CoChat
Sign Up
Cited by 66Network Security and Intrusion DetectionSoftware-Defined Networks and 5GNetwork Packet Processing and Optimization

Cloud-Based Zero Trust Access Control Policy: An Approach to Support Work-From-Home Driven by COVID-19 Pandemic

Open access
Mandal, Sudakshina, Khan, Danish Ali, Jain, Sarika·2021·New Generation Computing
DOI 10.1007/s00354-021-00130-6PMC PMC8239485
Open this paper in CoChat — free accountOpen PDF

Abstract

The ubiquitous cloud computing services provide a new paradigm to the work-from-home environment adopted by the enterprise in the unprecedented crisis of the COVID-19 outbreak. However, the change in work culture would also increase the chances of the cybersecurity attack, MAC spoofing attack, and DDoS/DoS attack due to the divergent incoming traffic from the untrusted network for accessing the enterprise's resources. Networks are usually unable to detect spoofing if the intruder already forges the host's MAC address. However, the techniques used in the existing researches mistakenly classify the malicious host as the legitimate one. This paper proposes a novel access control policy based on a zero-trust network by explicitly restricting the incoming network traffic to substantiate MAC spoofing attacks in the software-defined network (SDN) paradigm of cloud computing. The multiplicative increase and additive decrease algorithm helps to detect the advanced MAC spoofing attack before penetrating the SDN-based cloud resources. Based on the proposed approach, a dynamic threshold is assigned to the incoming port number. The self-learning feature of the threshold stamping helps to rectify a legitimate user's traffic before classifying it to the attacker. Finally, the mathematical and experimental results exhibit high accuracy and detection rate than the existing methodologies. The novelty of this approach strengthens the security of the SDN paradigm of cloud resources by redefining conventional access control policy.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1007/s00354-021-00130-6

