Employing invariants for anomaly detection in software defined networking based industrial internet of things

The use of Software-Defined Networking (SDN) in the communications of the Industrial Internet of Things (IIoT) demands more comprehensive solutions than those developed to date. The lack of an SDN solution applicable in diverse IIoT scenarios is the problem addressed in this article. The main cause of this problem is the lack of integration of a set of aspects that should be considered in a comprehensive SDN solution. To contribute to the solution of this problem, a review of the literature is conducted in this article, identifying the main requirements for industrial networks nowadays as well as their solutions through SDN. This review indicates that aspects such as security, independence of the network technology used, and network centralized management can be tackled using SDN. All the advantages of this technology can be obtained through the implementation of the same solution, considering a set of aspects proposed by the authors for the implementation of SDNs in IIoT networks. Additionally, after analyzing the main features and advantages of several architectures proposed in the literature, an architecture with distributed network control is proposed for all SDN network scenarios in IIoT. This architecture can be adapted through the inclusion of other necessary elements in specific scenarios. The distributed network control feature is relevant here, as it prevents a single fault-point for an entire industrial network, in exchange for adding some complexity to the network. Finally, the first ideas for the selection of an SDN controller suitable for IIoT scenarios are included, as this is the core element in the proposed architecture. The initial proposal includes the identification of six controllers, which correspond to different types of control planes, and ten characteristics are defined for selecting the most suitable controller through the Analytic Hierarchy Process (AHP) method. The analysis and proposal of different fundamental aspects for the implementation of SDNs in IIoT in this article contribute to the development of a comprehensive solution that is not focused on the characteristics of a specific scenario and would, therefore, be applicable in limited situations.

Download Full-text

A multi-factor integration-based semi-supervised learning for address resolution protocol attack detection in SDIIoT

International Journal of Distributed Sensor Networks ◽

10.1177/15501477211059940 ◽

2021 ◽

Vol 17 (12) ◽

pp. 155014772110599

Author(s):

Zhong Li ◽

Huimin Zhuang

Keyword(s):

Internet Of Things ◽

Supervised Learning ◽

Software Defined Networking ◽

Training Data ◽

Detection Methods ◽

Industrial Internet Of Things ◽

Data Set ◽

Correct Judgment ◽

Industrial Internet ◽

Address Resolution Protocol

Nowadays, in the industrial Internet of things, address resolution protocol attacks are still rampant. Recently, the idea of applying the software-defined networking paradigm to industrial Internet of things is proposed by many scholars since this paradigm has the advantages of flexible deployment of intelligent algorithms and global coordination capabilities. These advantages prompt us to propose a multi-factor integration-based semi-supervised learning address resolution protocol detection method deployed in software-defined networking, called MIS, to specially solve the problems of limited labeled training data and incomplete features extraction in the traditional address resolution protocol detection methods. In MIS method, we design a multi-factor integration-based feature extraction method and propose a semi-supervised learning framework with differential priority sampling. MIS considers the address resolution protocol attack features from different aspects to help the model make correct judgment. Meanwhile, the differential priority sampling enables the base learner in self-training to learn efficiently from the unlabeled samples with differences. We conduct experiments based on a real data set collected from a deepwater port and a simulated data set. The experiments show that MIS can achieve good performance in detecting address resolution protocol attacks with F1-measure, accuracy, and area under the curve of 97.28%, 99.41%, and 98.36% on average. Meanwhile, compared with fully supervised learning and other popular address resolution protocol detection methods, MIS also shows the best performance.

Download Full-text