Defense Against Software-Defined Network Topology Poisoning Attacks

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

The evolution and advancements in Information and Communication Technologies (ICT) have enabled large scale distributed computing with a huge chunk of applications for massive number of users. This has obviously generated large volumes of data, thus severely burdening the processing capacity of computers as well as the inflexible traditional networks. State-of-the-art methods for addressing datacenter level performance fixes are yet found wanting for sufficiently addressing this huge processing, storage, and network movement with proprietary protocols for this voluminous data. In this chapter the works have focused on addressing the backend server performance through effective reducer placement, intelligent compression policy, handling slower tasks and in-network performance boosting techniques through effective traffic engineering, traffic classification, topology discovery, energy minimization and load balancing in datacenter-oriented applications. Hadoop, the defacto standard in distributed big data storage and processing, has been designed to store data with its Hadoop Distributed File System (HDFS) and processing engine MapReduce large datasets reliably. However, the processing performance of Hadoop is critically dependent on the time taken to transfer data during the shuffle generated during MapReduce. Also, during concurrent execution of tasks, slower tasks need to be properly identified and efficiently handled to improve the completion time of jobs. To overcome these limitations, three contributions have been made; (i) Compression of generated map outputs at a suitable time when all the map tasks are yet to be completed to shift the load of network onto the CPU; (ii) Placing the reducer onto the nodes where the computation done is highest based on a couple of counters, one maintained at the rack level and another at node level, to minimize the run-time data copying; and (iii) Placing the slower map tasks onto the nodes where the computation done is highest and network is handled by prioritizing. Software defined networking (SDN) has been a boon for next generation networking owing to the separation of control plane from the data plane. It has the capability to address the network requirements in a timely manner by setting flows for every to and fro data movement and gathering large network statistics at the controller to make informed decisions about the network. A core issue in the network for the controller is traffic classification, which can substantially assist SDN controllers towards efficient routing and traffic engineering decisions. This chapter presents a traffic classification scheme utilizing three classifiers namely Feed-forward Neural Network (FFNN), Logistic Regression (LR), Naïve Bayes and employing Particle Swarm Optimization (PSO) for improved traffic classification with less overhead and without overlooking the key Quality of Service (QoS) criterion. Also lowering energy minimization and link utilization has been an important criterion for lowering the operating cost of the network and effectively utilizing the network. This issue has been addressed in the chapter by formulating a multi-objective problem while simultaneously addressing the QoS constraints by proposing a metaheuristic, since no polynomial solution exists and hence an evolutionary based metaheuristic (Clonal Selection) based energy optimization scheme, namely, Clonal Selection Based Energy Minimization (CSEM) has been devised. The obtained results show the efficacy of the proposed traffic classification scheme and CSEM based solution as compared with the state-of-the-art techniques. SDN has been a promising newer network paradigm but security issues and expensive capital procurement of SDN limit its full deployment hence moving to a hybrid SDN (h-SDN) deployment is only logical moving forward. The usage of both centralized and decentralized paradigms in h-SDN with intrinsic issues of interoperability poses challenges to key issues of topology gathering by the controller for proper allocation of network resources and traffic engineering for optimum network performance. State-of-the-art protocols for topology gathering, such as Link Layer Discovery Protocol (LLDP) and Broadcast Domain Discovery Protocol (BDDP) require a huge number of messages and such schemes only gather link information of SDN devices leaving out legacy switches’ (LS) links which results in sub-optimal performance. This chapter provides novel schemes which unearth topology discovery by requiring fewer messages and gathering link information of all the devices in both single and multi-controller environments (might be used when scalability issue is prevalent in h-SDN). Traffic engineering problems in h-SDN are addressed by proper placement of SDN nodes in h-SDN by utilizing the analyzing key criterion of traffic details and the degree of a node while lowering the link utilization in real-time topologies. The results of the proposed schemes for topology discovery and SDN node placement demonstrate the merits as compared with the state-of-the-art protocols.

