Korea Advanced Institute of Science and Technology

Sri International

Seungwon Shin

Jinwoo Kim

Jaehyun Nam

Phillip Andrew Porras

Vinod Yegneswaran

Minjae Seo

Yeonkeun Kim

Heedo Kang

Seungsoo Lee

Changhoon Yoon

Seunghyeon Lee

JunSik Seo

Hyeonseong Jo

A protocol state fuzzing method for security of a control plane of a distributed software-defined network is provided. The protocol state fuzzing method includes receiving input alphabets being abstract symbols of a protocol message in an ambusher of a distributed network operating system (NOS), converting the input alphabets into the protocol message, and sending the protocol message to a cluster, monitoring, by the cluster, intercommunication between instances in the distributed NOS, and selecting a set of sequences executable in the cluster and searching a cluster log for an output by executing the sequence to generate an attack result.

Protocol state fuzzing method and system for security of distributed software-defined network control plane

A method, apparatus and system for providing security for a container network having a plurality of containers includes establishing a network stack for each of the plurality of containers of the container network, determining network and policy information from active containers, based on a set of pre-determined inter-container dependencies for the plurality of containers learned from the determined network and policy information, configuring container access in the container network to be limited to only containers of the plurality of containers that are relevant to a respective communication, and configuring inter-container traffic in the container network to be directed only from a source container into a destination container in a point-to-point manner such that exposure of the inter-container traffic to peer containers is prevented.

Security for container networks

The inventive concept described herein relates to a performance analysis apparatus of VNF in a NFV platform and a method thereof that may analyze the performance of VNFs in an NFV platform and a factor that causes the performance to be degraded. A performance analysis apparatus of VNF that analyzes performance of the VNF within a NFV platform includes an NFV environment constituting unit generating a service chain composed of VNFs, using a VNF policy configuration of the VNF and configured to deploy the VNFs corresponding to the service chain in the NFV platform, a performance monitoring unit monitoring internal forms of the VNFs by measuring a performance feature of each component within the NFV platform and a performance feature for the service chain, and an analysis unit specifying a performance degradation VNF that degrades performance in the service chain to derive a cause.

Apparatus for preformance analysis of virtual network functions in network functional virtualization platform and method thereof

The present invention which relates to HoneyNet method, system, and computer program for mitigating link flooding attacks by exposing Honey Topology in SDN (Software Defined Networking) includes a Honey Node detecting unit configured to detect Honey Node Set of static metric and dynamic metric calculating from a SDN controller and OF (OpenFlow), a Honey Topology generating unit configured to arrange Honey Topology by applying probability model for the Honey Node Set, and an access determining unit configured to detect packet-in triggered to a Honey Node, and control transmission of packet to the Honey Topology from the Honey Node.

Honeynet method, system and computer program for mitigating link flooding attacks of software defined network

A method, an apparatus, and a computer program for detecting network anomaly in a distributed software defined networking (SDN) environment. The method includes collecting a control message from a distributed SDN controller and generating network characteristic information using the control message. The network characteristic information includes statistic information or event information included in the control message, new calculation information calculated using the statistic information or the event information, and network stateful information. The method, the apparatus, and the computer program for detecting network anomaly have high utilization, scalability, availability, and distribution properties to a user by supporting a variety of functions for detecting network anomaly in the SDN environment and providing a high-level API to the user.

Method for detecting network anomaly in distributed software defined networking environment, apparatus therefor, and computer program therefor

Disclosed are a modular controller and an operating method thereof. An operating method of a modular controller having a plurality of modules in a software-defined network environment includes generating a first event including a message that is received from a network device, transmitting the first event to an event handler, transmitting the first event to the plurality of modules from the event handler, determining whether the first event is identical to a target event in event type through the plurality of modules that receive the first event, and performing a function of a first module, which corresponds to the identity between the first event and the target event, by using the first event. A network manager is able to easily form a controller with various functions such as performance enhancement and security enhancement at need, facilitating combination and separation of different modules in a controller.

Modular controller in software-defined networking environment and operating method thereof

A method, an apparatus, and a computer program for analyzing performance of a network application program are provided. The method for analyzing performance of a network application program which operates at a controller in a software defined networking (SDN) environment may include receiving identification information of the application program, flow information, and network configuration information of a network controlled by the controller, emulating a virtual network using the network configuration information, executing the virtual network using the flow information, measuring a time, when a virtual controller processes a flow, on a function basis, extracting information corresponding to the identification information of the application program from the measured result, and analyzing a performance degradation factor of the application program using the extracted information. According to an embodiment, a network manager automatically searches for a critical path and a hotspot using a conventional profiling scheme.

Method for analyzing performance of network application program in software defined networking environment, apparatus therefor, and computer program therefor

Growing community of inventors

Daejeon, South Korea

Seungwon Shin