FML: A novel forensics management layer for software defined networks

The detection and protection mechanisms are not accurate enough to investigate the real source of the attack. Therefore, forensic is vital to investigate attack for identifying potential stepping stones of the attack. Software defined networks is a new evolutionary architecture for the network which suffers with numerous attacks on its early deployment phase. To investigate such attacks, this paper introduces a novel forensic layer of software defined network architecture with aim to investigate in-depth network devices and traffic at infrastructure and control tier. The proposed forensic layer “forensics management layer” can be deployed into small and large data center infrastructures because of its generalized working schema. The vertical deployment of the forensics management layer intend to investigate south, east and west bound interfaces to find root cause of the attack.