How to Implement Network Virtualized Security in NS2

To implement Network Virtualized Security in ns2 has contain to incorporate the security characteristics into a virtualized network environment, ensure that traffic is examined, filtered, and secured without depending on traditional, static security appliances. In a virtualized environment, security functions like firewalls, intrusion detection systems (IDS), and encryption mechanisms are abstracted and can be dynamically enforced via virtual machines, containers, or network functions. In NS2, we can mimic Network Virtualized Security by generating virtual security services, like traffic filtering, dynamic firewall rules, or packet inspection, that dynamically adjust according to traffic conditions.

Here is a brief structure to implement the Network Virtualized Security in ns2:

Steps to Implement Network Virtualized Security in NS2:

  1. Set up Network Topology: Generate a topology with nodes, routers, and servers that implements a virtualized environment.
  2. Define Virtual Security Functions: Execute security features like firewalls, packet filtering, or encryption, using scripting to mimic the behaviour of these functions.
  3. Simulate Traffic: Create different kinds of traffic that has malicious traffic, to mimic real-world scenarios that need a security intervention.
  4. Dynamically Enforce Security Policies: Use event-driven scripts to enthusiastically enable or modify security policies according to network conditions or detected threats.
  5. Monitor and Analyze Security: gather and measure network performance data, like packet drops, throughput, and delay, to analyse on how security policies impact the traffic.

Example: Implementing Network Virtualized Security in NS2

In this example, we will execute:

  • A virtual firewall that blocks certain traffic based on source IP or port number.
  • A packet inspection system that filters out malicious traffic.
  • A dynamic security policy that adapt according to traffic behaviour.

Example TCL Script for Network Virtualized Security:

# Create a new NS2 simulator instance

set ns [new Simulator]

# Define output trace file for logging events

set tracefile [open virtualized_security.tr w]

$ns trace-all $tracefile

# Define animation file for NAM (optional)

set namfile [open virtualized_security.nam w]

$ns namtrace-all $namfile

# Create network nodes: Clients, firewall (virtual security), and a server

set client1 [$ns node]   # Client 1 (normal traffic)

set client2 [$ns node]   # Client 2 (malicious traffic)

set firewall [$ns node]  # Virtual firewall (security node)

set server [$ns node]    # Server

# Create duplex links between the nodes

$ns duplex-link $client1 $firewall 10Mb 10ms DropTail

$ns duplex-link $client2 $firewall 10Mb 10ms DropTail

$ns duplex-link $firewall $server 50Mb 10ms DropTail

# Virtual Firewall: Block traffic from Client 2 (malicious) based on source IP or port

proc apply_virtual_firewall {} {

global ns client2 firewall

puts “Applying virtual firewall…”

# Simulate blocking Client 2 (malicious traffic)

$ns at 2.0 “$ns rtmodel-at 2.0 down $client2 $firewall”

$ns at 3.0 “$ns rtmodel-at 3.0 up $client2 $firewall”

}

# Packet Inspection: Drop specific malicious packets (for example, UDP traffic)

proc packet_inspection {} {

global ns client2

puts “Applying packet inspection for malicious traffic…”

# Simulate packet filtering (dropping malicious traffic)

$ns at 1.0 “drop-packet”

}

# Dynamic Security Policy: Adjust firewall rules dynamically based on traffic behavior

proc dynamic_security_policy {} {

global ns client1 client2 firewall

puts “Enforcing dynamic security policies…”

# Dynamically block or allow traffic based on network load or detected patterns

if {[rand] < 0.5} {

puts “Blocking traffic from Client 2”

$ns at 2.5 “$ns rtmodel-at 2.5 down $client2 $firewall”

} else {

puts “Allowing traffic from Client 2”

$ns at 2.5 “$ns rtmodel-at 2.5 up $client2 $firewall”

}

}

# Define traffic for Client 1 (TCP – Normal traffic)

set tcp_client1 [new Agent/TCP]

$ns attach-agent $client1 $tcp_client1

set tcp_sink [new Agent/TCPSink]

$ns attach-agent $server $tcp_sink

$ns connect $tcp_client1 $tcp_sink

set ftp_client1 [new Application/FTP]

$ftp_client1 attach-agent $tcp_client1

# Define traffic for Client 2 (UDP – Malicious traffic)

set udp_client2 [new Agent/UDP]

$ns attach-agent $client2 $udp_client2

set udp_sink [new Agent/Null]

$ns attach-agent $server $udp_sink

$ns connect $udp_client2 $udp_sink

set cbr_client2 [new Application/Traffic/CBR]

