Title
Behavior Anomaly Detection In Sdn Control Plane:A Case Study Of Topology Discovery Attacks
Abstract
The SDN controller uses the OpenFlow Discovery Protocol (OFDP) to collect network topology status. OFDP detects the link between OpenFlow switches by generating Link Layer Discovery Protocol (LLDP) packets. However, OFDP is not a completely secure protocol and can be used by attackers to perform topology discovery injection attacks, topology discovery man-in-the-middle attacks, and topology discovery flood attacks, thereby confusing the network topology. This paper proposes a Correlation-based Topology Anomaly Detection (CTAD) mechanism to run in a software-defined network controller. Spearman's rank correlation is used to analyze the correlation between network traffic between links and measure the time difference between the round trip time of each LLDP frame to determine whether the topology man-in-the-middle attack exists in the network. This paper also adds a dynamic authentication key and counting mechanism in the LLDP frame to prevent attackers from using the topology discovery injection attack to generate fake links and topology discovery flooding attacks, causing network routing or switching abnormalities.
Year
DOI
Venue
2019
10.1109/ictc46691.2019.8939903
2019 10TH INTERNATIONAL CONFERENCE ON INFORMATION AND COMMUNICATION TECHNOLOGY CONVERGENCE (ICTC): ICT CONVERGENCE LEADING THE AUTONOMOUS FUTURE
Keywords
Field
DocType
Software Defined Networking, topology discovery attacks, OpenFlow Discovery Protocol, Link Layer Discovery Protocol
Topology,Anomaly detection,Authentication,Computer science,Network packet,Network topology,OpenFlow,Software-defined networking,Network interface controller,Link Layer Discovery Protocol
Conference
ISSN
Citations 
PageRank 
2162-1233
0
0.34
References 
Authors
0
9
Name
Order
Citations
PageRank
Li-Der Chou131038.42
Chien-Chang Liu2152.74
Meng-Sheng Lai300.68
Kai-Cheng Chiu400.34
Hsuan-Hao Tu500.34
Sen Su600.34
Chun-Lin Lai700.34
Chia-Kuan Yen800.68
Wei-Hsiang Tsai900.68