Abstract:The (logically) centralized architecture of software-defined networks makes them an easy target for packet injection attacks. In these attacks, the attacker injects malicious packets into the SDN network to affect the services and performance of the SDN controller and overflows the capacity of the SDN switches. Such attacks have been shown to ultimately stop the network functioning in real-time, leading to network breakdowns. There have been significant works on detecting and defending against similar DoS attacks in non-SDN networks, but detection and protection techniques for SDN against packet injection attacks are still in their infancy. Furthermore, many of the proposed solutions have been shown to be easily bypassed by simple modifications to the attacking packets or by altering the attacking profile. In this paper, we develop novel Graph Convolutional Neural Network models and algorithms for grouping network nodes/users into security classes by learning from network data. We start with two simple classes — nodes that engage in suspicious packet injection attacks and nodes that are not. From these classes, we then partition the network into separate segments with different security policies using distributed Ryu controllers in an SDN network. We show in experiments on an emulated SDN that our detection solution outperforms alternative approaches with above 99% detection accuracy for various types (both old and new) of injection attacks. More importantly, our mitigation solution maintains continuous functions of non-compromised nodes while isolating compromised/suspicious nodes in real-time. All code and data are publicly available for the reproducibility of our results.

REAL-GUARD

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Research on Security Threat Monitoring and Testing Framework in Software - Defined Network Based on Depth Learning

SDN-RDCD: A Real-Time and Reliable Method for Detecting Compromised SDN Devices.

TableGuard: A Novel Security Mechanism Against Flow Table Overflow Attacks in SDN.

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Combination Attacks and Defenses on SDN Topology Discovery.

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

DoSGuard: Mitigating Denial-of-Service Attacks in Software-Defined Networks

Detection and Mitigation of DoS Attacks in Software Defined Networks

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

Realguard: A Lightweight Network Intrusion Detection System for IoT Gateways

SDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN

SoftGuard: Defend Against the Low-Rate TCP Attack in SDN

Towards Fine-grained Network Security Forensics and Diagnosis in the SDN Era.

Flooddefender: Protecting Data and Control Plane Resources under Sdn-Aimed Dos Attacks

SD-Anti-DDoS: Fast and efficient DDoS defense in software-defined networks

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane

Realtime DDoS Defense Using COTS SDN Switches via Adaptive Correlation Analysis

An Efficient Scheme to Defend Data-to-Control-Plane Saturation Attacks in Software-Defined Networking

Defending SDN against packet injection attacks using deep learning