Cites

17 of 17 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 23

  1. [3]Yu, J., Kim, E., Kim, H., Huh, J.: A framework for detecting MAC and IP spoofing attacks with network characteristics. In: 2016 International conference on software security and assurance (ICSSA), pp. 49–53 (2016)
  2. [4]Osanaiye, O.A.: Short paper: IP spoofing detection for preventing DDoS attack in Cloud Computing. In: 2015 18th International conference on intelligence in next generation networks, pp. 139–141 (2015)
  3. [5]Jian, T., Rendon, B. C., Gritsenko, A., Dy, J., Chowdhury, K., Ioannidis, S.: MAC ID spoofing-resistant radio fingerprinting. In: 2019 IEEE global conference on signal and information processing (GlobalSIP), Ottawa, ON, Canada, pp. 1–5 (2019)
  4. [6]Gajbhiye, Y., Daruwala, R.D.: RSS-based spoofing detection and localization algorithm in IEEE 802.11 wireless networks. In: 2016 International conference on communication and signal processing (ICCSP), Melmaruvathur, Tamil Nadu, India, pp. 1642–1645 (2016)
  5. [7]Ahmad, S., Mehfuz, S., Beg, J.: Securely work from home with CASB policies under COVID-19 pandemic: a short review. In: 2020 9th International conference system modeling and advancement in research trends (SMART), pp. 109–114 (2020)
  6. [8]DeCusatis, C., Liengtiraphan, P., Sager, A., Pinelli, M.: Implementing zero trust cloud networks with transport access control and first packet authentication. In: 2016 IEEE international conference on smart cloud (SmartCloud), New York, NY, USA, pp. 5–10 (2016)
  7. [13]Aishwarya, R., Malliga, S.: Intrusion detection system- an efficient way to thwart against Dos/DDos attack in the cloud environment. In: 2014 International conference on recent trends in information technology, pp. 1–6 (2014)
  8. [14]Durairaj, M., Persia, A.: Theoretical framework of the algorithm to thwart MAC spoofing DoS attack in wireless local area infrastructure network. In: Padma Suresh, L., Dash, S.S. Panigrahi, B.K. (eds.) Artificial intelligence and evolutionary algorithms in engineering systems. Advances in Intelligent Systems and Computing, pp. 99–107. Springer India, New Delhi (2015)
  9. [15]Li, R., Liu, Q., Wang, M., We, X.: A novel framework for application of cloud computing in wireless mesh networks. In: 2014 Ninth international conference on P2P, parallel, grid, cloud and internet computing, pp. 448–452 (2014)
  10. [20]Benzaïd, C., Boulgheraif, A., Dahmane, F.Z., Al-Nemrat, A., Zeraoulia, K.: Intelligent detection of MAC spoofing attack in 802.11 network. In: Proceedings of the 17th international conference on distributed computing and networking, ICDCN ’16, New York, NY, USA, Association for Computing Machinery, pp. 1–5 (2016)
  11. [21]Bekerman, D., Shapira, B., Rokach, L., Bar, A.: Unknown malware detection using network traffic classification. In: 2015 IEEE conference on communications and network security (CNS), Florence, Italy, pp. 134–142 (2015)
  12. [22]Indre, I., Lemnaru, C.: Detection and prevention system against cyber attacks and botnet malware for information systems and Internet of Things. In: 2016 IEEE 12th international conference on intelligent computer communication and processing (ICCP), Cluj-Napoca, Romania, pp. 175–182 (2016)
  13. [25]Eidle, D., Ni, S.Y., DeCusatis, C., Sager, A.: Autonomic security for zero trust networks. In: 2017 IEEE 8th annual ubiquitous computing, electronics and mobile communication conference (UEMCON), New York City, NY, pp. 288–293 (2017)
  14. [26]Prasse, P., Machlica, L., Pevný, T., Havelka, J., Scheffer, T.: Malware detection by analysing network traffic with neural networks. In: 2017 IEEE security and privacy workshops (SPW), pp. 205–210 (2017)
  15. [27]Li, K., Chen, R., Gu, L., Liu, C., Yin, J.: A method based on statistical characteristics for detection malware requests in network traffic. In: 2018 IEEE third international conference on data science in cyberspace (DSC), Guangzhou, pp. 527–532 (2018)
  16. [29]Wang, J., Yang, L., Wu, J., Abawajy, J.H.: Clustering analysis for malicious network traffic. In: 2017 IEEE international conference on communications (ICC), Paris, France, pp. 1–6 (2017)
  17. [30]DeCusatis, C., Liengtiraphan, P., Sager, A.: Advanced intrusion prevention for geographically dispersed higher education cloud networks. In: Auer, M.E., Zutin, D.G. (eds.) Online engineering & internet of things, vol. 22, pp. 132–143. Series Title: Lecture Notes in Networks and Systems. Springer International Publishing, Cham (2018)
  18. [33]Vijayakumar, R., Selvakumar, K., Kulothungan, K., Kannan, A.: Prevention of multiple spoofing attacks with dynamic MAC address allocation for wireless networks. In: 2014 International Conference on Communication and Signal Processing, Melmaruvathur, India, pp. 1635–1639 (2014)
  19. [41]Liu, S.: MAC spoofing attack detection based on physical layer characteristics in wireless networks. In: 2019 IEEE international conference on computational electromagnetics (ICCEM), Shanghai, China, pp. 1–3 (2019)
  20. [44]Mell, P., Harang, R.: Limitations to threshold random walk scan detection and mitigating enhancements. In: 2013 IEEE Conference on Communications and Network Security (CNS), National Harbor, MD, USA, pp. 332–340 (2013)
  21. [45]Nychis, G., Sekar, V., Andersen, D.G., Kim, H., Zhang, H.: An empirical evaluation of entropy-based traffic anomaly detection. In: Proceedings of the 8th ACM SIGCOMM conference on Internet measurement conference - IMC ’08, Vouliagmeni, Greece, p. 151. ACM Press (2008)
  22. [46]Sharma, S., Sahu, S.K., Jena, S.K.: On selection of attributes for entropy based detection of DDoS. In: 2015 International Conference on Advances in Computing, Communications and Informatics (ICACCI), pp. 1096–1100 (2015)
  23. [47]Wagner, A., Plattner, B.: Entropy based worm and anomaly detection in fast IP networks. In: Proceedings of IEEE International Workshop on Enabling Technologies, Infrastructures for Collaborative Enterprises (2005)

Cited by

Sorted by citations

Authors
Mandal, S., Khan, D. A., & Jain, S.
Affiliations
  • National Institute of Technology Jamshedpur (IN)
  • National Institute of Technology Kurukshetra (IN)
Corresponding author
Khan, Danish Ali
ORCID
Venue
New Generation Computing
Publisher
Springer Science and Business Media LLC
Published
2021-06-29
Volume
39
Issue
3-4
Pages
599-622
ISSN
  • 0288-3635 (ISSN-L)
  • 1882-7055
DOI
10.1007/s00354-021-00130-6
PMC
PMC8239485
OpenAlex
W3174106839
Cited by
66
References
17
Citations by year
2026: 13 · 2025: 12 · 2024: 19 · 2023: 13 · 2022: 8 · 2021: 1
FWCI
4.37
Type
journal article
Language
en
Open access
Licence
Locations
  • New Generation Computing (publishedVersion)
  • PubMed Central (publishedVersion)
  • PubMed (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
  • Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
Keywords
zero-trust architecture, access control policies, software-defined networking, cloud security, working from home, COVID-19 pandemic, DDoS attack detection, dynamic threshold, network traffic classification

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review