Abstract:Software-defined networking (SDN) enables dynamic management and flexible network control by employing reactive rule installation. Due to high power consumption and cost, current OpenFlow switches only support a limited number of flow rules, which is a major limitation for deploying massive fine-grained policies. This bottleneck can be exploited by attackers to launch saturation attacks to overflow the flow table. Moreover, flow table overflow can occur in the absence of malicious attackers. To cope with this, researchers have developed many proposals to relieve the load under benign conditions. Among them, the dynamic timeout mechanism is one of the most effective solutions. We notice that when the SDN controller adopts dynamic timeouts, existing flow table saturation attacks can fail, or even expose the attackers, due to inaccurate inferring results. In this paper, we extract the common features of dynamic timeout strategies and propose an advanced flow table saturation attack. We explore the definition of flow rule lifetime and use a timing-based side-channel to infer the timeout of flow rules. Moreover, we leverage the dynamic timeout mechanisms to proactively interfere with the decision of timeout values and perform an attack. We conduct extensive experiments in various settings to demonstrate its effectiveness. We also notice that some replacement strategies work differently when the controller assigns dynamic timeouts. The experiment results show that the attack can incur significant network performance degradation and carry out the attack in a stealthy manner.

Distributed denial of service (DDoS) attack mitigation in software defined network (SDN)-based cloud computing environment

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

TableGuard: A Novel Security Mechanism Against Flow Table Overflow Attacks in SDN.

Flow Table Saturation Attack Against Dynamic Timeout Mechanisms in SDN

Flow Anomaly Telemetry Driven by Programmable Data Plane

DDoS attack protection in the era of cloud computing and Software-Defined Networking

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane

Efficient Distributed Denial-of-Service Attack Defense in SDN-Based Cloud

On Denial of Service Attacks in Software Defined Networks

SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane.

Defense mechanisms against DDoS attack based on entropy in SDN-cloud using POX controller

HTTP DDoS Flooding Attack Mitigation in Software-Defined Networking

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

Detecting DDoS Attack on SDN Due to Vulnerabilities in OpenFlow

Detection and Mitigation of DoS Attacks in Software Defined Networks

A comprehensive survey on DDoS detection, mitigation, and defense strategies in software-defined networks

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

LineSwitch: Efficiently Managing Switch Flow in Software-Defined Networking while Effectively Tackling DoS Attacks

DDoS Defense Mechanism Based on Software Defined Network

SD-Anti-DDoS: Fast and efficient DDoS defense in software-defined networks

Source-Based Defense Against DDoS Attacks in SDN Based on sFlow and SOM