How to detect a compromised SDN switch

Abstract

SDN is a concept of programmable networking. A network manager can process each network flow through software programs. There is a hypothesis that all switches are trusted and follow programmed commands to handle packets. That is, once a switch is compromised by an attacker and does not follow the order of the network manager, this will bring a huge network disaster. In this paper, we define some attack models through compromised switches and design a detection mechanism to find these compromised devices. We evaluate our mechanism and discuss some future works.

Systematizing Attacks and Defenses in Software-Defined Networking: A Survey

“…They detect these threats by using anomaly detection. Chi et al [106] propose an online detection algorithm that creates an artificial packet from a controller to see if it follows the intended forwarding path. Mohan et al [107] use node-disjoint control paths based on the fact that two control messages will be inconsistent if the source switch is compromised.…”