Distributed denial of service (DDoS) attacks challenge software-defined networks (SDN), primarily due to vulnerabilities present in the separation between the control and data planes. The control plane maintains continuous communication with the data plane switches to direct traffic according to forwarding policies. Although the literature presents various solutions to detect DDoS attacks, most of them concentrate on the control plane. The controller facilitates automated network management, making it easier to integrate and administer applications. On the other hand, the development of security solutions on the control plane imposes an additional load on the controller’s duties. As an alternative to this problem, the research community proposed security solutions adapted to work on the data plane. However, due to the complexity of acting in this layer, the proposed solutions are restricted to statistical analysis of the network flow. This work proposes DataPlane-ML, a machine learning (ML) solution that acts on the data plane to detect DDoS attacks. To realize the use of ML techniques at the data plane, DataPlane-ML makes use of white box switches enhanced with P4 constructs to handle input flow and ML libraries to run ML models. This strategy allows the use of ML techniques on the data plane to provide more elaborated solutions that operate close to the input flow, reducing the impact on the SDN controller. The proposed DataPlane-ML was evaluated using the KNN, SVM and RF algorithms to detect DDoS attacks on real network traces. The experimental results show that DataPlane-ML is ≈23% faster than statistical-based solutions while providing better accuracy and similar CPU usage.

Software defined network (SDN) with disjoint control and data plane enables the controller to address network requirement better. A significant issue in such networks is how the network resources are allocated by the controller based on the demand, for instance, allocation of path with less delay, less error rate and so forth. The controller allocate such network resources by enabling link discovery between switches. SDN utilizes protocol like link layer discovery protocol (LLDP) for links to be identified in OpenFlow devices. The detection of links in OpenFlow devices requires a huge number of PACKET OUT (P <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">out</inf> ) messages from the controller to be sent across every active interfaces of the switch which might limit the controller performance. This paper introduces a Broadcast based Link Discovery (BBLD) scheme which lowers messages required to obtain the link discovery in OpenFlow switches (OFS’s) by dispatching a solitary P <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">out</inf> from the SDN controller (unlike a unicast message from the controller in case of LLDP) to any OpenFlow switch (OFS), which then circulates the same to the nodes successively. Experiments performed with Mininet reveal that messages required to obtain similar link discovery are reduced by an average of (28%-42.4%) under varied set of topologies.

Software Defined Network (SDN) Technology made tremendous changes in networking field by controlling the hardware with remote software by decoupling data plane and control plane. The focus here is on the controller which is part of control plane. A controller is a central part of SDN; it is an intermediary between Data plane and Forwarding plane. It takes prime place in SDN architecture like Operating System in Computers. SDN Controller is a software which directs the packets using flow rules and also contains statistical information of network. The controller orchestrates the networking devices such as switches and routers by channelizing the packets. SDN controller has different flavor based on the commercial requirement achieved by including new pluggable module. This paper discusses some of the SDN Controller with their feature; the controllers are POX, NOX, Floodlight, ODL, Open Contrail. This paper also compares the characteristic of centralized and distributed controller by focusing on performance, bandwidth and round-trip time of Floodlight and Open Daylight (ODL) controller. The simulation is conducted using Mininet.

SummaryNetwork virtualization (NV) technologies have attracted a lot of attention as an essential solution for future networking infrastructure. The NV enables multiple tenants to share the same physical infrastructure and to create independent virtual networks (VNs) by decoupling the physical network in terms of topology, address, and control functions. One feasible way to realize full NV involves considering solutions based on the software‐defined networking (SDN) paradigm using its programmability. The SDN contributes many benefits to both network operations and management including programmability, agility, elasticity, and flexibility. There are several SDN‐based NV solutions; however, they suffered from a lack of scalability, high availability. Also, they have high latency between control and data plane because of proxy‐based architecture. In this thesis, we introduce a new NV platform, named Open Network Hypervisor (ONVisor). The design objectives include, among the features, (1) multitenancy, (2) scalability, (3) flexibility, (4) isolated VNs, and (5) VN federation. ONVisor was designed and implemented by extending Open Network Operating System, an open‐source SDN controller. The main features of ONVisor are (1) isolated control and data plane per VN, (2) support of distributed operations, (3) extensible translators, (4) on‐platform VN application development and execution, and (5) support of heterogenous SDN data‐plane implementations. Several experiments are conducted on various test scenarios in different test environments in terms of control and data plane performance compared to nonvirtualized SDN network. The results show that ONVisor can provide VNs a little bit lower control plane performance and similar data plane performance.

