An Incremental Approach for Swift OpenFlow Anomaly Detection

Abstract

Software Defined Networking (SDN) is designed for dynamic policy update where frequent changes are pushed to the forwarding devices. Different offline approaches for detecting misconfiguration anomalies in SDN by taking a snapshot of the state of the network have been developed in the literature. However, the detection process is time-consuming and unfeasible in the case of frequent changes to the OpenFlow tables as well in big size networks containing a large number of rules. This paper presents an incremental method for detecting potential anomalies in an online manner, i.e., after one or multiple simultaneous updates in the SDN policy. Whenever the OpenFlow tables are dynamically changed, a static approach that rechecks the whole policy is unnecessarily redundant in a sense that most of the policy remains intact. Hence the need for incremental verification method to reduce this overhead, and only the subset of the policy that is affected by the update is checked. Two different solutions are proposed based on whether the policy modifications take place in the ingress switches or in the middle switches. We provide some comprehensive experiments to demonstrate the detection performance for the case of single or multiple simultaneous changes in forwarding devices. The experiment results show that the incremental method is drastically faster than the static parallel approach, with a factor up to about 450 times in some cases!

Net Auto-Solver: A formal approach for automatic resolution of OpenFlow anomalies

“…Both a single-thread and multi-thread implementation of Net Auto-Solver are assessed, and the results are promising. As future work, we would like to apply an incremental approach [10] to improve the performance of the correction process in Net Auto-Solver. Since the data plane rules are updated frequently, the correction performance is an essential factor in the efficiency of the method and thus the need for an incremental approach.…”

Misconfiguration in Firewalls and Network Access Controls: Literature Review

“…Shadowing does not only occur when one rule completely encompasses another rule. The authors of [27] list a different kind of shadowing that they call total shadowing. The authors describe total shadowing as when the combined scope of multiple rules covers the entire scope of another rule.…”

“…Earlier, we discussed how the concept [27] describes as total shadowing. We mentioned before that total shadowing represents multiple instances of a different misconfiguration.…”

“…Stateful firewall misconfiguration checking as stated before does not have any substantial differences, even using the same definitions without adding more types of misconfigurations. Some of the papers that check stateful firewalls include [26,27,29,41,59]. The first paper listed is an extension of "Firewall Policy Advisor", the tool that essentially started the work in this field.…”

A parallel approach for detecting OpenFlow rule anomalies based on a general formalism

“…The online verification operates by the principle of only checking the affected set of packets due to the policy update. In Reference 11, we show how we can extend the offline verification method proposed in Reference 1 to cover online verification. In this article, we focus on the offline method for modeling the static networks and verifying policies before any changes.…”