Abstract

Software Defined Network (SDN) is a modern network architecture that has a centralized controller. It differs from traditional networks for being more flexible and programmable due to separation of the control plane from the data plane. However, this paradigm faces the danger of Distributed Denial of Service (DDoS) attacks which are one of the most interesting subjects in the security field because of the widespread use of these attacks. In this thesis, two algorithms are proposed to protect networks and servers from these attacks in SDN based on entropy. The first algorithm is Lower Entropy Detection (LED) which it is using the entropy to isolate the suspected traffic at a backup server outside the data center to distribute the huge amount of traffic in more than one server and avoid congestion on switches. The results of this algorithm are introduced using three scenarios to show an increase in the throughput of the server about 16% and reduce the CPU load to 8.7% during attacks compared with the direct block mitigation method, which was mostly used with entropy detection in previous research. The second algorithm is Entropy and Q-learning algorithm (EQD) which is using Reinforcement Learning to detect the DDoS attacks based on entropy. It is redirecting the traffic to the edge of the data center through a second controller to a honeypot server. This algorithm results are obtained by a number of scenarios that show how to distinguish between DDoS attacks and flash crowds based on MAC address and time delay. Moreover, there is an increase about 50% in the throughput of the server and reduce the CPU load to 23.7% compared with entropy detection in previous research.

This thesis uses the mininet emulator for network topology, real SDN controller python network operating system (POX) to manage the network, and Open V Switch which is supporting OpenFlow protocol. The Scapy and Hping3 are tools used to create normal and DDoS attacks. Moreover, measurement tools are Iperf, Wireshark, Analysis of Variance (ANOVA), and Least Significant Difference (LSD).

ABSTRACT

The internet of things (IoT) creates one extensive network of connected and communicating devices. This will have a great impact on businesses and the financial sector. The revolution of payment systems presents chances and a new approach for consumers to make payments in the future. For example, an autonomous payment system may let the consumer pay for different aspects of life. The current problem is that electronic payment devices connected to Internet devices are limited in our time because it is modern technology. Some people may find it challenging to deal with them and prefer to use cash instead of bank accounts, which may lead to a lack of financial liquidity, this causes a weak economy for countries instead of investing it. In addition to the fact that paper financial transactions cause delays and the consumption of human resources.

The current thesis will design and implement an IoT prototype for autonomous payment on the Internet of Everything (IoE) environment and propose an enhanced user authentication solution that utilizes user biometrics as an authentication factor. The tools used are IoT cloud services, a microcontroller (Node MCU), and raspberry pi3 as an access point to the main server.

The result of the implementation generates a flexible system that can be applied in several scenarios: online purchasing, for citizens, use to pay bills online (electricity bills, water bills, and taxes bills) and used the system for university payments in different places. In addition to applying an intelligent algorithm to predict future bills with budget management. Also, it uses a secure database with latency servers less than (2 seconds). This thesis focus on providing high protection through three levels of security, the smart card radio-frequency identification (RFID), password, and biometrics (such as fingerprint and face). The optimal results obtained from several tests and comparisons between them, achieved system accuracy reached (90-95%) when applying biometrics in the authentication process.