Lightweight Detection and Mitigation Method for IP Spoofing Attacks in Software Defined Network

Abstract

In response to the problems of high computational overhead and lack of flexibility in traditional IP spoofing attack mitigation methods, a method for mitigating IP spoofing attacks in SDN based on a dynamic restriction strategy is proposed. By using the triplet information in the Packet-In message to trace the attack path and locate the source host of the IP spoofing attack; the controller formulates a dynamic restriction strategy to limit the new flow forwarding function of the switch port connected to the attack source host, and then restores its function to forward new flows after the restriction period expires; the duration of the restriction period increases with the number of times it is detected as an attack source. This dynamic restriction strategy can prevent attack traffic from entering the SDN network, thereby effectively avoiding the overload of SDN switches, controllers, and links. Additionally, since there is no need for real-time monitoring of these restricted switch ports during the restriction period, this method has a higher mitigation efficiency and consumes fewer resources when dealing with long-duration attacks compared to traditional methods.