Software Defined Networking (SDN) has emerged as a new networking paradigm that is based on the decoupling between data plane and control plane providing several benefits that include flexible, manageable, and centrally controlled networks. From a security point of view, SDNs suffer from several vulnerabilities that are associated with the nature of communication between control plane and data plane. In this context, software defined networks are vulnerable to distributed denial of service attacks. In particular, the centralization of the SDN controller makes it an attractive target for these attacks because overloading the controller with huge packet volume would result in bringing the whole network down or degrade its performance. Moreover, DDoS attacks may have the objective of flooding a network segment with huge traffic volume targeting single or multiple end systems. In this paper, we propose an entropy-based mechanism for Distributed Denial of Service (DDoS) attack detection and mitigation in SDN networks. The proposed mechanism is based on the entropy values of source and destination IP addresses of flows observed by the SDN controller which are compared to a preset entropy threshold values that change in adaptive manner based on network dynamics. The proposed mechanism has been evaluated through extensive simulation experiments.

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

The nature of computer network flash crowd traffic, which is generated by legitimate users accessing servers or other network resources are similar to the traffic generated by Distributed Denial of Service (DDoS) like attacks. With advancement in spoof packet generation tools, attacker may generate Multi-source Multi-destination Multi-protocol (MMM) traffic; characteristics of such traffic are very similar to on-going genuine/ flash crowd traffic in the network. In the case of Software Defined Network (SDN), attacker’s target is controller plane. Controller plane in SDN is a centralized processing unit of the underlying network, which manages several data planes. Controller plane frames the policies and pushes forwarding rules to the data planes. Data planes just maintain the forwarding rules. Thus by overloading the SDN controller, functionality of complete computer network will be hampered. In this paper, we have proposed Media Access Control (MAC) address based Model to Differentiate Flash crowd and Malicious traffic in SDN (MDFMS). Novelty of the proposed model is to detect, locate and mitigate the source of Traditional DDoS (T-DDoS) and MMMDDoS traffic. MDFSM has been implemented on separate machine to avoid any additional computing load on SDN controller. It also preserves the original design of the SDN architecture. Proposed model has been evaluated under various scenarios and encouraging results have been obtained to differentiate T-DDoS and MMM-DDoS from benign flash crowd traffic.

As a new networking paradigm, Software-Defined Networking (SDN) separates data and control planes to facilitate programmable functions and improve the efficiency of packet delivery. Recent studies have shown that there exist various security threats in SDN. For example, a saturation attack may disturb the normal delivery of packets and even make the SDN system out of service by flooding the data plane, the control plane, or both. The existing research has focused on saturation attacks caused by SYN flooding. This paper presents an anomaly detection method, called SA-Detector, for dealing with a family of saturation attacks through IP spoofing, ICMP flooding, UDP flooding, and other types of TCP flooding, in addition to SYN flooding. SA-Detector builds upon the study of self-similarity characteristics of OpenFlow traffic between the control and data planes. Our work has shown that the normal and abnormal traffic flows through the OpenFlow communication channel have different statistical properties. Specifically, normal OpenFlow traffic has a low self-similarity degree whereas the occurrences of saturation attacks typically imply a higher degree of self-similarity. Therefore, SA-Detector exploits statistical results and self-similarity degrees of OpenFlow traffic, measured by Hurst exponents, for anomaly detection. We have evaluated our approach in both physical and simulation SDN environments with various time intervals, network topologies and applications, Internet protocols, and traffic generation tools. For the physical SDN environment, the average accuracy of detection is 97.68% and the average precision is 94.67%. For the simulation environment, the average accuracy is 96.54% and the average precision is 92.06%. In addition, we have compared SA-Detector with the existing saturation attack detection methods in terms of the aforementioned performance metrics and controller's CPU utilization. The experiment results indicate that SA-Detector is effective for the detection of saturation attacks in SDN.

