Abstract:Software-Defined Networking (SDN) greatly meets the need in industry for programmable, agile, and dynamic networks by deploying diversified SDN applications on a centralized controller. However, SDN application ecosystem inevitably introduces new security threats since compromised or malicious applications can significantly disrupt network operations. Thus, a number of effective security enhancement systems have been developed to defend against potential attacks from SDN applications. In this paper, we identify a new vulnerability on flow rule installation in SDN, namely, buffered packet hijacking, which can be exploited by malicious applications to launch effective attacks bypassing all existing defense systems. The root cause of this vulnerability lies in that SDN systems do not check the inconsistency between buffer IDs and match fields when an application attempts to install flow rules. Thus, a malicious application can manipulate buffer IDs to hijack buffered packets even though they do not match any installed flow rules. We design effective attacks exploiting this vulnerability to disrupt all three SDN layers, i.e., application layer, data plane layer, and control layer. First, by modifying buffered packets and resending them to controllers, a malicious application can poison other applications. Second, by manipulating forwarding behaviors of buffered packets, a malicious application can not only disrupt TCP connections of flows but also make flows bypass network security policies. Third, by copying massive buffered packets to controllers, a malicious application can saturate the bandwidth of SDN control channels and their computing resources. We demonstrate the feasibility and effectiveness of these attacks with both theoretical analysis and experiments in a real SDN testbed. Finally, we develop a lightweight defense system that can be readily deployed in existing SDN controllers as a patch.

Denial of Firewalling

Firewall Fingerprinting and Denial of Firewalling Attacks.

Firewall fingerprinting

A Reference Model And System Architecture For Database Firewall

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

A Deep ConvNet-Based Countermeasure to Mitigate Link Flooding Attacks Using Software-Defined Networks

A novel mechanism to defend against low-rate denial-of-service attacks

Effective DDoS Mitigation Via ML-Driven In-network Traffic Shaping

Subverting Stateful Firewalls with Protocol States (Extended Version)

Distributing and Obfuscating Firewalls via Oblivious Bloom Filter Evaluation

NetFence: Preventing Internet Denial of Service from Inside Out

Robust dynamic network traffic partitioning against malicious attacks.

SYN Flood Attack Detection and Mitigation using Machine Learning Traffic Classification and Programmable Data Plane Filtering

FloodShield: Securing the SDN Infrastructure Against Denial-of-Service Attacks.

Detection and Defense of SYN Flood Attacks Based on Dual Stack Network Firewall

Systematic Structural Testing of Firewall Policies

Network-on-Chip Firewall: Countering Defective and Malicious System-on-Chip Hardware

The store-and-flood distributed reflective denial of service attack

CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure

When Match Fields Do Not Need to Match: Buffered Packets Hijacking in SDN

Fault Localization for Firewall Policies.