Performance Analysis of Software-Defined Networks to Mitigate Private VLAN Attacks.

Area of Science:

• Computer Science
• Network Security
• Network Engineering

Background:

• Defence-in-depth (DiD) is a network security strategy involving layering and segmentation, often using VLANs or PVLANs.
• Traditional DiD methods struggle with scalability in large corporate networks.
• Software-defined networking (SDN) presents a promising solution for advanced network segmentation.

Purpose of the Study:

• To emulate a corporate network scenario using private virtual local area networks (PVLANs).
• To conduct a comparative performance analysis of network defense strategies.
• To evaluate mitigation techniques against a known PVLAN attack.

Main Methods:

• Emulation of a corporate network using PVLANs.
• Execution of a simulated PVLAN attack within the emulated network.
• Comparative analysis of mitigation strategies: Access Control Lists (ACLs) versus SDN.

Main Results:

• Performance metrics including CPU/memory usage, communication delay, packet loss, and power consumption were analyzed.
• Both ACLs and SDN mitigation strategies were tested under various network conditions.
• The SDN approach demonstrated superior performance, especially in oversubscribed network designs.

Conclusions:

• SDN significantly enhances network segmentation capabilities for large-scale environments.
• SDN offers a more efficient and scalable solution for network defense compared to traditional ACLs.
• The findings highlight SDN's potential to improve security and performance in corporate networks.