A Lightweight SDN Fingerprint Attack Defense Mechanism Based on Probabilistic Scrambling and Controller Dynamic Scheduling Strategies

Abstract

Software-defined networking (SDN) decouples the control plane from the data plane, which increases network flexibility and programmability. However, the “three-layer two-interface” architecture of SDN introduces new security issues. Attackers can collect fingerprint information (such as network types, controller types, and critical flow rules) by analyzing round-trip time (RTT) distribution of test packets. In order to defend against the fingerprint attack with limited attack time, we first design a probabilistic scrambling strategy. This strategy not only interferes with the delay distribution of probe packets in attack flow but also reduces the negative impact on the performance of legal packets in normal flow. However, if fingerprint attackers have unlimited attack time, it is not enough to defend against the attack only by this strategy. Therefore, we further propose a controller dynamic scheduling strategy to change SDN fingerprint information actively. Because scheduling different types of controllers to work in different periods will generate costs, the scheduling strategy is also responsible for determining the optimal switching time point to balance security benefits and costs. At last, we implement the defense mechanism on different types of controllers and verify its effectiveness in experimental scenarios. The experimental results show that the mechanism can effectively hide the SDN fingerprint information while reducing the negative impact on network performance.

Research on SDN Fingerprint Attack Defense Mechanism Based on Dynamic Disturbance and Information Entropy Detection

“…e data packet delay forwarding defense [9,10,[17][18][19][20]. e authors of [13][14][15][16] are mainly aimed at the fingerprint attack of the flow table matching rule.…”

“…When the detection packet involves the installation of a new flow rule, the attacker can observe the difference between the round-trip delay and the existing matching rule, and the delay network device is not described in detail and its availability is unknown. Wang and Chen [10] proposed to impose perturbation on the probability of the initial data packet. By defining a new action bucket selection logic for the group table, different data packets can be implemented with different delay operations, and the scrambling strategy can be converted into a data plane executable instruction.…”

“…OpenFlow is currently the most in uential protocol in the SDN framework [25]. e matching eld that can be used as a forwarding rule Input: Flow, n, Delay table Output: Flow of the 2 to n + 1 packets is delayed (1) Monitor () (2) while TRUE do: (3) packeti ← Flow (4) P Parser (packet1) (5) if R in (Flow table with P satis ed): ( 6) R.action (packeti) (7) counters + 1 (8) Add (dpid, port) with Delay table (9) while counters n: (10) Remove (dpid, port) (11) else: (12) Packet-in, t1 ← nowtime ( 13)…”

“…At present, the research on domestic and international SDN ngerprint attacks is mainly about how to attack, and there is only a little literature on the defense research of SDN ngerprint attacks. e defense against SDN ngerprint attacks is mostly through certain active measures, mainly through packet delay forwarding [5][6][7][8][9][10], moving target defense (MDT) [11][12][13][14], and setting honeypots [15,16] to confuse attackers.…”