E‐Replacement: Efficient scanner data collection method in P4‐based software‐defined networks

• Published in: International journal of network management 2021-11, Vol.31 (6), p.n/a
• Main Authors: Cai, Yun‐Zhan, Lin, Ting‐Yu, Wang, Yu‐Ting, Tuan, Ya‐Pei, Tsai, Meng‐Hsun
• Format: Article
• Language: English
• Subjects: Anomalies; Data collection; Internet of Things; Malware; Network latency; Performance degradation; Scanners; Scanning; Software; Software-defined networking; Switches; Target detection
• ISSN: 1055-7148; 1099-1190
• DOI: 10.1002/nem.2162

Summary Internet of things (IoT) botnets such as Mirai are rampant in the past years. Port scanning is a well‐known behavior of botnets for searching targets in networks. To detect port scanning, a detector requires network statistics with high discriminatory power. In P4‐based software‐defined network (SDN), switches take charge of recording characteristics about scanning behaviors, and controllers pull the statistics from the switches periodically for anomaly detection. Given storage resources in switches are limited, we proposed a scanner data collection method, 0‐Replacement, in P4‐based SDN to efficiently collect scanner data and improve the detection rate. 0‐Replacement, however, does not consider performance degradation caused by the hash collision. In this paper, we combine the conception of Hashpipe with 0‐Replacement and propose a new scanner data collection method named E‐Replacement. By leveraging the conception of Hashpipe, E‐Replacement can mitigate the performance degradation caused by the hash collision. Through simulations, we show that E‐Replacement improves the detection rate by up to 6.73% and 210.82% compared to 0‐Replacement and the traditional sample and hold method, respectively. Besides, E‐Replacement improves the precision by around 528.2% compared to the count‐min sketch and k‐ary sketch methods. The memory usage in E‐Replacement is the same as 0‐Replacement. In simulations, E‐Replacement can detect around 93.4% of scanners in a class B network with only 4.02‐Mb SRAM. After implementing E‐Replacement on a software P4 switch, BMv2, we observe the extra forwarding latency for E‐Replacement is not greater than a millisecond. E‐Replacement collects more anomaly data compared to 0‐Replacement. Up to 93.4% scanners in a class B network are identified with only 4.02‐Mb SRAM.