Abstract:Software Defined Networking (SDN) has evolved to revolutionize next-generation networks, offering programmability for on-the-fly service provisioning, primarily supported by the OpenFlow (OF) protocol. The limited storage capacity of Ternary Content Addressable Memory (TCAM) for storing flow tables in OF switches introduces vulnerabilities, notably the Low-Rate Flow Table Overflow (LOFT) attacks. LOFT exploits the flow table's storage capacity by occupying a substantial amount of space with malicious flow, leading to a gradual degradation in the flow-forwarding performance of OF switches. To mitigate this threat, we propose FloRa, a machine learning-based solution designed for monitoring and detecting LOFT attacks in SDN. FloRa continuously examines and determines the status of the flow table by closely examining the features of the flow table entries. Upon detecting an attack FloRa promptly activates the detection module. The module monitors flow properties, identifies malicious flows, and blacklists them, facilitating their eviction from the flow table. Incorporating novel features such as Packet Arrival Frequency, Content Relevance Score, and Possible Spoofed IP along with Cat Boost employed as the attack detection method. The proposed method reduces CPU overhead, memory overhead, and classification latency significantly and achieves a detection accuracy of 99.49%, which is more than the state-of-the-art methods to the best of our knowledge. This approach not only protects the integrity of the flow tables but also guarantees the uninterrupted flow of legitimate traffic. Experimental results indicate the effectiveness of FloRa in LOFT attack detection, ensuring uninterrupted data forwarding and continuous availability of flow table resources in SDN.

Flowfence: a denial of service defense system for software defined networking

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

TableGuard: A Novel Security Mechanism Against Flow Table Overflow Attacks in SDN.

Flow Table Saturation Attack Against Dynamic Timeout Mechanisms in SDN

Detection and Mitigation of DoS Attacks in Software Defined Networks

AdaFlow: Adaptive Control to Improve Availability of OpenFlow Forwarding for Burst Quantity of Flows.

Flooddefender: Protecting Data and Control Plane Resources under Sdn-Aimed Dos Attacks

A Deep ConvNet-Based Countermeasure to Mitigate Link Flooding Attacks Using Software-Defined Networks

FloodShield: Securing the SDN Infrastructure Against Denial-of-Service Attacks.

NetFence: Preventing Internet Denial of Service from Inside Out

rDefender: A Lightweight and Robust Defense Against Flow Table Overflow Attacks in SDN

DoS attack defense framework for SDN infrastructure

FADM: DDoS Flooding Attack Detection and Mitigation System in Software-Defined Networking

FlowCloak: Defeating Middlebox-Bypass Attacks in Software-Defined Networking.

An elastic intrusion detection system for software networks

SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane.

DoSGuard: Mitigating Denial-of-Service Attacks in Software-Defined Networks

On Denial of Service Attacks in Software Defined Networks

FloRa: Flow Table Low-Rate Overflow Reconnaissance and Detection in SDN

MinDoS: A Priority-Based SDN Safe-Guard Architecture for DoS Attacks.

Software defined networking flow admission and routing under minimal security constraints