TY - JOUR
T1 - SDNShield
T2 - NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane
AU - Chen, Kuan Yin
AU - Liu, Sen
AU - Xu, Yang
AU - Siddhrau, Ishant Kumar
AU - Zhou, Siyu
AU - Guo, Zehua
AU - Chao, H. Jonathan
N1 - Publisher Copyright:
© 1993-2012 IEEE.
PY - 2022/2/1
Y1 - 2022/2/1
N2 - Software-defined networking (SDN) is increasingly popular in today's information technology industry, but existing SDN control plane is insufficiently scalable to support on-demand, high-frequency flow requests. Weaknesses along SDN control paths can be exploited by malicious third parties to launch distributed denial-of-service (DDoS) attacks against the SDN control plane. Recently proposed solutions only partially solve the problem, by protecting either the SDN network edges or the centralized controller. We propose SDNShield, a solution based on emerging network function virtualization (NFV) technologies, which enforces more comprehensive defense against potential DDoS attacks on SDN control plane. SDNShield incorporates a three-stage overload control scheme. The first stage statistically identifies legitimate flows with low complexity and performance overhead. The second stage further performs in-depth TCP handshake verification to ensure good flows are eventually served. The third stage intellectually salvages the misclassified legitimate flows that are falsely dropped from the first two stages. Prototype tests and real data-driven simulation results show that SDNShield can achieve high resilience against brute-force attacks, and maintain good flow-level service quality at the same time.
AB - Software-defined networking (SDN) is increasingly popular in today's information technology industry, but existing SDN control plane is insufficiently scalable to support on-demand, high-frequency flow requests. Weaknesses along SDN control paths can be exploited by malicious third parties to launch distributed denial-of-service (DDoS) attacks against the SDN control plane. Recently proposed solutions only partially solve the problem, by protecting either the SDN network edges or the centralized controller. We propose SDNShield, a solution based on emerging network function virtualization (NFV) technologies, which enforces more comprehensive defense against potential DDoS attacks on SDN control plane. SDNShield incorporates a three-stage overload control scheme. The first stage statistically identifies legitimate flows with low complexity and performance overhead. The second stage further performs in-depth TCP handshake verification to ensure good flows are eventually served. The third stage intellectually salvages the misclassified legitimate flows that are falsely dropped from the first two stages. Prototype tests and real data-driven simulation results show that SDNShield can achieve high resilience against brute-force attacks, and maintain good flow-level service quality at the same time.
KW - Distributed denial-of-service
KW - network function virtualization
KW - network security
KW - software-defined networking
UR - http://www.scopus.com/inward/record.url?scp=85113857676&partnerID=8YFLogxK
U2 - 10.1109/TNET.2021.3105187
DO - 10.1109/TNET.2021.3105187
M3 - Article
AN - SCOPUS:85113857676
SN - 1063-6692
VL - 30
SP - 1
EP - 17
JO - IEEE/ACM Transactions on Networking
JF - IEEE/ACM Transactions on Networking
IS - 1
ER -