Lightweight Detection and Mitigation Method for IP Spoofing Attacks in Software Defined Network

doi:10.21203/rs.3.rs-4849667/v1

Download PDF

Research Article

Lightweight Detection and Mitigation Method for IP Spoofing Attacks in Software Defined Network

https://doi.org/10.21203/rs.3.rs-4849667/v1

This work is licensed under a CC BY 4.0 License

You are reading this latest preprint version

In response to the problems of high computational overhead and lack of flexibility in traditional IP spoofing attack mitigation methods, a method for mitigating IP spoofing attacks in SDN based on a dynamic restriction strategy is proposed. By using the triplet information in the Packet-In message to trace the attack path and locate the source host of the IP spoofing attack; the controller formulates a dynamic restriction strategy to limit the new flow forwarding function of the switch port connected to the attack source host, and then restores its function to forward new flows after the restriction period expires; the duration of the restriction period increases with the number of times it is detected as an attack source. This dynamic restriction strategy can prevent attack traffic from entering the SDN network, thereby effectively avoiding the overload of SDN switches, controllers, and links. Additionally, since there is no need for real-time monitoring of these restricted switch ports during the restriction period, this method has a higher mitigation efficiency and consumes fewer resources when dealing with long-duration attacks compared to traditional methods.

Software Defined Network

IP spoofing

Attack mitigation

Attack tracing

With the continuous development of information technology, the scale of the Internet continues to grow, and the needs of Internet users are becoming increasingly diverse. Software Defined Network (SDN), with its centralized control and programmability advantages, can decouple the control and forwarding function of network devices, enabling the network to develop independently of hardware, and can meet the diverse needs of Internet users. It has gradually attracted the attention and favor of a wide range of equipment manufacturers and network operators [1]. However, the openness of the SDN architecture makes it more susceptible to network attacks. Attackers only need to send many flows containing forged IP addresses to any SDN switch to achieve a DoS attack on the SDN network, causing switch flow table overflow and controller overload. Therefore, how to timely block the attack traffic from entering the network in the face of an attack on SDN, alleviate the impact of the attack, and maintain a relatively stable state of the network, has always been a hot topic in SDN technology research. The related research work has important theoretical and practical significance for the promotion and application of SDN.

Attack mitigation refers to the countermeasures taken after detecting the source host of an attack or the access switch, to slow down or prevent the attack from causing further damage to the network and to maintain the quality of network services. There are currently three main implementation approaches: load balancing-based methods, restriction policy-based methods, and rerouting policy-based methods [2]. However, the load-balancing-based method can only alleviate the impact of the attack behavior and cannot prevent the attack packets from entering the network. The mitigation based on rerouting policies is like the load balancing method; although it allows for dynamic network adjustment, it also adds additional computational and communication overhead to the network system. Restriction policy-based methods usually require the addition of new components or the implementation through control messages of the switch, which not only increases the network resource overhead but also typically results in fixed mitigation solutions that lack dynamic adaptability.

Given the excellent control and storage capabilities of SDN, it can support the tracing of the source of network attacks and block attack traffic by formulating flexible forwarding policies. Therefore, this paper proposes a dynamic restriction strategy-based attack mitigation method for IP spoofing attacks in OpenFlow SDN networks. This method can trace the source of the attack by parsing effective information through Packet-In messages without significantly increasing the computational overhead and bandwidth consumption of network devices. It implements dynamic restriction strategies on the attacking host or the access switch port, blocking the attack source host from sending attack packets into the network, thereby mitigating the impact of the attack on the quality of service of the SDN network.

In this manuscript, we have presented the research highlights as follows:

(1) Dynamic Restriction Strategy:

The method uses a dynamic restriction strategy to mitigate IP spoofing attacks. It leverages the information contained within Packet-In messages to trace the path of the attack and identify the source host.
Once the source is located, the SDN controller enacts a dynamic restriction strategy that limits the ability of the switch port connected to the attack source host to forward new flows.
The restriction period is adjustable and increases with the frequency of detection of the host as an attack source, which prevents the source from sending further attack packets into the network.

