Anomaly detection for software defined datacenter networks using X-Pack

Abstract

The global data center market is growing as more and more enterprises are increasingly adopting cloud computing services and applications. Data centers are evolving towards highly virtualized architectures where transformation to software defined network (SDN) based solutions provides benefits in terms of network programmability, automation, and flow visibility. With the benefits, the need for securing network becomes essential as many critical applications are hosted on to such networking platforms. Anomaly detection is a continuous process of monitoring the traffic pattern and alerting the user about the anomalies if detected. For such real time analysis NoSQL and relational databases are less efficient. This paper proposes a framework for anomaly detection and alerting system using Elasticsearch database for SDN. Traffic patterns generated from SDN devices are continuously monitored and predefined actions are taken immediately if an anomaly is detected. The proof of concept is implemented in NOKIAs Nuage Networks Laboratory and the results showed a real time anomaly detection and took relevant actions within minimum time.