Stealthy Probing-Based Verification (SPV): An Active Approach to Defending Software Defined Networks Against Topology Poisoning Attacks

摘要: Since a key advantage of Software Defined Networks (SDN) is providing logically centralized view the network topology, correctness such becomes critical for SDN applications to make right management decisions. However, recently discovered vulnerabilities in OpenFlow Discovery Protocol (OFDP) show that malicious hosts and switches can poison controller consequently lead more severe security attacks, as man-in-the-middle or denial service. Existing solutions mostly rely on passive techniques, which only work known attacking methods. In this paper, we propose novel stealthy probing-based verification approach, namely, SPV, detect fake links regardless methods used fabricate them. Specifically, SPV incrementally verifies legitimate detects by sending probing packets designed be indistinguishable from normal traffic. To illustrate feasibility our implement an emulated environment using Mininet OpenDaylight. We further evaluate applicability performance based real SDN/cloud topology. The experimental results respond near real-time (e.g., less than 120 ms) both environments, makes scalable solution large networks.