SDN中的DDoS防御：分类、挑战与前景

DDoS

SDN

需积分: 9 36 浏览量更新于2024-06-30 收藏 3.57MB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

"Sukhveer Kaur, Krishan Kumar, Naveen Aggarwal, 和 Gurdeep Singh 在《计算机与安全》杂志上发表的文章 'SDN中DDoS防御解决方案的综合调查：分类、研究挑战和未来方向'，探讨了在软件定义网络（SDN）环境下的分布式拒绝服务（DDoS）攻击防御策略。文章于2021年1月25日提交，7月5日修订，7月29日接受，并于8月8日在线发布。关键词包括软件定义网络、OpenFlow、DDoS攻击、数据平面、控制平面和安全性。" 在软件定义网络（SDN）的背景下，DDoS防御解决方案面临着新的挑战。SDN通过将控制平面和数据平面分离，提高了网络的灵活性和可编程性，但同时也暴露出新的安全漏洞。DDoS攻击是利用大量恶意流量淹没目标网络或服务，使其无法正常运行的攻击方式。在SDN环境中，由于集中式的控制平面成为了攻击者的目标，因此需要特别关注其安全性。首先，文章可能详细介绍了SDN中的DDoS防御分类。这些防御措施可能包括检测技术（如基于统计的异常检测、深度包检查）、缓解策略（如流量整形、资源隔离）、以及预防机制（如认证和授权、动态流量重定向）。此外，可能还讨论了OpenFlow协议在DDoS防御中的角色，因为OpenFlow允许控制器对流表进行精细管理，从而能够识别和阻止恶意流量。其次，研究挑战部分可能会涵盖SDN的实时性问题，即如何快速有效地检测并响应DDoS攻击。此外，可能还会讨论隐私和数据保护，因为中央控制器可能成为敏感信息的集中点。此外，由于SDN的开放性，固有的安全漏洞也是挑战，比如控制器的安全防护、网络设备的认证和完整性保护。最后，未来方向可能涉及到利用网络功能虚拟化（NFV）、意图驱动的网络、物联网（IoT）和5G等新技术来增强DDoS防御。例如，NFV可以提供灵活的资源分配和动态部署防御服务，而意图驱动的网络则可以自动化防御策略的制定。同时，随着物联网设备数量的增加，对边缘计算的利用也可能成为一种趋势，以在更接近源头的位置处理攻击。这篇文章深入分析了SDN环境下DDoS防御的现状，挑战以及潜在的解决方案，为研究人员和从业者提供了有价值的参考，以应对不断演变的网络安全威胁。

资源详情

资源推荐

computers & security 110 (2021) 102423 7

Fig. 4 –SDN architecture.

Table 3 – Distribution of the studies according to publica-

tion type.

Publication type No.of studies Percentage

Journal 58 77.33%

Conference 14 18.66%

Symposium 3 4%

3. Background

3.1. SDN architecture

SDN is a promising architecture that separates the con-

trol functionality from the forwarding hardware and pro-

vides exibility and programmability in todays data center

( Jarraya et al., 2014 ). The SDN is a three layer architecture

which consists of control plane (controller), data plane (for-

warding plane), and application plane (management plane),

as shown in Fig. 4 . The data plane contains one or more

switches that forward the packets. Most of the switches avail-

able in the market are based on the OpenFlow protocol. There-

fore, SDN switches are also called OpenFlow enabled switches.

The control plane comprises different controllers that con-

vert these switches into intelligent devices like router, IDS, IPS,

and rewall depending on the program running on the appli-

cation plane. The southbound API (popularly used OpenFlow)

provides the connection between the control plane and SDN

switches ( Braun and Menth, 2014 ). The applications can com-

municate with the controller with the aid of northbound in-

terface ( Zhou et al., 2014 ).

3.1.1. Data plane

Data plane comprises OpenFlow enabled switches that handle

the trafc according to the instructions given by the controller.

