Control Plane Reflection Attacks in SDNs: New Attacks and Countermeasures
Control Plane Reflection Attacks in SDNs: New Attacks and Countermeasures
复制标题
DOI：
10.1007/978-3-030-00470-5_8
复制
发表时间：
2018-09
期刊：
影响因子：
--
通讯作者：
Menghao Zhang;Guanyu Li;Lei Xu;J. Bi;G. Gu;Jia-Ju Bai
中科院分区：
文献类型：
--
作者：
Menghao Zhang;Guanyu Li;Lei Xu;J. Bi;G. Gu;Jia-Ju Bai
随着各种支持 SDN 的硬件交换机的出现，软件定义网络 (SDN) 的部署范围不断扩大，从企业数据中心到云计算。在本文中，我们提出了控制平面反射攻击，以利用支持 SDN 的硬件交换机的有限处理能力。反射攻击采用直接和间接数据平面事件来迫使控制平面向SDN交换机发出大量昂贵的控制消息。此外，我们提出了一种两阶段探测触发攻击策略，使反射攻击更加高效、隐蔽和强大。在物理 OpenFlow 交换机测试台上进行的实验表明，这些攻击可能会导致灾难性的结果，例如损害新流的建立，甚至破坏 SDN 控制器和交换机之间的连接。为了减轻此类攻击，我们提出了一种名为 SWGuard 的新型防御框架。特别是，SWGuard 检测下行链路消息的异常，并根据新颖的监控粒度（即主机应用程序对 (HAP)）对这些消息进行优先级排序。实施和评估表明，SWGuard 可以有效减少合法主机和应用程序在控制平面反射攻击下的延迟，而只需很小的开销。
Software-Defined Networking (SDN) continues to be deployed spanning from enterprise data centers to cloud computing with emerging of various SDN-enabled hardware switches. In this paper, we present Control Plane Reflection Attacks to exploit the limited processing capability of SDN-enabled hardware switches. The reflection attacks adopt direct and indirect data plane events to force the control plane to issue massive expensive control messages towards SDN switches. Moreover, we propose a two-phase probing-triggering attack strategy to make the reflection attacks much more efficient, stealthy and powerful. Experiments on a testbed with physical OpenFlow switches demonstrate that the attacks can lead to catastrophic results such as hurting establishment of new flows and even disruption of connections between SDN controller and switches. To mitigate such attacks, we propose a novel defense framework called SWGuard. In particular, SWGuard detects anomalies of downlink messages and prioritizes these messages based on a novel monitoring granularity, i.e., host-application pair (HAP). Implementations and evaluations demonstrate that SWGuard can effectively reduce the latency for legitimate hosts and applications under Control Plane Reflection Attacks with only minor overheads.