A parallel approach for detecting OpenFlow rule anomalies based on a general formalism

Abstract

Summary As the policies of a software‐defined networking (SDN) network can be updated dynamically and often at a high pace, conflicts between policies can easily occur. Due to the large number of switches and heterogeneous policies within a typical SDN network, detecting those conflicts is a laborious and challenging task. This article presents three main contributions. First, we devise an offline method for detecting unmatched OpenFlow rules, that is, rules that are never fired. In our taxonomy such anomalies can stem from either invalid or irrelevant unmatched rules. Second, we introduce a new set of definitions for the intraanomalies between rules in the same table, which might occur when using the multiaction feature of an OpenFlow rule. Third, our detection method has been enhanced to support parallel execution, which makes it a viable solution for troubleshooting large‐scale networks. We provide some comprehensive experimental results based on both synthetic and real‐life setup the synthetic set up is designed in such a way that the rule matching takes place in the last rules of the switch and thus putting more stress on the rule detection process. The parallel method is shown to outperform the single‐threaded checking method by order of magnitude up to 21.

Misconfiguration in Firewalls and Network Access Controls: Literature Review

“…Stateful firewall misconfiguration checking as stated before does not have any substantial differences, even using the same definitions without adding more types of misconfigurations. Some of the papers that check stateful firewalls include [26,27,29,41,59]. The first paper listed is an extension of "Firewall Policy Advisor", the tool that essentially started the work in this field.…”

“…SDN-focused anomaly detection occurs in very recent papers such as [1,29,41,59,60]. Unlike the early days of firewalls, the majority of the development into SDNs goes into an open framework that the various solutions are built upon.…”