Fast and accurate detection of compromised switches in software-defined networks

Abstract

Software-Defined Networking (SDN) has emerged as one of the significant network architectures that decouples the network’s control plane from the data plane. Due to the noteworthy scope of innova- tion with reduced cost of management and many built-in salient features, SDN has recently gained unparalleled attention both from industry and academia. Though SDN resolves many existing se- curity threats, it suffers from traditional network security threats as well as new threats related to its decentralized architecture. Most of the proposals that have been made recently to resolve security vul- nerabilities in all layers of SDN, will not function when one or more switches in the network behave abnormally or do not follow the commands from SDN controller. Therefore, a compromised switch will bring colossal network adversity as it may launch DoS, Eavesdropping, Man-in-the-middle, and Topology spoofing attacks other than disobeying controller’s command. Recent works accomplish the goal of detecting compromised switch in SDN by sending probe packets or analyzing flow statistics. These existing approaches have many weak links such as high traffic overhead for detection or high false positive detection rate. These approaches also work under some unrealistic assumptions, such as no collaboration among malicious switches, no flow statistics alteration by the attacker, etc. In this thesis, a hybrid and real-time detection framework “FADCS” has been developed which would work efficiently with a view to lessening the weakness of existing available approaches. “FADCS” has been developed as an application in “Floodlight” controller and its performance has been evaluated in a simulation environment built using Mininet and FNSS. The experiment result assures that “FADCS” can successfully detect all major unruly forwarding behavior of a compromised switch in real-time with zero false positive detection rate and without incurring a great network traffic overhead.