DoSGuard: Mitigating Denial-of-Service Attacks in Software-Defined Networks

Abstract

Software-defined networking (SDN) is a new networking paradigm that realizes the fast management and optimal configuration of network resources by decoupling control logic and forwarding functions. However, centralized network architecture brings new security problems, and denial-of-service (DoS) attacks are among the most critical threats. Due to the lack of an effective message-verification mechanism in SDN, attackers can easily launch a DoS attack by faking the source address information. This paper presents DoSGuard, an efficient and protocol-independent defense framework for SDN networks to detect and mitigate such attacks. DoSGuard is a lightweight extension module on SDN controllers that mainly consists of three key components: a monitor, a detector, and a mitigator. The monitor maintains the information between the switches and the hosts for anomaly detection. The detector utilizes OpenFlow message and flow features to detect the attack. The mitigator protects networks by filtering malicious packets. We implement a prototype of DoSGuard in the floodlight controller and evaluate its effectiveness in a simulation environment. Experimental results show the DoSGuard achieves 98.72% detecion precision, and the average CPU utilization of the controller is only around 8%. The results demonstrate that DoSGuard can effectively mitigate DoS attacks against SDN with limited overhead.

Detection and mitigation of DDoS attacks in SDN based intrusion detection system

“…The researchers simulated these attacks on Mininet and explored their impacts, noting that both the timeout duration of a flow rule and the bandwidth of the control plane significantly influence switch performance. Yet another paper [12] showcases DoS-Guard, a comprehensive and protocol-agnostic safeguard for SDN networks, designed to identify and alleviate such threats. Essentially, DoS-Guard is a streamlined add-on for SDN controllers, comprising three primary elements: a monitor, a detector, and a mitigator.…”

Defending Sdn Against Packet Injection Attacks Using Deep Learning

“…In [24], the authors propose a defense framework called DoSGuard to detect and mitigate denial-of-service (DoS) attacks in SDN networks. The framework was implemented as an extension module for the SDN controllers.…”

DoSDefender: A Kernel-Mode TCP DoS Prevention in Software-Defined Networking

“…However, the defined threshold value of the mechanisms based on entropy broadly depends on the security researchers’ experience. DoSGuard uses a support vector machine (SVM) as the classifier to detect and filter DoS attacks and protects networks [ 11 ]. A deep learning approach based on Gated Recurrent Unit (GRU) was introduced to handle DDoS attacks in SDN [ 12 ].…”