$cbr_client2 attach-agent $udp_client2

$cbr_client2 set packetSize_ 1000

$cbr_client2 set rate_ 2Mb

$cbr_client2 set interval_ 0.01

# Schedule the start of traffic

$ns at 0.5 “$ftp_client1 start”

$ns at 0.5 “$cbr_client2 start”

# Apply virtualized security functions

$ns at 1.0 “apply_virtual_firewall”

$ns at 1.5 “packet_inspection”

$ns at 2.0 “dynamic_security_policy”

# Schedule the stop time for traffic

$ns at 4.0 “$ftp_client1 stop”

$ns at 4.0 “$cbr_client2 stop”

# End the simulation at 5.0 seconds

$ns at 5.0 “finish”

# Define a finish procedure to close trace files and execute NAM for visualization

proc finish {} {

global ns tracefile namfile

$ns flush-trace

close $tracefile

close $namfile

exec nam virtualized_security.nam &

exit 0

}

# Run the simulation

$ns run

Explanation of the Script:

  1. Network Topology:
    • The network consists of two clients: Client 1 (normal traffic) and Client 2 (malicious traffic). Both send traffic via a firewall node (simulating a virtual security function) to the server.
  2. Virtual Firewall:
    • A virtual firewall is executed using the apply_virtual_firewall procedure. This blocks traffic from Client 2 (which is malicious) at certain times such as at 2.0 seconds.
  3. Packet Inspection:
    • The packet_inspection procedure mimics a simple packet inspection function that can drop certain packets. For example, it drops UDP traffic to mimic the filtering of malicious traffic.
  4. Dynamic Security Policy:
    • The dynamic_security_policy procedure dynamically adapts the firewall rules. It decides either to block or enable Client 2’s traffic according to particular conditions (in this case, a random condition).
  5. Traffic Simulation:
    • Client 1 generates TCP traffic (normal traffic via FTP) to the server.
    • Client 2 creates UDP traffic (malicious traffic via CBR) to the server.
  6. Security Policy Enforcement:
    • At 1.0 seconds, the virtual firewall initiates to blocking Client 2.
    • At 1.5 seconds, packet inspection filters out malicious traffic.
    • At 2.0 seconds, the dynamic security policy decides either to block or enable Client 2’s traffic.
  7. Simulation Control:
    • The traffic initiates at 0.5 seconds and terminates at 4.0 seconds. The virtual security functions are implemented enthusiastically during the simulation.
  1. Analysing the Impact of Virtualized Security

Once the simulation is done, the trace file (virtualized_security.tr) will contain detailed logs of the network events that have packet transmissions, drops, and firewall enforcement.

  1. a) Packet Drops:

We can measure on how many packets were dropped by the virtual firewall or packet inspection system:

awk ‘$1 == “d” { total_dropped++ } END { print “Packet Drops: “, total_dropped }’ virtualized_security.tr

This command counts the number of packets that were dropped because of the virtualized security functions.

  1. b) Throughput Measurement:

To extent the throughput of TCP traffic (normal traffic), use the following command:

awk ‘$1 == “r” && $4 == “tcp” { total_bytes += $5 } END { print “Throughput: “, total_bytes/5, “bytes/sec” }’ virtualized_security.tr

These estimates the total bytes received over the simulation period and contribute the average throughput.

  1. c) Firewall Effectiveness:

We can measure the firewall’s effectiveness by validating on how well it blocked malicious UDP traffic from Client 2.

awk ‘$1 == “r” && $4 == “udp” { udp_received++ } END { print “UDP Packets Received: “, udp_received }’ virtualized_security.tr

This command counts how many UDP packets from Client 2 reached the server notwithstanding the firewall being in place.

  1. Advanced Virtualized Security Features

To improve the security simulation, we can:

  • Intrusion Detection System (IDS): To mimic IDS that classifies and responds to attacks by enthusiastically updating firewall rules or activating alerts.
  • Encryption: Add encryption to specific traffic types to mimic secure communication among nodes.
  • Real-Time Security Adaptation: Execute real-time traffic analysis that adapts security policies according to the traffic behaviour, like identifying DDoS attacks or unauthorized access attempts.

In this manual, we elaborately shows that the techniques of the Network Virtualized Security and their implementation process on how it performs in ns2 tool without any deception and also we deliver the sample snippets, explanation of the script. Additional details were provided regarding this process.

. We encourage you to reach out to us for timely outcomes. Additionally, our team is prepared to provide you with an in-depth project performance  analysis and thorough explanations. ns2project.com specializes in Network Virtualized Security within the NS2 implementation framework tailored to your needs.