DoSDefender: A Kernel-Mode TCP DoS Prevention in Software-Defined Networking

Dongbin Wang,Yu Zhao,Hui Zhi,Dongzhe Wu,Weihan Zhuo,Yueming Lu,Xu Zhang

DOI: https://doi.org/10.3390/s23125426

IF: 3.9

2023-06-08

Sensors

Abstract:The limited computation resource of the centralized controller and communication bandwidth between the control and data planes become the bottleneck in forwarding the packets in Software-Defined Networking (SDN). Denial of Service (DoS) attacks based on Transmission Control Protocol (TCP) can exhaust the resources of the control plane and overload the infrastructure of SDN networks. To mitigate TCP DoS attacks, DoSDefender is proposed as an efficient kernel-mode TCP DoS prevention framework in the data plane for SDN. It can prevent TCP DoS attacks from entering SDN by verifying the validity of the attempts to establish a TCP connection from the source, migrating the connection, and relaying the packets between the source and the destination in kernel space. DoSDefender conforms to the de facto standard SDN protocol, the OpenFlow policy, which requires no additional devices and no modifications in the control plane. Experimental results show that DoSDefender can effectively prevent TCP DoS attacks in low computing consumption while maintaining low connection delay and high packet forwarding throughput.

engineering, electrical & electronic,chemistry, analytical,instruments & instrumentation

What problem does this paper attempt to address?

The paper attempts to address the issue of how to effectively defend against Transmission Control Protocol (TCP)-based Denial of Service (DoS) attacks in Software-Defined Networking (SDN). Specifically, the paper focuses on two main challenges:

1. **How to effectively prevent TCP DoS attacks from entering the SDN?**
- In SDN, TCP DoS attack traffic is mixed with normal traffic, making it difficult to distinguish between them. Therefore, simply discarding packets that cause table-miss will result in normal traffic being discarded as well. The paper proposes the need for a method to differentiate between genuine connection attempts and forged connection attempts, and to filter out packets from attack connections.

2. **How to efficiently handle TCP DoS attacks while maintaining low computational overhead, low connection latency, and high packet forwarding throughput?**
- TCP DoS attacks cause a large number of table-misses, consuming resources of the control plane and data plane, thereby reducing the performance of the SDN. The paper proposes the need for a method to effectively defend against TCP DoS attacks without significantly increasing computational overhead, while maintaining low connection latency and high packet forwarding throughput.

To address these challenges, the paper proposes a kernel-mode TCP DoS defense framework called DoSDefender. DoSDefender prevents TCP DoS attacks from entering the SDN by validating the legitimacy of connections, migrating connections, and relaying packets in the kernel space. The framework complies with the OpenFlow standard and does not require additional devices or modifications to the control plane. Experimental results show that DoSDefender can effectively defend against TCP DoS attacks with low computational overhead, while maintaining low connection latency and high packet forwarding throughput.