Abstract:SDN improves the flexibility and programmability of the network. However, malicious attacks caused by potential vulnerabilities and backdoors can easily lead to data and rule tampering in the network. To address this problem, this paper proposes an endogenous secure SDN network framework based on multipath resilient routing (MRR). MRR includes multipath comparing forwarding, multipath weighted forwarding, and multipath random forwarding. The framework ensures the correctness of flow rules and data content by dynamically comparing the consistency of multi-heterogeneous path data within a certain period, and multipath can also achieve load balance by weighted forwarding. In the MRR framework, we also present an intermediate information feedback mechanism based on encryption authentication and give a mathematical model to evaluate it. This mechanism can accurately identify and dynamically repair malicious switches. Simulation evaluation and prototype system test show that this framework can achieve high accuracy of flow transmission and high availability of system. At the same time, multipath comparing forwarding will bring some performance costs such as delay, bandwidth, and jitter at initial and attacking time. However, when the appropriate forwarding mode and reasonable period T are selected, the proportion of delay introduced by comparing and ruling can be less than 10%, and the average bandwidth of mixed forwarding is almost the same as traditional multipaths', such as we can guarantee 25% multipath comparing forwarding when the bandwidth requirement is 250 M in prototype system.

DSPHR: A Dynamic SDN-Based Port Hopping Routing Technique for Mitigating SD-WSN Attacks

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Combination Attacks and Defenses on SDN Topology Discovery.

Denial of Service Attacks Detection in Software-Defined Wireless Sensor Networks

Software Defined Network Routing in Wireless Sensor Network

Multipath Resilient Routing for Endogenous Secure Software Defined Networks.

Detection and Defense Against Network Isolation Attacks in Software‐defined Networks

A Software Defined Network Routing in Wireless Multihop Network

Dynamic-Scheduling Mechanism of Controllers Based on Security Policy in Software-Defined Network

Adaptive Suspicious Prevention for Defending DoS Attacks in SDN-Based Convergent Networks

SDNManager: A Safeguard Architecture for SDN DoS Attacks Based on Bandwidth Prediction.

Dynamic Defense Strategy Against DoS Attacks Over Vehicular Ad Hoc Networks Based on Port Hopping.

SD-Anti-DDoS: Fast and efficient DDoS defense in software-defined networks

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

Attacking Network Isolation in Software-Defined Networks: New Attacks and Countermeasures

PSSPR: A source location privacy protection scheme based on sector phantom routing in WSNs

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane

SDORP: SDN based Opportunistic Routing for Asynchronous Wireless Sensor Networks

A Secure Routing Protocol with Trust and Energy Awareness for Wireless Sensor Network

Using Network Processor to Establish Security Agent for AODV Routing Protocol

Detection and Mitigation of DoS Attacks in Software Defined Networks