Software defined networks (SDN) has gained a lot of attention from both academia and industry recently. SDN is a new networking paradigm that decouples the control plane from the data plane. In this paradigm, control functions are centralized in an SDN controller. The migration from traditional networks to SDN is highly challenging for network operators. Sudden migration may not be possible due to the cost and operational issues. Therefore, incremental deployment of SDN is considered as a viable solution, resulting in the formation of hybrid SDN networks. An important task in hybrid SDN networks is bandwidth allocation and routing considering the coexistence of both conventional and SDN-enabled routers. In this paper, we first formulate this problem as a multi-objective integer program with delay and capacity constraints. Then, a heuristic approach is proposed to combat the computational complexity of the model. Our proposed method is extensively analyzed through simulations, and the evaluation results confirm the effectiveness of our approach.

Software-defined networking (SDN) is a network approach achieved by decoupling of the control and data planes. The control plane is logically centralized and the data plane is distributed across the network elements. The real-time network is in need of the incorporation of distributed controllers to maintain distributed state information of the traffic flows. Software-based solutions aid distributed SDN controllers to handle fluctuating network traffic and the controller’s configurations are dynamically programmed in real time. In this study, SDN controllers were programmed with a stateful firewall application to provide firewall functionalities without the support of committed hardware. A stateful firewall filtered traffic based on the complete context of incoming packets; it continuously evaluated the entire context of traffic flows, looking for network entry rather than specific traffic flows. In addition, a flow-based scheduling module was implemented in the distributed controllers to improve network scalability. A network cluster was configured with three distributed controllers and we experimented with three independent network topologies. The performance of the proposed network model was evaluated by measuring and analyzing metrics such as network throughput (kbps), delay (ms) and network overhead (pkt/ms) for various combinations of controllers and topologies. The results of the analysis were determined using the mininet emulator. The findings of the performance evaluation indicate that the distributed SDN controllers performs better than a centralized controller. When comparing distributed SDN with two controllers and distributed SDN with three controllers the overall network throughput is increased by 64%, the delay is decreased by 43% and network overhead is reduced by 39%.

The use of Software-Defined Networking (SDN) has created a huge leap in the management of computer networks. SDN offers flexibility and the ability to dynamically manage networks, but along with its advantages, it also brings significant challenges in managing quality of service (QoS). QoS is critical to maintaining performance and user experience in increasingly complex and distributed network environments. The research method uses Solution Development to address a quality of service (QoS) management challenge and solution in Software Defined Networking with the approach of designing and developing practical solutions to address QoS management issues and challenges in SDN environments. Control Separation and Data Plane are centralized network control at the SDN controller, while the data plane reside in the networks hardware, both capable of maintaining QoS and a challenges in SDN with a computer network approach that separates the control layer from the data layer, enabling more flexible and centralized network management. Research conclusions related to SDN Software Defined Networking quality of service management problems and solutions, focusing on the problem of separating management and data levels. The separations of control and data plane concept in SDN has great potential to improve flexibility, scalability and more efficient network management.

The traditional networks, with the control and data plane integrated into the same network devices, do not provide a global view of the network performance like degree of congestion, bandwidth utilization, etc. Software defined network (SDN) is an approach towards this problem which separates the control plane of the switch from its data plane and provide a centralized control plane so as to get a global view of the network performance and thus make decisions of how to regulate flows. In SDN, network monitoring can be achieved more efficiently than traditional networks using OpenFlow statistics. SDN controller can keep track of available bandwidth on each link and thus estimate end-to-end available bandwidth of a path simply by composing individual link bandwidths thus avoiding end-to-end probing. We have made two contributions in this paper: (i) proposed and validated a method to estimate end-to-end available bandwidth on any given path by composing link-wise available bandwidths (ii) proposed a method to measure link capacity using OpenFlow protocol. We compared our results to the ones obtained using the state-of-the-art bandwidth measurement tool, Yaz.