OpenFlow switches maintain a ow table that includes three

elds: match, actions, and counters. The match eld contains

various matching header elds like Ethernet, IP, TCP or UDP

and others depending upon the version of OpenFlow (OF) pro-

tocol. The OF version 1.0 ( OpenNetworkFoundation, 2009 ) sup-

ports 12 matching elds, and OF version 1.5 ( Open Network-

ing Foundation, 2015 ) supports 44 matching elds. There are

various types of actions available in the action eld, like for-

warding/dropping the packet, etc. The counter eld is used for

quality of service to count the number of packets per ow.

When an OpenFlow enabled device receives the packets, it

matches these packets with the ow table rules. If the pack-

ets are matched, then it performs a particular action associ-

ated with that entry, like forwarding and dropping the packet

( Hu et al., 2014 ). Otherwise, it drops the packet or sends the

packet to the controller using the southbound interface. As

directed by the program running on the application plane, the

controller inserts or modies the ow entries into the Open-

Flow switch.

3.1.2. Control plane

Control plane work as a Network Operating System (NOS)

which decide the functionality of SDN switches. It has a con-

8 computers & security 110 (2021) 102423

trol over the complete network. The centralized controller

maintains the complete picture of the network so it can exam-

ine the network trafc in a better way as compared to tradi-

tional network ( Salman et al., 2016 ). Some of the popular SDN

controllers ( Shalimov et al., 2013 ) include NOX ( Gude et al.,

2008 ), POX ( Kaur et al., 2014 ), Ryu ( Shalimov et al., 2013 ), Bea-

con ( Erickson, 2013 ), Opendaylight ( Khattak et al., 2014 ), Flood-

light ( Bholebawa and Dalal, 2018 ), ONIX ( Koponen et al., 2010 ),

ONOS ( Berde et al., 2014a ).

3.1.3. Application plane

In the SDN Architecture, application plane comprises multi-

ple applications like load balancer, rewall, trafc monitoring,

and others that are running on the controller. These applica-

tions dene the functionality of the forwarding device. In this

way, the SDN utilizes the network infrastructure in a better

way than the traditional network. In SDN, the same device can

perform different functionalities, but in the conventional net-

work, each device performs dedicated functionality due to its

rigid architecture.

3.1.4. Southbound API

SDN separates the control functionality from the forwarding

hardware and the southbound interface is needed to provide

communication between these two planes. There are various

southbound APIs available like ForCES ( Haleplidis et al., 2015 ),

OpenFlow ( McKeown et al., 2008 ), Netconf ( Denazis et al.,

2015 ). The OpenFlow is the standard southbound interface de-

ned by the Open Network Foundation (ONF). For secure com-

munication through the southbound interface, transport layer

security is implemented on OpenFlow protocol, but this is

not mandatory as recommended by the ONF ( Agborubere and

Sanchez-Velazquez, 2018 ).

3.1.5. Northbound API

Applications in the management plane interact with the con-

troller through the northbound API. There are various types

of northbound APIs such as REST API ( Zhou et al., 2014 ), Fren-

tic ( Foster et al., 2010 ), Pyretic ( Reich et al., 2013 ), Procera

( Voellmy et al., 2012 ), Netcore ( He et al., 2017 ). The standard-

ization of the northbound interface is still a topic of discussion

due to its dynamic nature.

3.2. Vulnerable points in the SDN architecture

The SDN makes the management of networks easier by con-

trolling the network behavior from a single point. The overall

expenses of the network are reduced by using vendor agnos-

tic network operating system instead of using vendor-specic

tightly coupled hardware devices. In spite of the advantages

of the SDN, it comes up with some limitations. The security

of SDN has become a signicant concern among the research

community and industry ( Chica et al., 2020; Tus h ar Ubale,

2019 ). The various target points of attacks in SDN architecture

are shown in Fig. 5 ( ROCHAK SWAMI, MAYANK DAVE, 2019 ).

Moreover, the authors identied vulnerabilities at all the tar-

get points as depicted in Fig. 5 ; these weaknesses are exploited

by the attacker to launch various kinds of attacks on SDN ar-

chitecture. Table 5 shows the various security threats associ-

ated with different SDN layers.