(2) Efficient IP Spoofing Attack Tracing and Mitigation:

By tracing the IP spoofing attack path, the controller can implement a dynamic restriction strategy without significantly increasing the computational overhead or bandwidth consumption of the network devices.
After the restriction period, the controller restores the port's ability to forward new flows, which reduces the need for real-time monitoring and conserves resources, especially during long-duration attacks.

(3) Algorithm for Managing Flow Table Entries:

The paper includes an algorithm designed to periodically clean up flow table entries in switches that have not been matched for a long time, particularly those created by early attack traffic.
This dynamic deletion strategy helps to maintain the reliability of the switch's forwarding function by freeing up space in the flow table and ensuring higher-quality network services.

The structure of this paper is as follows: Section 2 introduces related research work; Section 3 provides a detailed description of the proposed mitigation method; Section 4 verifies the proposed method and analyzes the experimental results; and Section 5 summarizes the entire paper.

SDN, with its innovative network architecture and efficient network management capabilities, has become an important direction in the development of network technology. It consists of a forwarding plane, a control plane, and an application plane, with each layer interconnected through open network interface protocols [3], as shown in the logical architecture in Fig. 1. The forwarding plane mainly includes network node devices such as switches and routers, which are responsible for the actual forwarding of data packets. The control plane contains several controllers in charge of responding to instructions from the application plane and formulating and issuing data packet forwarding policies; the application plane mainly includes network applications, such as firewalls and traffic control, among other network applications. The northbound interface is between the controller and the application, which currently lacks a unified standard. The southbound interface is the interface between the controller and the forwarding device, through which the controller issues rules to the forwarding device to achieve control and management of the SDN network [4], with the commonly used standard being the OpenFlow protocol.

2.1 OpenFlow Protocol and Its Vulnerabilities

OpenFlow is currently the most influential southbound interface protocol, through which the controller deploys the corresponding flow tables on the forwarding devices via the interface provided by OpenFlow, thereby achieving control over the forwarding plane [5]. Each flow table entry in the OpenFlow switch's flow table is composed of match fields, priority, counters, instructions, timeouts, Cookie, Flags, etc. The structure of the OpenFlow v1.5 flow table entry is shown in Table 1.

Table 1

Structure of OpenFlow V1.5 Flow Table Entry
Match Fields	Priority	Counters	Instructions	Timeouts	Cookie	Flags

The match fields are a combination of network packet protocol domains, such as the destination MAC address, the source MAC address, the destination IP address, the source IP address, the TCP port, etc. These combinations can identify the flow corresponding to the table entry. For example, a flow can be aggregated based on the source IP address, or another flow can be aggregated based on both the source IP address and the destination IP address. Priority is mainly used to determine the order of matching for flow table entries when multiple entries match concurrently. The counter typically counts the number of packets or bytes that pass through the OpenFlow switch. Instructions specify the specific operations for the matched flow, such as adding, modifying, clearing, etc., and include a series of actions to be taken for the packet.

In an OpenFlow-based SDN network, when an OpenFlow switch receives a data packet, it first looks up its local flow table to see if there is a matching flow entry. If a match is found, it performs operations according to the instruction set. If no matching entry is found, the switch encapsulates the relevant information of the packet in a Packet-In message and sends it to the controller to inform it of the packet's mismatch situation. The controller then formulates forwarding rules and installs new flow entries in the switch via Flow-Mod messages.

From the working principle of OpenFlow, OpenFlow switches only match the received data streams with their flow tables and do not check the security and reliability of the streams themselves. This inherent vulnerability in the protocol can easily be exploited by malicious actors to organize network disruption activities such as DoS (Denial of Service) attacks and DDoS (Distributed Denial of Service) attacks. A common method of implementation involves sending many data streams with spoofed IP addresses to the SDN switch, causing the switch to continuously send Packet-In messages to the controller to inquire about how to handle them. This continuously consumes the controller's computational resources and causes the switch to generate a large number of useless flow table entries, leading to controller overload or switch flow table overflow, which can result in partial or total failure of the SDN network. Therefore, studying how to mitigate the impact of IP spoofing attacks is one of the main tasks in maintaining the normal operation of SDN.

