A Probabilistic Data Structures-Based Anomaly Detection Scheme for Software-Defined Internet of Vehicles

Internet of Vehicles (IoV) has escalated the movement of big data across moving vehicles which create a huge burden on the network infrastructure. In IoV environment, effective handling of streaming data has to face various challenges like; traffic monitoring, flow management, re-configuration and security. Software-defined networks (SDN) provides improved flexibility, and centralized control of the network to overcome (almost) the above-mentioned challenges. However, it can lead to an easy target (node or controller) for malicious agents. So, to detect the anomalous behaviour of the nodes in the IoV environment, a hybrid approach using probabilistic data structures is proposed which works in the following phases. In phase I, a traffic monitoring scheme using Count-Min-Sketch is designed to identify the suspicious nodes. In phase II, to detect an anomaly, a Bloom filter-based control scheme is used for signature verification of suspicious nodes. In phase III, a Quotient filter is used for fast and efficient storage of malicious nodes. In phase IV, to detect the super points (malicious hosts that are connected to a large number of destinations), a Hyperloglog counter is used to measure the cardinality of each flow passing through the switches. The proposed scheme has been evaluated in a simulated environment. The results obtained depict that the proposed scheme is faster, accurate, and efficient concerning detection ratio and false-positive ratio.

I. Introduction

Internet of Vehicles (IoV) is one of the emerging technologies of recent times which comprises of a large number of connected vehicles. Such vehicles, equipped with computing and transmitting capabilities, are capable of intelligent processing and control of various smart applications to provide a better quality of experience [1]. However, the data generated by these vehicles moving in a smart city has escalated to a higher level. Such an increase in the data traffic associated with the IoV-based applications has elevated the challenges of underlying network architecture. Although, the evolution of Internet has led to the creation of a digital society, where almost everything is connected and is accessible from anywhere. But, despite of the widespread adoption, traditional IP networks are complex and difficult to manage in IoV environment. In traditional networks, there are hardware devices (such as routers, switches, etc.) are vertically integrated where the control plane (that decides how to handle network traffic) and the data plane (that forwards traffic according to the decisions made by the control plane) are bundled together, thus reducing flexibility [2], [3]. Therefore, in IoV environment, it is difficult to configure each network device separately, and then reconfigure it to respond to faults, and load variations. Moreover, the rate of change in configuration has created a huge amount of complexity in administering these network devices. A network administrator has to connect to each device to change the configuration, which generates a lot of overhead.