithm's capabilities in the case of specific SDWSN vulnerabilities that exhibit largely different behavior. Both attacks are explained in Section <ref>. 



We have tested our approach on the IT-SDN framework[http://www.larc.usp.br/users/cbmargi/www/it-sdn/]  <cit.>  and our results show that we can detect these attacks with a detection rate close to 100%, improving the state of the art; importantly, it is further possible to gain insight regarding the type of the attack, based on the metric that provides the quickest detection, a feature, that to the best of our knowledge, breaks new ground in the domain of DDoS analysis for SDWSNs.






§ IMPACT OF DDOS ATTACKS IN SDWSNS




 §.§ SDWSN security analysis
 

The SDN networks security threats are grouped in three sets <cit.>: application plane attacks, control plane attacks, and data plane attacks. Among the three, the control plane attacks are pointed out as the most high impact and attractive <cit.><cit.>, as the control plane is responsible for the overall management of the network <cit.>. This characteristic turns the control plane prone to distributed denial of service (DDoS) attacks. For example, an intruder may flood the network with flow rule requests, which could lead to an exhaustion of the controller's resources. This attack can be intensified using multiple intruders.

The threats and vulnerabilities explained before also apply to SDWSN. Moreover, there are specific attacks that can attain SDWSNs due to resources constraints, for example: in SDWSN the forwarding devices have low storage capacity, which limits the memory assigned for flow tables and buffers. These constraints make the forwarding devices prone to saturation attacks. Also, SDWSN networks are characterized for having a limited bandwidth and low processing power. This means that a saturation attack can also result in a DoS attack.

Another vulnerability concerns the gateway between the SDN controller and the WSN. The gateway has a radio module of limited bandwidth, rendering it a weak link even when the controller has enough resources to overcome an attack. 

For the reasons outlined above, most of the security mechanisms designed for standard SDN networks have to be adapted or redesigned. This is one of the major challenges for SDWSN security.





 §.§ Impact of DDoS Attacks on Network Performance

Based on SDWSN specific security vulnerabilities, in a previous work, we studied the impact of three DDoS attacks on SDWSN performance <cit.>. The attacks investigated were: false flow request (FFR), false data flow forwarding (FDFF), and false neighbor information (FNI). 

The FFR attack aimed at increasing the SDWSN controller's processing overhead, as well as the packets' traffic, thus, increasing the number of collisions. Each attacker sent multiple flow rule requests to the controller, while the latter calculated the rule and replied to the request. The impact of the attack was observed to be negligible. The FDFF attack followed the FFR attack main idea of sending false flow rule requests to the controller, however, the execution was based on using each attacker's neighbors (benign nodes). Each attacker sent one data packet to its neighbors tagged with an unknown flow identifier; as the neighbors did not have a rule to apply to the packet, they sent a flow request to the controller asking a rule for the unknown flow identifier. Thus, compared to the FFR, the intensity of the attack was multiplied by the number of neighbors. The FDFF attack tripled the number of control packets in the whole network, but had a minor impact on the delivery rate. For both control and data packets, the delivery rate decreased only between 2% and 4%. 

In the FNI attack, each attacker intercepted packets containing neighbor information, modified them with false neighbor information and forwarded them to the controller. The controller updated the network topology graph using the false information, and then reconfigured the network with wrong forwarding rules.
Our main results <cit.> showed that the FNI attack could double the number of control packets in the whole network and had a significant impact on the delivery rate. In the case of the control packets, the delivery rate decreased between 35% and 50%. In the case of the data packets, the delivery rate decreased between 20% and 70%. 






§ CHANGE POINT DETECTION ALGORITHM FOR DDOS


The study in <cit.> provided valuable insight regarding the impact of the FDFF and FNI DDoS attacks on the two metrics under observation, i.e., the mean data packet delivery rate and the mean control packets overhead. Building on this analysis, we formulate the attack detection problem as a hypothesis test, examining whether a change has occurred in the mean value of the time series of the metrics involved. 