2.2 Research on Network Attack Mitigation

Attack mitigation involves employing certain technologies or strategies to reduce the impact of attack behaviors on network operations, and it is an essential aspect of cybersecurity protection. From the perspective of implementation approaches, current network attack mitigation methods can be categorized into three types: load balancing, restriction policy, and rerouting.

(1) Load balancing involves taking certain measures to uniformly allocate tasks among control devices and forwarding devices in SDN, transferring tasks from heavily loaded devices to lightly loaded ones to mitigate the impact of attack behaviors. Filali et al. [6] proposed a game-based load-balancing algorithm for multiple controllers, assigning control tasks of switches to multiple controllers to ensure that each controller has a certain quota. Kamel et al. [7], to achieve unified scheduling between flow establishment time and device load, compromised the transmission time between switches and controllers and the load of controllers using the minimum bisection method. Yuan et al. [8] optimized the available resources of switches and controllers based on the assessment results of the devices' resistance to attacks in SDN, to enhance the good performance of SDN under external attacks. Gillani et al. [9], to reduce the information interaction between the links of controllers and switches, dynamically allocated the available resources of SDN using OpenFlow proxies to mitigate the impact of abnormal flows on network transmission performance. Although load-balancing methods can alleviate the impact of attacks on the network to some extent, they are "symptomatic rather than curative" approaches and do not fundamentally prevent attack traffic from entering the network.

(2) Mitigation methods based on restrictive strategies mainly involve limiting the ability of the attacking host to send data packets, preventing packets from entering the network, thus ensuring the sustainable operation of the network. Directly discarding abnormal data packets is a common complete restriction strategy, which has the characteristics of simple operation and high efficiency. Joseph et al. [10] used the controller to establish a blacklist and send it to the switch when detecting and tracing abnormal traffic, and the switch would directly discard the packets sent by the host in the blacklist. Similarly, Cao et al. [11] establish a whitelist of legitimate flows, and the switch directly discards traffic packets outside the white list. Another type of restriction strategy is the conditional restriction strategy, which primarily involves assigning different forwarding priorities or weights to various flows based on the source of the attack. For instance, legitimate normal flows are given higher forwarding priorities or weights, while abnormal and illegal flows are assigned lower priorities or weights. This approach aims to mitigate the infringement of abnormal packets on the network. Yungaicela et al. [12] determine the attributes of flows based on the controller's response time to user requests, allocating high-quality forwarding routes for legitimate flows and low-quality routes for suspected illegal flows. Sudar et al. [13] propose a mitigation approach that assigns longer forwarding durations to trusted source hosts and shorter durations to suspicious source hosts. Their restriction policies, once established, are unable to be adjusted and do not adapt to changes in the state of the SDN network, which could lead to legitimate needs of some normal users not being promptly addressed due to erroneous detection results, potentially causing serious consequences.

(3) Mitigation method based on rerouting strategy When an attack is detected in the network, the controller will recalculate the optimal path, bypass the affected network part, and guide the legal traffic to the undamaged link, thus reducing the impact of the attack on the network performance and maintaining the continuity of network services. Xie Lixia et al. [14] proposed an SDN moving target defense mechanism against Crossfire DDoS attacks, which flexibly schedules traffic through an SDN rerouting strategy to relieve the congestion load of the attacked link and avoid the interference of key link interruption to network business. Zhang et al. [15] introduced a Trust-Based Proximal Policy Optimization (TBPPO) multipath routing algorithm, using KL divergence trust values and node diversity mechanisms as security evaluation criteria to mitigate issues such as network fluctuation, low robustness, and congestion. Bhayo et al. [16] proposed a fast programmable segment rerouting strategy, combining the data plane whitelist with a segmented rerouting scheduling algorithm, to quickly migrate attack traffics without interrupting network services, effectively isolating network attacks and ensuring quality of service. Although rerouting strategies can maximize network resource utilization, they also introduce additional computational and communication overhead, which can lead to bandwidth wastage; moreover, they cannot fundamentally prevent attack traffics from entering the network.

