Digital forensics framework for intent-based networking over software-defined networks

Intent-based networking (IBN) is an evolutionary paradigm. Its recent adaptation has been increased substantially by Cloud Service Providers, Telecom, and network operators due to its automation capabilities. However, there are certain challenges specifically related to security. One of the core challenges is the lack of a forensic framework for identifying different incidents inside IBN. In this paper, we have proposed a framework to perform the forensics investigation of an IBN inside a software defined networking (SDN) environment. This framework is based on the steps of the forensics investigation process and consists of four modules: Identification, Collection, Analysis, and Reporting. Identification includes logs searching for specific events. Logs are searched through keywords, Time, Date, and Event ID. Pieces of evidence are collected from the Application, Control, and Infrastructure Layers of SDN by exploiting the default log file of ONOS and third-party tools. The analysis is performed using manual analysis of the raw log entries and third-party tools such as Loki/Grafana. This framework is implemented by utilizing ONOS as an SDN controller. The emulator used for creating the experimental network is Mininet on two different use cases: Normal Traffic Routing and Redirection of Attack Traffic, to analyze the difference in log files generated by the SDN controller. These files are manually analyzed and sent to the Loki–Grafana server for better analysis, visualization, and real-time monitoring of IBN logs. Assessment of the obtained experimental results is based on the states defined in the Intent Framework of ONOS.