Automated Discovery of Cross-Plane Event-Based Vulnerabilities in Software-Defined Networking

Abstract

Software-defined networking (SDN) achieves a programmable control plane through the use of logically centralized, event-driven controllers and through network applications (apps) that extend the controllers' functionality. As control plane decisions are often based on the data plane, it is possible for carefully crafted malicious data plane inputs to direct the control plane towards unwanted states that bypass network security restrictions (i.e., cross-plane attacks). Unfortunately, because of the complex interplay among controllers, apps, and data plane inputs, at present it is difficult to systematically identify and analyze these cross-plane vulnerabilities. We present EVENTSCOPE, a vulnerability detection tool that automatically analyzes SDN control plane event usage, discovers candidate vulnerabilities based on missing event-handling routines, and validates vulnerabilities based on data plane effects. To accurately detect missing event handlers without ground truth or developer aid, we cluster apps according to similar event usage and mark inconsistencies as candidates. We create an event flow graph to observe a global view of events and control flows within the control plane and use it to validate vulnerabilities that affect the data plane. We applied EVENTSCOPE to the ONOS SDN controller and uncovered 14 new vulnerabilities. 1 An SDN controller service or app often consists of multiple functional units, which we call components. A functional unit ends at an API boundary or event dispatch.

Systematizing Attacks and Defenses in Software-Defined Networking: A Survey

“…4) Program Analysis: This method examines program behavior to find flaws that abuse security-sensitive APIs or violate network policies (invariant). Prior studies have utilized diverse program analysis techniques, such as static analysis looking into control flows [69], [70] or dynamic instrumentation investigating execution traces [48], [71].…”

“…Under the shadow of the For example, an attacker can abuse a host-to-application event chain, denoting a case when events generated from hosts affect an application's behavior. EventScope [70] presents a cross-plane attack that focuses on "unparsed" events by applications. They show that an attacker can trigger a malformed HOST ADDED event containing an invalid IP address (e.g., 10.0.0.256).…”

“…Dynamic Instrumentation [45], [71], [84]- [86], [94] Provenance Graph Analysis [12], [48], [95], [96] §V-A3 Control/Data Flow Analysis [12], [48], [69], [70]…”

“…By conducting clustering analysis, it is shown that malicious API chains can be detected with high accuracy. EventScope [70] extends the CFG into an event flow graph to catch how events are propagated over code blocks within an application. Its purpose is to detect "unhandled" data-plane events by the application, which makes a hole that an attacker can bypass security logic.…”

A Systematic Treat Model for Software-Defined Networking

“…In this case, the host tracking application indirectly obtains permission to modify the flow rules through the routing application [50]. Besides, on the data plane, the hosts can utilize inappropriate responsibility assigning of the applications to bypass access control [51].…”