Network-Wide Forwarding Anomaly Detection and Localization in Software Defined Networks
Network-Wide Forwarding Anomaly Detection and Localization in Software Defined Networks
复制标题
软件定义网络中的全网转发异常检测和定位
DOI：
10.1109/tnet.2020.3033588
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Chengchen Hu
中科院分区：
文献类型：
--
作者：
Peng Zhang;Fangzheng Zhang;Shimin Xu;Zuoru Yang;Hao Li;Qi Li;Huanzhao Wang;Chao Shen;Chengchen Hu
软件定义网络(SDN)的一个重要要求是数据平面转发行为应始终符合控制平面策略。当存在转发异常时，不能满足这种要求，在转发异常时，分组偏离控制器指定的路径。大多数SDN的异常检测方法都设置了专门的规则来收集每个流量的统计数据，并检查统计数据是否符合流量守恒原则。我们发现这些方法的检测范围有限：它们每次只检查一个流，因此只能同时检查少量的流。此外，专用的统计收集规则可能会给SDN交换机的流表带来很大的开销。为此，本文提出了一种SDN中的全网转发异常检测与定位方法Foces。与以往的方法不同，Focus在网络范围内应用了一种新的流守恒原理，可以同时检查网络中所有流的转发行为，而不需要安装任何专用规则。最后，当检测到异常时，Foces应用基于投票的方法来定位恶意交换机。实验结果表明，在丢包率不大于10%的情况下，FOCES能够达到90%以上的检测精度；在丢包率不超过5%的情况下，定位精度可以达到80%左右。
A crucial requirement for Software Defined Network (SDN) is that data plane forwarding behaviors should always agree with control plane policies. Such requirement cannot be met when there are forwarding anomalies, where packets deviate from the paths specified by the controller. Most anomaly detection methods for SDN install dedicated rules to collect statistics of each flow, and check whether the statistics conform to the “flow conservation principle”. We find these methods have a limited detection scope: they look at one flow each time, thus can only check a small number of flows simultaneously. In addition, dedicated rules for statistics collection can impose a large overhead on flow tables of SDN switches. To this end, this paper presents FOCES, a network-wide forwarding anomaly detection and localization method in SDN. Different from previous methods, FOCES applies a new kind of flow conservation principle at network wide, and can check forwarding behaviors of all flows in the network simultaneously, without installing any dedicated rules. Finally, FOCES applies a voting-based method to localize malicious switches when anomalies are detected. Experiments with four network topologies show that FOCES can achieve a detection precision higher than 90%, when the packet loss rate is no larger than 10%, and a localization accuracy of around 80% when the packet loss rate is no larger than 5%.