FloodGuard: A DoS Attack Prevention Extension in Software-Defined Networks

Abstract

This paper addresses one serious SDN-specific attack, i.e., data-to-control plane saturation attack, which overloads the infrastructure of SDN networks. In this attack, an attacker can produce a large amount of table-miss packet_in messages to consume resources in both control plane and data plane. To mitigate this security threat, we introduce an efficient, lightweight and protocol-independent defense framework for SDN networks. Our solution, called FLOODGUARD, contains two new techniques/modules: proactive flow rule analyzer and packet migration. To preserve network policy enforcement, proactive flow rule analyzer dynamically derives proactive flow rules by reasoning the runtime logic of the SDN/OpenFlow controller and its applications. To protect the controller from being overloaded, packet migration temporarily caches the flooding packets and submits them to the OpenFlow controller using rate limit and round-robin scheduling. We evaluate FLOODGUARD through a prototype implementation tested in both software and hardware environments. The results show that FLOODGUARD is effective with adding only minor overhead into the entire SDN/OpenFlow infrastructure.

Hauth:A Novel Approach for Network Visibility Protection

“…Avant-Guard [3] shows a new attack (which is called data-to-control plane saturation attack) against SDN networks and provide solutions to prevent such attacks. FloodGuard [7] provides a new solution to this attack. Besides, SPHINX [2] proposes a unified approach to use network graphs to detect attacks that violate those learned flow graphs.…”

An Approach for Protecting the OpenFlow Switch from the Saturation Attack

“…AvantGuard can alleviate TCP saturation attack effectively which however, has some limitation for other protocols. FloodGuard [11] is another approach which is also proposed to defend saturation attack in both control plane and data plane. FloodGuard adopts proactive flow rules to preserve network policy enforcement and packet migration mechanism to protect the controller from being overloaded.…”

SDNManager: A Safeguard Architecture for SDN DoS Attacks Based on Bandwidth Prediction

“…end if (12) end for ( a product of innovations (errors) of the past terms and its standard deviation by = ,…”

“…AvantGuard [2] introduces connection migration and actuating triggers into the SDN architecture to defend against the SYN Flood attacks, but it does not work well when confronted with other DoS attacks in SDN. FloodGuard [12] uses proactive flow rule analyzer and packet migration to defend against data plane saturation attack, but it is too costly. Previously related works, such as [13,14], employed Self Organizing Maps (SOM) to classify whether the traffic is abnormal or not to defend against DoS attacks, but the overhead of the classification is also too high to be used in real time.…”