Defending SDN against packet injection attacks using deep learning

01/20/2023
by   Anh Tuan Phu, et al.
0

The (logically) centralised architecture of the software-defined networks makes them an easy target for packet injection attacks. In these attacks, the attacker injects malicious packets into the SDN network to affect the services and performance of the SDN controller and overflow the capacity of the SDN switches. Such attacks have been shown to ultimately stop the network functioning in real-time, leading to network breakdowns. There have been significant works on detecting and defending against similar DoS attacks in non-SDN networks, but detection and protection techniques for SDN against packet injection attacks are still in their infancy. Furthermore, many of the proposed solutions have been shown to be easily by-passed by simple modifications to the attacking packets or by altering the attacking profile. In this paper, we develop novel Graph Convolutional Neural Network models and algorithms for grouping network nodes/users into security classes by learning from network data. We start with two simple classes - nodes that engage in suspicious packet injection attacks and nodes that are not. From these classes, we then partition the network into separate segments with different security policies using distributed Ryu controllers in an SDN network. We show in experiments on an emulated SDN that our detection solution outperforms alternative approaches with above 99% detection accuracy on various types (both old and new) of injection attacks. More importantly, our mitigation solution maintains continuous functions of non-compromised nodes while isolating compromised/suspicious nodes in real-time. All code and data are publicly available for reproducibility of our results.

READ FULL TEXT

page 10

page 11

research
11/01/2018

SDFW: SDN-based Stateful Distributed Firewall

SDN provides a programmable command and control networking system in a m...
research
04/29/2020

Towards Understanding Man-on-the-Side Attacks (MotS) in SCADA Networks

We describe a new class of packet injection attacks called Man-on-the-Si...
research
05/25/2022

P4Filter: A two level defensive mechanism against attacks in SDN using P4

The advancements in networking technologies have led to a new paradigm o...
research
01/04/2021

Machine Learning based Malicious Payload Identification in Software-Defined Networking

Deep packet inspection (DPI) has been extensively investigated in softwa...
research
04/24/2020

Towards Model Checking Real-World Software-Defined Networks

In software-defined networks (SDN) a controller program is in charge of ...
research
04/24/2020

Towards Model Checking Real-World Software-Defined Networks (version with appendix)

In software-defined networks (SDN), a controller program is in charge of...
research
08/30/2018

Securing Tag-based recommender systems against profile injection attacks: A comparative study

This work addresses challenges related to attacks on social tagging syst...

Please sign up or login with your details

Forgot password? Click here to reset