Counteracting UDP Flooding Attacks in SDN

Abstract

Software-defined networking (SDN) is a new networking architecture with a centralized control mechanism. SDN has proven to be successful in improving not only the network performance, but also security. However, centralized control in the SDN architecture is associated with new security vulnerabilities. In particular, user-datagram-protocol (UDP) flooding attacks can be easily launched and cause serious packet-transmission delays, controller-performance loss, and even network shutdown. In response to applications in the Internet of Things (IoT) field, this study considers UDP flooding attacks in SDN and proposes two lightweight countermeasures. The first method sometimes sacrifices address-resolution-protocol (ARP) requests to achieve a high level of security. In the second method, although packets must sometimes be sacrificed when undergoing an attack before starting to defend, the detection of the network state can prevent normal packets from being sacrificed. When blocking a network attack, attacks from the affected port are directly blocked without affecting normal ports. The performance and security of the proposed methods were confirmed by means of extensive experiments. Compared with the situation where no defense is implemented, or similar defense methods are implemented, after simulating a UDP flooding attack, our proposed method performed better in terms of the available bandwidth, central-processing-unit (CPU) consumption, and network delay time.

Detecting Temporal Attacks: An Intrusion Detection System for Train Communication Ethernet Based on Dynamic Temporal Convolutional Network

“…is will probably lead to an unexpected operation accident. According to the weaknesses of protocols within TCE, several categories of DoS attacks could happen: UDP flood attacks [30] exploiting the weaknesses of TRDP and UDP, SYN flood attacks [31] exploiting the weaknesses of TRDP and TCP, MAC flood attacks [32] exploiting the weaknesses of switch tables, and Smurf attacks [33] exploiting the weaknesses of ICMP.…”

“…According to equation ( 4), networks with such TCN blocks have the receptive field size of [31,127,511,2047,8095]. Accordingly, we fed different input packet sequences with seq Len � [30,120,500,2000,8000] from TCE-IDS dataset into these five models. Experimental results are shown in Figure 14.…”

On the (in)Security of the Control Plane of SDN Architecture: A Survey

“…Attack in SDN Scenario: In an SDN architecture, an attacker could launch a UDP flood attack against an SDN switch or an SDN controller. The attacker could use a tool to generate a high volume of UDP packets and send them to the target device, causing it to become overwhelmed with traffic and unable to process incoming requests [120], [121].…”