SoftGuard: Defend Against the Low-Rate TCP Attack in SDN

Renjie Xie,Mingwei Xu,Jiahao Cao,Qi Li

DOI: https://doi.org/10.1109/icc.2019.8761806

2019-01-01

Abstract:The low-rate TCP attack is essentially a great threat to the Internet. It causes significant throughput degradation of TCP flows by generating periodical pulsing flows. Due to its low rate, the attack is difficult to be detected and throttled. Recently, Software-Defined Networking (SDN) has emerged as a promising network paradigm. Several SDN-based defense systems have been proposed to deal with various Denial of Service (DoS) attacks. However, they fail to consider the low-rate TCP attack. In this paper, we propose SoftGuard, which is an SDN-based defense that effectively detects and mitigates the low-rate TCP attack. SoftGuard detects the attack by installing crafted flow rules to monitor the degradation of aggregated TCP throughput in ports of switches. It confirms the attack by judging whether there is periodicity for aggregated TCP throughput with adaptive Fast Fourier Transform, and accurately identifies attack flows with Mean Euclidean Distance. Identified attack flows will be effectively throttled by installing mitigation rules in ingress switches. We implement SoftGuard in the Floodlight controller. Experiments in a real SDN testbed demonstrate its effectiveness on defending against the low-rate TCP attack.