Detection and mitigation of UDP flooding attack in a multicontroller software defined network using secure flow management model

Abstract

Software-Defined Networking (SDN) simplifies the network management and provides a way to virtualize, configure, and manage the network infrastructure centrally. The central management has been exhibited by reinforcing an SDN controller, which separates the network data plane from the control functions and is responsible for managing the flows. Distributed Denial-of-Service (DDoS) attacks are the most threatening issue among many security attacks, and it makes the services unavailable in a network. The flow management done by the controller is disrupted when one or more malicious host flood User Datagram Protocol (UDP) packets in the network, focusing on exhausting the bandwidth of the controller. It results in degrading the performance of the controller, leading to control plane saturation. A Secure Flow Management model (SFM), which dynamically identifies and mitigates the UDP flooding attack in a multicontroller SDN has been proposed. The proposed model is a practically applicable defense mechanism against volumetric attack, and it tries to secure the control plane bandwidth.The SFM has been experimented as an extension of the RYU controller and has exploited the attack under different traffic scenarios. Further, an analysis has been made on response time and the CPU utilization taken by the controller to recover from the DoS attack. KEYWORDSinterdomain attack, intradomain attack, multicontroller software-defined network (SDN), pushback requests, secure flow management, UDP flooding attack 1 INTRODUCTION Software-Defined Networking (SDN) is an emerging technology in networking where all the control functions are centralized within the SDN controller, and it is done by the logical separation of the control and data planes. 1 SDN applications communicate with the SDN controller via a northbound interface (eg, REST and Java APIs). OpenFlow (OF) acts as a southbound interface that supports the communication between the SDN controller and the OF switches. The controller has the responsibility of transferring the forwarding rules to the flow table of the corresponding switch. 2 OF protocol is the base for the development of SDN architecture. OF has actually been developed to make experiments and innovations with new protocols in networking. The network communication in SDN is abstracted in the form of flows. A sequence of packets with same header fields belongs to a flow. The OF switches consist of flow tables, each containing a set of rules that specify how to forward the packets. Each rule has a matching pattern, action field, priority, and a counter. When there is an incoming packet, the OF switch searches for the matching pattern; if it exists, it continues with that rule. Otherwise, the corresponding switch sends a Packet-In message to the controller. The benefits of SDN such as enhanced configuration of networking devices, reduced cost of management, and improved performance, make this new networking paradigm to be used in enterprises, data centers, and other large-scale networks. 3 Distributed Denial-of-Servi...

Application-Layer DDoS Attack Detection Using Explicit Duration Recurrent Network-Based Application-Layer Protocol Communication Models

“…Aziz and Okamura [33] adopted deep learning algorithms to detect SMTP food attacks on software-defned networking (SDN) platforms. Gurusamy and Msk [34] detected SMTP food attacks by monitoring all ports' trafc statistics in the SDN.…”

Research on Detection and Defense Methods for Software‐Defined Network Architecture after Hybrid Attack by Distributed Denial of Service

“…Lim et al [5] developed a scheduling‐based architecture to effectively mitigate attacks and safeguard networks in the event of denial‐of‐service (DoS) attacks. Perumal et al [6] introduced a DDoS attack detection model in SDN, which utilizes data flows and statistical features to determine the presence of an attack. The model employed a deep neural network trained using the self‐improved moth flame optimization algorithm.…”

Standard Scaling and PCA-based Logistic Regression Model for Classifying and Detecting DDoS Attack

“…There are many instances in the past in which this attack was used to down important services, such as the attack on Google in 2020, the attack on AWS in the same year 2020, and many more. UDP [2] Flood User Datagram Protocol (UDP) Flood is a DDoS attack in which an attacker takes the help of UDP packets. Here, the bots (used by the attacker) send spoofed UDP Packets to the target system, resulting in a flood of UDP packets.…”