(i) Data plane switches : Data plane consists of dumb Open-

Flow enabled switches that make it vulnerable to sev-

eral security threats like ow table modication, topol-

ogy spoong, and DDoS attack ( Gao et al., 2018b ). In the

ow table modication attack, a malicious node inserts

or modies the ow table rules to sniff ongoing com-

munication happening in a network or to perform Man-

in-the-middle Attack (MITM), resulting in loss of data

integrity. The purpose of topology spoong attack is to

create a fake network view for the controller to redi-

rect the trafc to the attackers machine. Moreover, the

limited memory and processing constraints in the SDN

switches make it vulnerable to ow table overloading

and buffer saturation attack ( Durner et al., 2017 ).

(ii) Southbound interface : The Openow is a popular south-

bound protocol. However, it does not impose the se-

cure connection between OpenFlow switch and con-

troller because TLS level security is recommended but

not mandatory. The lack of TLS security will open the

door for attackers because when the controller inserts

rules into the OpenFlow switch through the south-

bound interface, these rules can be easily intercepted by

the attacker ( Agborubere and Sanchez-Velazquez, 2018 ).

Therefore, an attacker can modify existing ow rules or

add malicious ow entries to misdirect packets, which

can have devastating effects on the entire network.

Moreover, the limited bandwidth capacity of communi-

cation channel makes it vulnerable to bandwidth satu-

ration attack. To exhaust the bandwidth of communi-

cation channel, a malicious node crafts the values of

packet header elds so that these packets are not able to

match with the existing ow rules and switch is forced

to send these packets to the controller, resulting in con-

gestion on the communication channel.

(iii) SDN controller : It becomes the main target of attack-

ers as it controls the whole network. If the attacker

impersonates the controller or modies its function-

ality in some way, then it can destroy the entire net-

work. A hijacked controller can perform various attacks

such as blackhole, fake ow rule insertion, and DDoS

attack. A malicious controller can insert fake ow rules

to change the route of the packets, resulting in losing

data integrity and condentially of sensitive informa-

tion. In the SDN architecture, a switch sends every new

packet of a ow to the controller. An attacker exploits

this property of SDN to exhaust the computational and

network resources of the control plane by generating

a huge amount of fake new packets ( Han et al., 2019;

Wang et al., 2017 ).

(iv) Northbound interface : The applications use the north-

bound interface to collect the network statistics or to

give instructions to the controller for managing the net-

work. Due to the lack of standardization, this interface

is susceptible to multiple security threats such as tam-

pering, DoS, and eavesdropping ( Laan, 2015 ).

(v) Applications plane : In the SDN framework, forwarding de-

vices are dumb devices and behave according to the pro-

gram running on the controller. Due to the lack of au-

thentication and access control mechanism, this plane

is susceptible to multiple security threats like malicious

剩余38页未读，继续阅读

Liar_n

粉丝: 4
资源: 1

SDN中的DDoS防御：分类、挑战与前景

基于SDN技术的DDoS防御系统简析.pdf

基于SDN构架的DoS/DDoS攻击检测与防御体系

初识DHCP和SDN：入门指南

VLAN和SDN：软件定义网络对VLAN的影响

OpenStack与SDN：利用Neutron与OpenDaylight实现灵活的网络编排

SPARQL检索SDN网络故障

DDos异常流量数据分析系统国内外研究现状

SDN下的DDoS防御研究

sdn网络设备可以分为哪四种

基于SDN的DDOS攻击检测国内外研究现状

基于sdn的ddos防御系统

基于sdn的ddos攻击检测与防御

基于sdn的ddos攻击检测的研究意义

SDN设备有哪几种类型

基于SDN来防御DDoS攻击

计算机网络近三年参考文献

sdn网络设备可以分为哪几种

详细阐述SDN下的DDoS检测研究综述

SDN应用策略冲突综述

最新资源