In <cit.> a change point (CP) detection algorithm was proposed to estimate in real-time the existence, the number, the magnitude and the direction of changes in a time series. To attain these objectives, the algorithm combined (i) off-line and on-line CP schemes; (ii) an improved measurements window segmentation heuristic for the detection of multiple CPs; and (iii) a variation of the moving average convergence divergence (MACD) indicator to detect the direction of changes. The main elements of the algorithm are explained in the following.





 §.§ Basic Off-line Approach
 

The proposed algorithm tests the constancy of the mean values of the time series through a hypothesis test; the null hypothesis is defined as H_0: μ_1 = ⋯ = μ_N against the alternative H_1: μ_1 = ⋯ = μ_kμ_k+1 = ⋯ = μ_N indicating a change point (CP) at instance k ∈{ 1, N }, where N denotes the length the time series and μ_i the mean value of the time series up to instance i. 

Assuming that each sample of the time series X_1,...,X_N can be written as, X_n=μ_n+Y_n,   1⩽n⩽N, a non-parametric CUSUM test statistic can be developed to identify changes in μ<cit.>; the test statistic can be viewed as a max-type procedure,

    M=max_1⩽n⩽NC^T_nΩ_N^-1C_n,

where the parameter C_n is the typical CUSUM,

    C_n=1√(N)(∑_i=1^nX_i-nN∑_i=1^NX_i),

and Ω_N is the estimator of the asymptotic covariance Ω, where

    Ω=∑_s=-∞^∞𝐂𝐨𝐯(X_nX_n-s).



To estimate Ω, 
the Bartlett estimator was employed <cit.>. 





















Finally, the critical values for several significance levels α were computed using Monte Carlo simulations. 
The last step is to estimate, if H_0 fails, the unknown CP, under H_1, given by:

    cp=1N_1⩽n⩽NM.























 §.§ On-line Phase

The on-line scheme includes an on-line CUSUM algorithm for the detection of a change in the mean and a MACD indicator to estimate the direction of a change;  X_n is expressed as <ref>

    X_n= μ+Y_n,  n=1,…,m+k^*-1 
    μ+Y_n+I,  n=m+k^*,…

where μ, M∈ℝ, represent the mean parameters before and after the unknown time of possible change k^*∈ℕ^* respectively. The term m denotes the length of an initial training period during which there is no change in the mean (μ_1=…=μ_m). In the form of a statistical hypothesis test, the on-line problem is posed as,

    H_0: I=0
    
    H_1: I≠0.

The on-line detection belongs to the category of stopping time procedures, in which for a chosen detector TS(m,k) and a given threshold F(m,k) we define the stopping time as: 

    τ(m)= min{k∈ℕ: |TS(m,k)|⩾F(m,k)}
    ∞, otherwise .

It is necessary to have lim_m→∞ P{τ_m<∞|H_0}=a, 

ensuring that the probability of false alarm is asymptotically bounded by α∈(0,1), and, lim_m→∞ P{τ_m<∞|H_1}=1,

ensuring that under H_1 the asymptotic power is unity.
Fulfilling these condition, the threshold F(m,k) was defined as,

    F(m,k)=c_ag_γ(m,k),

where the critical value c_a is determined from the asymptotic distribution of the detector under H_0 and the asymptotic behavior achieved by letting m→∞. The weight function,

    g_γ(m,k)=√(m)(1+k/m)(k/k+m)^γ

depends on the sensitivity parameter γ∈[0,1/2).     
The on-line phase use 
the standard CUSUM  

detector, given by:

    Γ(m,k)=1/ω_m(∑_i=m+1^m+kX_i-k/m∑_i=1^mX_i)

where ω_m denotes the asymptotic variance, that captures the serial dependence between observations.

