Abstract:Like traditional IP networking, the emerging Software-Defined Networking (SDN) technology is vulnerable to sophisticated attacks against packets and their forwarding behaviors. However, existing proposals of packet forwarding verification for IP networking cannot be directly applied to the current SDN deployment due to the limited functionalities and resources in commercial off-the-shelf (COTS) SDN switches. We propose DynaPFV, a dynamic packet forwarding verification mechanism that is capable of detecting various sophisticated attacks against packet forwarding. DynaPFV leverages the controllability of SDN to examine both packets and flow statistics across a network of switches to detect violation of packet integrity and forwarding behaviors. To mitigate the verification overhead, DynaPFV dynamically adjusts the rates of packet sampling and flow statistics collection based on the prior detection results in order to preserve the verification accuracy. Furthermore, DynaPFV makes changes to the SDN controller only, and is directly deployable atop COTS SDN switches without modifications. We conduct theoretical analysis on the trade-off between performance and accuracy in our dynamic verification approach. We further prototype DynaPFV using the open-source Floodlight controller, and evaluate our DynaPFV prototype using Mininet simulations and hardware testbed experiments. DynaPFV achieves over 97 percent of verification accuracy only with less than 5 percent of throughput degradation and less than 10 percent of additional forwarding delays.

A Novel Method Against the Firewall Bypass Threat in OpenFlow Networks.

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

SDN-RDCD: A Real-Time and Reliable Method for Detecting Compromised SDN Devices.

A Deep ConvNet-Based Countermeasure to Mitigate Link Flooding Attacks Using Software-Defined Networks

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

Combination Attacks and Defenses on SDN Topology Discovery.

FlowCloak: Defeating Middlebox-Bypass Attacks in Software-Defined Networking.

Detection and Mitigation of DoS Attacks in Software Defined Networks

Securing Middlebox Policy Enforcement in SDN

Novel Mitm Attacks On Security Protocols In Sdn: A Feasibility Study

Exploiting the Vulnerability of Flow Table Overflow in Software-Defined Network: Attack Model, Evaluation, and Defense

Attacking Network Isolation in Software-Defined Networks: New Attacks and Countermeasures

How To Defend Against Sophisticated Intrusions In Home Networks Using Sdn And Nfv

A Novel Distributed Denial-of-Service Attack Detection Scheme for Software Defined Networking Environments.

Detection and Defense Against Network Isolation Attacks in Software‐defined Networks

Performance and Features: Mitigating the Low-Rate TCP-Targeted DoS Attack via SDN

Dynamic Packet Forwarding Verification in SDN

SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane.

A Low-Cost Detection and Mitigation Method for Link Flooding Attacks in SDN

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane