Timing SDN Control Planes to Infer Network Configurations

Sonchack, John; Aviv, Adam J.; Keller, Eric

doi:10.1145/2876019.2876030

Cited by 21 publications

(21 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…erefore, the controller type can be identified by recording the average processing time and comparing it to the constructed controller response time database. Sonchack et al [12] used specially constructed probe packets and test packets to identify key flow rules in the flow table. Zhang et al [13] conducted research on how to identify the flow matching domain information of SDN switches.…”

Section: Related Workmentioning

confidence: 99%

“…en, we construct the full-factor SDN fingerprint attack chain based on the classification results of the existing researches. It is worth noting that although the specific technologies in the SDN fingerprint attack chain are based on the existing researches [9,11,12], the concept of the fingerprint attack chain is first proposed by us in this paper, so this is also one of the contributions of our paper.…”

Section: Motivationmentioning

confidence: 99%

See 1 more Smart Citation

A Lightweight SDN Fingerprint Attack Defense Mechanism Based on Probabilistic Scrambling and Controller Dynamic Scheduling Strategies

Wang

Chen

2021

Security and Communication Networks

View full text Add to dashboard Cite

Software-defined networking (SDN) decouples the control plane from the data plane, which increases network flexibility and programmability. However, the “three-layer two-interface” architecture of SDN introduces new security issues. Attackers can collect fingerprint information (such as network types, controller types, and critical flow rules) by analyzing round-trip time (RTT) distribution of test packets. In order to defend against the fingerprint attack with limited attack time, we first design a probabilistic scrambling strategy. This strategy not only interferes with the delay distribution of probe packets in attack flow but also reduces the negative impact on the performance of legal packets in normal flow. However, if fingerprint attackers have unlimited attack time, it is not enough to defend against the attack only by this strategy. Therefore, we further propose a controller dynamic scheduling strategy to change SDN fingerprint information actively. Because scheduling different types of controllers to work in different periods will generate costs, the scheduling strategy is also responsible for determining the optimal switching time point to balance security benefits and costs. At last, we implement the defense mechanism on different types of controllers and verify its effectiveness in experimental scenarios. The experimental results show that the mechanism can effectively hide the SDN fingerprint information while reducing the negative impact on network performance.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Motivationmentioning

confidence: 99%

A Lightweight SDN Fingerprint Attack Defense Mechanism Based on Probabilistic Scrambling and Controller Dynamic Scheduling Strategies

Wang

Chen

2021

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…If the changed field triggers a flow rule installation, controller is probably sensitive to this header field. Further, [41] uses two streams, the timing packet stream and test packet stream, that cooperate with each other to infer the values of the matching fields. To improve the detection accuracy, [42] developed an explicit inference algorithm to detect the cache size, policy and state of the target flow table in a more fine-grained way and implement intelligent DoS attacks according to the inferred parameters, causing greater damage with less cost.…”

Section: Network Flow Rule Probingmentioning

confidence: 99%

“…DoS attacks to SDN usually originate from the data plane and affect the availability of controllers by populating the switch flow table or filling the southbound channel between the controller and data plane [36,41,44]. A DoS attack against an SDN controller is a serious security threat, which may cause the controller to be unavailable and jeopardize network stability.…”

Section: Packet_in Message Flooding Attackmentioning

confidence: 99%

A Systematic Treat Model for Software-Defined Networking

2021

KSII TIIS

View full text Add to dashboard Cite

Software-Defined Networking (SDN) has three key features: separation of control and forwarding, centralized control, and network programmability. While improving network management flexibility, SDN has many security issues. This paper systemizes the security threats of SDN using spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege (STRIDE) model to understand the current security status of SDN. First, we introduce the network architecture and data flow of SDN. Second, we analyze security threats of the six types given in the STRIDE model, aiming to reveal the vulnerability mechanisms and assess the attack surface. Then, we briefly describe the corresponding defense technologies. Finally, we summarize the work of this paper and discuss the trends of SDN security research.

show abstract

“…[26] creates a python script to probe packets between OpenFlow switches and controller to dissect fractions of the control layer latency. [27] studies the effect of varying the load of the control plane on it is latency using background control probe packets and ping utility on the Pica8 physical switch. At last, High-Fidelity Switch Models for SDN Emulation [3] is the most related work to this paper.…”

Section: Evaluation Of Sdnmentioning

confidence: 99%

Developing an Asynchronous Technique to Evaluate the Performance of SDN HP Aruba Switch and OVS

Al-Sadi

Al-Sherbaz

Xue

et al. 2018

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

Developers of Software Defined Network (SDN) faces a lack of or difficulty in getting a physical environment to test their inventions and developments. That drives them to use a virtual environment for their experiments. This work addresses the differences between the SDN virtual environment and physical SDN switches, which leads to equip a more realistic SDN virtual environment. Consequently, this paper presents a precise performance evaluation and comparison of off-the-shelf SDN devices, HP Aruba 3810M, with Open Virtual Switch (OVS) inside Mininet emulator. This work examines the variability of the path delay, throughput, packet losses and jitter of SDN in a different windows size of the packets and network background loads. Our conducted experiments consider a number of protocols such as ICMP, TCP and UDP. In order to evaluate the network latency accurately, a new asynchronous latency measurement technique is proposed. The developed technique shows more precise results in comparison to other techniques. Furthermore, the work focuses on extracting the flow-setup latency, caused by the external SDN controller when setting flow rules into the switch. The comparison of results shows a dissimilarity in the behaviour of SDN hardware and the Mininet emulator. The SDN hardware exposed higher latency and flowsetup time due to extra resources of delay, which the emulator does not possess.

show abstract

Timing SDN Control Planes to Infer Network Configurations

Cited by 21 publications

References 2 publications

A Lightweight SDN Fingerprint Attack Defense Mechanism Based on Probabilistic Scrambling and Controller Dynamic Scheduling Strategies

A Lightweight SDN Fingerprint Attack Defense Mechanism Based on Probabilistic Scrambling and Controller Dynamic Scheduling Strategies

A Systematic Treat Model for Software-Defined Networking

Developing an Asynchronous Technique to Evaluate the Performance of SDN HP Aruba Switch and OVS

Contact Info

Product

Resources

About