The corresponding threshold is F^Γ(m,k)=c^Γ_ag_γ(m,k) and the critical value is defined as:

    lim_m→∞ P {τ_m<∞}    =lim_m→∞ P {1/ω_msup_1⩽k⩽∞Γ(m,k)/g_γ(m,k)>c^Γ_a}
       = {sup_t∈[0,1]W(t)/t^γ>c^Γ_a}=α.


The direction of change is estimated applying the MACD indicator. This indicator is based on an exponential moving average (EMA) filter. More details about this indicator can be found in previous works <cit.><cit.>. 




 




















 §.§ Overall algorithm


Summarizing, the overall algorithm has 5 main steps:

    
  * Step 1: define a finite monitoring window k > 0 from a starting time instance m_s,
    
  * Step 2: apply the off-line algorithm for the whole historical period h={1, …, m_s}. If no changes are detected, set m=h, conversely, the training sample becomes m = {cp_last,…, m_s}, where cp_last is the last off-line CP detected.
    
  * Step 3: apply the on-line procedure TS(m, k) on the interval m_s, m_s+k. If an on-line CP (ĉp̂^*) is detected, the on-line process stops. Conversely, ĉp̂^*= 0, the monitoring ends and proceeds to Step 5.
    
  * Step 4: define k_cp=ĉp̂^* as a CP and apply the trend indicator. If TI(k_cp > 0), announce an upward change. Conversely, announce a downward change.
    
  * Step 5: Set a new starting point for the monitoring period. If k_cp > 0, set ms = k_cp + d where d is a constant value defining a period assuming no change, else, set m_s = m_h.

	









































§ METHODS
 

We employed the CP algorithm in <cit.> in SDWSNs under FDFF and FNI attacks. We simulated grid topologies with 36 and 100 nodes, varying the number of attackers in the network (5% and 20%).  Each simulation runs during 10 hours and each scenario was replicated 30 times. During the first 8 hours the network operated normally, then the attack is triggered. The choice of 8 hours was made because empirically it was seen that we needed at least 250 samples for the training period and we obtained one sample every 2 minutes.

The simulations were performed using the COOJA simulator <cit.> and sky motes. The MAC layer was the IEEE 802.15.4, configured to work without radio duty cycle (). The data sink received the application data, while the management sink received performance metrics information. Notice that the SDN controller is a different node from the sink. Table <ref> depicts the simulation parameters.


We analyzed the data packets delivery rate and the control packets overhead. The delivery rate was calculated by dividing the total number of packets successfully received by the total number of packets sent. The control packets overhead was quantified as the total amount of control packets sent. Those metrics were updated every two minutes.

The metrics measuring the performance of the intrusion detection algorithm are: i) detection rate (DR); ii) false positive rate (FPR); iii) false negative rate (FPR); iv) detection time median (DTM), indicating the median of the time instances elapsed from the launch of the attack to the instance it was identified; and v) median absolute deviation (MAD). The detection rate is the ratio between the correctly detected attacks and the total number of attacks. The false positive rate is the ratio between the number of attack events classified as attack and the total number of attack events. The false negative rate is the ratio between attack events classified as non-attack event and the number of attack events. The detection time median is the median of the number of samples required to detect the attack. The median absolute deviation measures the variability of the detection times and is calculated as shown in (<ref>), where X_i is the detection time for replication i, and X̃ is the median of all the detection times, 

    MAD = median(|X_i - X̃|)


The delivery rate and control overhead time series were analyzed for three monitoring windows and three critical values. We used monitoring periods K ∈{ 50, 100 , 150} samples. This means that the test statistic is run over K samples to extract changes in the mean value. As critical values we used α∈{90%, 95%,  99%}. Finally, in this analysis, we discarded the first 15 samples because during this time the network is bootstrapping.




§ RESULTS AND ANALYSIS
 

In this Section we present and analyze the simulation results. In Section <ref> we compare the FDFF attack detection performance when monitoring the data packets delivery rate and the control overhead. In Section <ref> we repeat this analysis for the FNI attack. 



