On the fine-grained fingerprinting threat to software-defined networks

Research on SDN Fingerprint Attack Defense Mechanism Based on Dynamic Disturbance and Information Entropy Detection

“…e data packet delay forwarding defense [9,10,[17][18][19][20]. e authors of [13][14][15][16] are mainly aimed at the fingerprint attack of the flow table matching rule.…”

“…In the real SDN, the location of the host will not change frequently, and the host connected to the switch port will not change frequently in the network [17]. Based on this, Hou et al [18] analyzed the common characteristics of time-based fingerprint attacks in SDNs, and explored a lightweight method to counter fingerprint attacks, taking the source IP and source MAC changes of the host address as potential fingerprint detection behavior, when the host address changes, delay the installation of matching rules in the switch, thereby increasing the difficulty of fingerprint attacks. Notwithstanding, if the attacker only uses one host to perform a fingerprint attack, this method is not applicable.…”

A Lightweight SDN Fingerprint Attack Defense Mechanism Based on Probabilistic Scrambling and Controller Dynamic Scheduling Strategies

“…Bilal and Nadeem [15] focused on a specific data plane attack referred to as Flow Table Entry Attack (FTEA) to infer the flow replacement policy in an SDN-based environment. Hou et al [16] presented a finegrained fingerprinting method that it can learn the match fields of flow rules by distinguishing the transmission delays of different packets. Cao et al [17] designed a deep learningbased method to fingerprint SDN applications from mixed control traffic.…”

“…add(index) (6) H(index).Counter ← 0 and H(index).Tag ← 0 (7) for NumTag � 0 to m do (8) setDelayTag(Flow(index).Packet NumTag , genProbability(NumTag) (9) if the label of Flow(index).Packet NumTag is delayed, then (10) delay(Flow(index).Packet NumTag , random(0.5, 1) * rtt) to proxy (11) end if (12) end for (13) H(index).Tag ← NumTag (14) else (15) H(index).Counter ← H(index).Counter + 1 (16) if H(packet i ).Counter � H(index).Tag, then (17) for NumTag � H(index).Tag to H(index).Tag + m do (18) setDelayTag(Flow(index).Packet NumTag , genProbanility(NumTag)) (19) if the label of Flow(index).Packet NumTag is delayed, then (20) delay(Flow(index).Packet NumTag , random(0.5, 1) * rtt) ro proxy (21) end if (22) end for packets of the flow, the probability decision component updates the counter value and compares the value with the tag value. Once the two values are detected to be equal, a new round of packet advance decision is made (lines [16][17][18] and the tag value is updated (line 23). e advanced decision mechanism effectively avoids the controller to make finegrained interference decisions for each packet in real time (if each packet in the flow requires a fine-grained decision by the controller, it means that each packet will be disturbed, which will degrade network performance).…”

“…If the value is less than the alert value, it means that the innovative attacker is less likely to appear. e scheduling execution component can still guide the controller to schedule based on the scheduling time (lines [11][12][13][14][15][16][17][18][19].…”