SaTC: CORE: Small: Adversarial Network Reconnaissance in Software Defined Networking

软件定义网络（SDN）从根本上改变了网络和构建在其上的系统的创建和维护方式。快速部署和重新配置SDN及其支持的服务的能力使组织能够灵活地应对不断变化的需求和威胁。此外，当与网络功能虚拟化（NFV）一起部署时，SDN使防火墙，网络入侵检测系统（NIDS）和负载均衡器等网络服务能够从其部署的物理基础设施中抽象出来，从而大大简化服务组合和扩展。然而，随着SDN被广泛采用，安全问题也随之出现。一方面，SDN的逻辑集中视图简化了对传统IP网络攻击（如端口扫描和防火墙探测）的防御。另一方面，SDN引入了对抗性侦察的新机会，这是一系列技术，允许内部和外部攻击者使用网络行为和控制平面消息来推断目标SDN的结构，配置和漏洞。为了保护未来的网络免受此类攻击者的攻击，该项目建议系统地了解SDN中对抗性侦察的技术，能力，基本限制和对策。该项目计划开发侦察技术的系统建模和分析，并在SDN中启用攻击。这种侦察的目的包括秘密提取策略（例如，规则替换策略）和各州（例如，网络拥塞状态、链路负载）。该项目计划通过开发和评估显式推理算法来实现这些目标，这些算法可以从容易获得的测量中学习目标SDN的内部参数，具体工作集中在基于主机的交换机内部参数侦察，以及基于交换机的内部逻辑侦察和重要控制应用的状态。为了了解对抗性侦察的后果，该项目还计划开发和评估利用侦察期间学习的网络参数的智能攻击。这种攻击的一般目标是在造成可测量的损害的同时最小化检测的风险，具体努力集中在设计攻击流以实现攻击性能和成本之间的最佳权衡的基于主机的智能攻击，以及利用目标控制应用的学习逻辑和状态的基于交换机的智能攻击（例如，负载平衡器）来操纵其决策。 这项工作将开发新的理论，算法，方法，评估工具和在线工具，将网络科学与安全分析结合起来，并与模拟和真实世界的实验相结合。其成果将推动SDN安全和漏洞分析的科学和实践，并通过激励攻击弹性设计来增强未来SDN的安全性。这项工作还将支持参与机构的教育，培养SDN和安全分析方面的专业人才，并促进PI在扩大参与计算方面的积极努力。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Software-defined networks (SDNs) have fundamentally altered the way in which networks and the systems built upon them are created and maintained. The ability to rapidly deploy and reconfigure SDNs and their supported services allow organizations to be agile in addressing changing needs and threats. Moreover, when deployed together with Network Function Virtualization (NFV), SDN enables network services such as firewalls, network intrusion detection systems (NIDS), and load balancers to be abstracted from the physical infrastructure that they are deployed on, thereby greatly simplifying service composition and scaling. However, as SDNs become widely adopted, the issue of security emerges. On the one hand, the logically centralized view of SDN eases defenses against traditional IP-network attacks such as port scanning and firewall probing. On the other hand, SDN introduces new opportunities for adversarial reconnaissance, which is a family of techniques that allow insider and outsider attackers to use the network behavior and control-plane messaging to infer the structure, configuration, and vulnerabilities of the target SDN. To secure future networks against such attackers, this project proposes to develop a systematic understanding of the techniques, capabilities, fundamental limits, and countermeasures of adversarial reconnaissance in SDNs. The project plans to develop systematic modeling and analysis of reconnaissance techniques and enabled attacks in SDNs. The objectives of such reconnaissance include the covert extraction of the policies (e.g., rule replacement policy) and the states (e.g., network congestion state, link loads) at both the network level and the service level. The project plans to achieve these objectives by developing and evaluating explicit inference algorithms that can learn the internal parameters of the target SDN from easily obtainable measurements, with concrete efforts focused on host-based reconnaissance of the internal parameters of switches, as well as switch-based reconnaissance of the internal logic and state of important control applications. To understand the consequence of adversarial reconnaissance, the project also plans to develop and evaluate intelligent attacks that make use of the network parameters learned during reconnaissance. The general objective of such attacks is to minimize the risk of detection while causing measurable damage, with concrete efforts focused on intelligent host-based attacks that design attack flows to achieve the optimal tradeoff between attack performance and cost, as well as intelligent switch-based attacks that exploit the learned logic and state of the target control application (e.g., load balancer) to manipulate its decisions. This work will develop new theories, algorithms, methodologies, evaluation harnesses, and online tools by combining network science with security analysis in concert with simulated and real-world experiments. Its outcome will advance the science and practice of SDN security and vulnerability analysis and enhance the security of future SDNs by motivating attack-resilient designs. The work will also support education at the participating institution and develop workforce expertise in SDN and security analysis, as well as fostering the PIs’ already active efforts in Broadening Participation in Computing.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.