 §.§ FDFF attack detection
 

Tables <ref> and <ref> summarize the FDFF attack detection results when 5% of nodes are attackers. The results show that when monitoring the data packets delivery rate, the DR is between 57% and 73% for 36 nodes, and between 60% and 83% for 100 nodes. The results when monitoring the control packets overhead show two main points: (i) the algorithm has the same detection performance if configured with a monitoring period K of 50 or 150 samples, and (ii) when the monitoring period is configured as K=100 samples we obtained a DR between 97% and 100%. 

Comparing the FPR and the FNR metrics, we observe that the number of cases classified as false negative is higher than the number of cases classified as false positive. This means, it is more common for the algorithm not to detect a change in the metrics when the network is under attack than to detect a suspicious change in a network without attackers. For example, looking at the results when monitoring the control overhead in Table <ref>, only in one out of nine cases the FPR was different than zero. Conversely, the FNR was different than zero in six of nine cases.

The DTM (detection time median) results show that when monitoring the control packets overhead, the attack detection is faster than when monitoring the delivery rate in all the cases. When monitoring the data packets delivery rate, the DTM is between 31 and 37 samples for 36 nodes, and between 20 and 31 samples for 100 nodes. When monitoring the control packets overhead, the DTM is between 9 and 19 samples for 36 nodes, and between 10 and 19 samples for 100 nodes. The fastest detection is obtained monitoring the control packets overhead using a monitoring period of 100 samples, highlighted in red color.











Tables <ref> and <ref> summarize the FDFF attack detection results when 20% of nodes are attackers. In the case of 36 nodes, the DR is between 73% and 83% when monitoring the data packets delivery rate, and between 87% and 100% when monitoring the control packets overhead. In terms of detection time, the best DTM when monitoring the data packets delivery rate was 24 samples and the DTM when monitoring the control packets overhead was 5 samples. 
Configuring the monitoring period in 100 we obtain the best DTM, but there is a drop in the DR if compared with the cases when using monitoring periods of 50 and 150 samples.

The results for 100 nodes show it is possible to obtain a DR of 100% monitoring any of the metrics, but there are significant differences in the detection time. The DTM when monitoring the control overhead is between 3 and 4 samples, while when monitoring the data packets delivery rate the DTM is between 7 and 15 samples. Considering the earliest detection with the highest DR for both monitoring metrics, it occurs when using a monitoring period of 100 samples. For both cases the DR obtained was 97%.
In terms of FPR and FNR, the best performance was obtained when monitoring the control overhead and using a monitoring period of 50 and 150 samples. Monitoring the control overhead using a monitoring window of 100 samples provides a FPR between 3% and 10%.

Summarizing, the algorithm is able to detect the FDFF attack using either the data packet packets delivery rate or the control packets overhead as inputs. Notably, the algorithm obtaines a DR of 100% with both metrics when 20% of nodes behave as attackers. However, aiming for the quickest detection captured through the detection time median, the algorithm achieved far better results when monitoring the control packets overhead in all scenarios.  
This is a direct consequence of the type of the attack; the attacker creates multiple flow rule request packets to increase the packet traffic and the controller processing overhead. After some time, the flow table of the nodes around the attacker start to saturate, affecting the data packets delivery rate. This means that the change in the delivery will be detected only after the tables saturation; on the contrary, the number of control packets start to change immediately after the attack is triggered. 














 §.§ FNI attack detection
 

Tables <ref> and <ref> summarize the FNI attack detection results when 5% of nodes are attackers. Opposite to the FDFF attack results, the algorithm obtained a better performance detecting the FNI attack when monitoring the data packets delivery rate. In the case of 36 nodes, the DR when monitoring the data packets delivery rate is between 80% and 93%, and the DR when monitoring the control packets overhead is between 23% and 33%. In the case of 100 nodes, the DR when monitoring the data packets delivery rate is between 83% and 93%, and the DR when monitoring the control packets overhead is between 30% and 70%. This means, even the best DR when monitoring the control packets overhead is under the worse DR when monitoring the data packets delivery rate. Also, the results show that using a critical value of 90%, we can obtain a negligible FPR (in our simulation calculated zero).
With respect to the DTM, the best result was obtained by monitoring the data packets delivery rate and the control packets overhead were 6 and 25 samples, respectively. This means the algorithm detects the attack four times faster when monitoring the data packets delivery rate. For 100 nodes, the best DTM when monitoring the data packets delivery rate remains in 6 samples, but when monitoring the control packets overhead it is 29 samples. 










