Abstract:Data centers, the critical infrastructure underpinning Cloud computing, often employ Software-Defined Networks (SDN) to manage cluster, wide-area and enterprise networks. As the network forwarding in SDN is dynamically programmed by controllers, it is crucial to ensure that the controller intent is correctly translated into underlying forwarding rules. Therefore, detecting and locating forwarding anomalies in SDN is a fundamental problem in production networks. Existing research proposals, roughly categorized into probing-based, packet piggybacking-based, and flow statistics analysis-based, either impose significant overhead or do not provide sufficient coverage for certain forwarding anomalies. In this article, we propose ${sf FADE}$FADE, a controllable and passive measuring scheme to simultaneously deliver detection efficiency and accuracy. ${sf FADE}$FADE first analyzes the entire network topology and flow rules, and then computes a minimal set of flows that can cover all forwarding rules. For each selected network flow, ${sf FADE}$FADE decides the optimal number of monitoring positions on its path (much less than total number of hops), and installs dedicated rules to collect flow statistics. ${sf FADE}$FADE controls the installation and expiration of these rules, along with unique flow labels, to guarantee the accuracy of collected statistics, based on which ${sf FADE}$FADE algorithmically decides whether a forwarding anomaly is detected, and if so it further locates the anomaly. On top of ${sf FADE}$FADE, we propose ${sf iFADE}$iFADE (a more scalable version of ${sf FADE}$FADE) to further optimize the usage and deployment of dedicated measurement rules. ${sf iFADE}$iFADE achieves over 40 percent rule reduction compared with ${sf FADE}$FADE . We implement a prototype of both

Identify Abnormal Packet Loss in Selective Forwarding Attacks

CHEMAS: Identify suspect nodes in selective forwarding attacks

An Efficient Countermeasure to the Selective Forwarding Attack in Wireless Sensor Networks

Adaptive and Channel-Aware Detection of Selective Forwarding Attacks in Wireless Sensor Networks

Learning-Based Security Technique for Selective Forwarding Attack in Clustered WSN

Multi-variant Network Address Hopping to Defend Stealthy Crossfire Attack

Defensive Mechanisms of Selective Forward Attack in Wireless Sensor Networks

Identify Selective Forwarding Attacks Using Danger Model: Promote the Detection Accuracy in Wireless Sensor Networks

Exploiting channel-aware reputation system against selective forwarding attacks in WSNs

Detecting SYN Flooding Agents under Any Type of IP Spoofing

Fade: Detecting Forwarding Anomaly in Software-Defined Networks

A More Accurate Scheme to Detect SYN Flood Attacks

Router based detection for low-rate agents of DDoS attack

Securing Middlebox Policy Enforcement in SDN

FlowCloak: Defeating Middlebox-Bypass Attacks in Software-Defined Networking.

A Robust Scheme To Detect Syn Flooding Attacks

LSTM-NV: A combined scheme against selective forwarding attack in event-driven wireless sensor networks under harsh environments

Detection and Mitigation of SYN Flooding Attacks through SYN/ACK Packets and Black/White Lists

Resisting Network Ddos Attacks By Packet Asymmetry Path Marking

A Trust System for Detecting Selective Forwarding Attacks in VANETs.

Efficient Forwarding Anomaly Detection in Software-Defined Networks