Abstract:The whole Software-Defined Networking (SDN) system might be out of service when the control plane is overloaded by control plane saturation attacks. In this attack, a malicious host can manipulate massive table-miss packets to exhaust the control plane resources. Even though many studies have focused on this problem, systems still suffer from more influenced switches because of centralized mitigation policies, and long recovery delay because of the remaining attack flows. To solve these problems, we propose FSDM, a Fast recovery Saturation attack Detection and Mitigation framework. For detection, FSDM extracts the distribution of Control Channel Occupation Rate (CCOR) to detect the attack and locates the port that attackers come from. For mitigation, with the attacker’s location and distributed Mitigation Agents, FSDM adopts different policies to migrate or block attack flows, which influences fewer switches and protects the control plane from resource exhaustion. Besides, to reduce the system recovery delay, FSDM equips a novel functional module called Force_Checking, which enables the whole system to quickly clean up the remaining attack flows and recovery faster. Finally, we conducted extensive experiments, which show that, with the increasing of attack PPS (Packets Per Second), FSDM only suffers a minor recovery delay increase. Compared with traditional methods without cleaning up remaining flows, FSDM saves more than 81% of ping RTT under attack rate ranged from 1000 to 4000 PPS, and successfully reduced the delay of 87% of HTTP requests time under large attack rate ranged from 5000 to 30000 PPS.

FUSO: Fast Multi-Path Loss Recovery for Data Center Networks

Fast and Cautious: Leveraging Multi-Path Diversity for Transport Loss Recovery in Data Centers

Load Balancing With Multi-Level Signals for Lossless Datacenter Networks

FMPTCP: Achieving High Bandwidth Utilization and Low Latency in Data Center Networks

Designing Fast and Friendly TCP to Fit High Speed Data Center Networks

CAFFE: Congestion-Aware Fast Failure Recovery in Software Defined Networks.

Fast Connection Recovery Against Region Failures with Landmark-Based Source Routing

Less is More: Dynamic and Shared Headroom Allocation in PFC-Enabled Datacenter Networks

Minimizing Buffer Utilization for Lossless Inter-DC Links

Multipath Routing Research Based on Traffic Measurement under SDN in Data Center Networks

TCP-Fusion: A Hybrid Congestion Control Algorithm for High-speed Networks

Unlocking Diversity of Fast-Switched Optical Data Center Networks with Unified Routing

Dual-Nat: Dynamic Multipath Flow Scheduling for Data Center Networks

FACC: Flow-Size-Aware Congestion Control in Data Center Networks.

Efficient Recovery Path Computation for Fast Reroute in Large-Scale Software-Defined Networks

FSDM: Fast Recovery Saturation Attack Detection and Mitigation Framework in SDN

DCCS: A dual congestion control signals based TCP for datacenter networks

S-PFC: Enabling Semi-Lossless RDMA Network with Selective Response to PFC.

An Efficient Flow Detection and Scheduling Method in Data Center Networks

Fast Recovery for Single Link Failure with Segment Routing in SDNs.

P-PFC: Reducing Tail Latency with Predictive PFC in Lossless Data Center Networks