Lastly, Tables <ref> and <ref> summarize the FNI attack detection results when 20% of nodes are attackers. For 36 nodes, the results remain similar to the case of 5% of nodes are attackers. In the case of 100 nodes, the DR when monitoring the data packets delivery rate is between 97% and 100%, and the DR when monitoring the control packets delivery rate is between 93% and 97%. 
About the DTM, the results for the scenarios when monitoring the data packets delivery rate are between 4 and 9 samples. The results for this same metric when monitoring the control packets overhead are between 24 and 26 samples. This means, for grid topologies with 100 nodes where 20% of nodes are attackers, we obtain similar DRs regardless of the monitoring metric, but when monitoring the delivery rate the detection is at least 3 times faster.

Summarizing our findings, the algorithm is able to detect the FNI attack monitoring either the data packet packets delivery rate or the control packets overhead. Then, comparing the detection performance based on the detection rate and the detection time median, the algorithm obtained a far better performance when monitoring the data packets delivery rate in all scenarios. 
This effect is directly related to the type of the attack; in the FNI attack, the attackers intercept the control packets that contain neighbor information, modify them, and then forward them to the controller. This means this attack can lead to a network misconfiguration using few control packets. 










 

§ CONCLUSIONS AND FUTURE WORK
 
SDWSNs are exposed to new security threats that may not affect traditional WSNs. Recent proposals in the literature for the identification of DDoS attacks in SDWSN do not always consider “restricted” networks and there is also the need to improve the solutions' performance.
In this work we provide a solution for DDoS attack detection for SDWSN. We identify an attack by monitoring changes in the mean values of two metrics, the network data packets delivery rate and the control packets overhead. To detect a change in either metric due to a DDoS attack, we use state-of-the-art non-parametric and on-line change point detection algorithms <cit.>. We performed experiments for two SDWSN DDoS attacks, in topologies of 36 and 100 nodes, and with varying number of attackers. The attacks implemented were the FDFF and the FNI. 

Our results showed that it is feasible to detect those attacks by monitoring either the data packets delivery rate or control packets metrics. However, targeting the quickest detection possible, far superior detection performance was achieved for the FDFF when monitoring the control packets overhead. Conversely, results showed a far better performance in detecting the FNI attack when monitoring the data packets delivery rate.  In either cases, the detection rate increased to even 100% with increasing attack intensity, while the agility of the detection is noteworthy, with either attack identified within 3-10 samples from its launch. Notably, different metrics have been shown to be better indicators for different types of attack, allowing to detect  not only the existence,  but, potentially the type of the attack. 

As the detector's algorithmic complexity is linear to the size of the network and the number of metrics monitored, the proposed approach could scale to include other metrics. 
In future work, we will test the algorithm monitoring the change of other network metrics to see if we can improve the detection performance. We would like to test the algorithm analyzing the metrics by regions or clusters to obtain more information about the attacker location. Also, we will repeat the experiments reducing the simulator Tx/Rx success ratio. 




§ ACKNOWLEDGMENTS


This study was financed in part by the Coordenação de Aperfeiçoamento de Pessoal de Nível Superior - Brasil (CAPES) - Finance Code 001 and by the ELIOT project (ANR-18-CE40-0030 / FAPESP 2018/12579-7).
Gustavo A. Nunez Segura is supported by Universidad de Costa Rica. 




















































































































IEEEtran