Furthermore, the three current mitigation methods all have certain limitations when dealing with IP spoofing attacks:

(1) Load Balancing Methods: These methods cannot fundamentally prevent IP spoofing attack traffics from entering the SDN. As the attack continues, the available resources in the SDN will eventually be exhausted.

(2) Rerouting Methods: While these methods can temporarily alleviate network congestion by scheduling legitimate data to other paths, they still cannot stop IP spoofing attack traffics from entering the network. They may even route these attack traffics to normal network nodes, expanding the scope of harm.

(3) Restriction Policy-Based Methods: These methods can prevent attack traffics from entering the SDN network. However, the current restriction methods do not discriminate between packets sent from attack source hosts, so they also indiscriminately intercept legitimate traffic from those hosts. Additionally, most current restriction policies are "static," lacking a "recovery" mechanism for misjudged normal hosts or hosts that have ceased attacking. Once identified as attack source hosts, even if they later return to a legitimate state, they cannot regain normal network services until network administrators manually adjust them back to normal devices.

Like traditional networks, the security protection system in SDN networks typically includes attack detection, attack tracing, and attack mitigation, as represented in the theoretical model shown in Fig. 2.

The detection of network attack behaviors typically involves the use of various detection algorithms to identify existing attacks on the network as early as possible. Attack tracing is the process of retracing the transmission path of attack traffic using effective means, until the source host of the attack is discovered. Attack mitigation involves formulating corresponding strategies to counter the attack behaviors of the source host, preventing the continuous entry of attack traffic into the network, and ensuring that the quality of network services does not significantly deteriorate due to attack activities. Given SDN's excellent centralized control capabilities, once the attack source host is identified, immediate countermeasures can usually be taken, such as blocking the access switch port of the attack source or diverting the attack traffic to a default port for discarding. Therefore, in SDN, tracing and mitigation are often studied as an integrated process.

Attackers typically use forged header information, such as fake IP or MAC addresses, to evade tracking. Consequently, even after the system detects an attack in the network, it is difficult to trace back the attack path and track down the attack source using the IP addresses, MAC addresses, or other information obtained from a single detection result. Therefore, tracing the correct attack origin is a prerequisite for effectively mitigating the impact of network attacks.

3.1 Attack Tracing Based on Packet-In Messages

To reduce the computational overhead on forwarding devices during the tracing process, this paper only uses the source IP address ($I{P_{Src}}$), destination IP address ($I{P_{Dst}}$), and forwarding time (${T_{Tra}}$) of the data packet as the parameters to track the target data packet. The tracing process mainly consists of two steps: first, the controller extracts the triplet information of $I{P_{Src}},{\text{ }}I{P_{Dst}},{\text{ }}{T_{Tra}}$from the Packet-In message as matching parameters; then, it extracts $I{P^{\prime}_{Src}},{\text{ }}I{P^{\prime}_{Dst}}$and forwarding statistics information from the forwarding rules of the switch, and matches them with the triplet information of the target data packet to determine whether the target data packet has passed through that switch, implementing the process as follows.

(1) Establish an SDN network topology mapping diagram, number all switches in sequence to ensure that each switch has a unique identifier.

(2) Parse the Packet-In messages received by the controller and extract the triplet information of the target packet, such as $I{P_{Src}},{\text{ }}I{P_{Dst}},{\text{ }}{T_{Tra}}$ and other relevant parameters, as matching criteria.

(3) Traverse the flow table entries of all switches, match them against the triplet information, and record the number of switches and the port numbers that have forwarded the target packet. By integrating the global SDN topology map known to the controller, trace the transmission path of the target packet within the SDN network, which can be represented as follows:

$${E_{i,j}}=\sum {({s_i},{p_i})} \to ({s_j},{p_j})$$

Here, ${E_{i,j}}$represents the transmission path of the target packet, ${s_i},{\text{ }}{s_j}$ denotes the node switch along the transmission path, and ${p_i},{\text{ }}{p_j}$ refers to the respective port numbers on the switches. When the target packet passes through two switches ${s_i},{\text{ }}{s_j}$, the edge connecting${s_i},{\text{ }}{s_j}$ is considered the attack path, and ${p_i},{\text{ }}{p_j}$ is the interface for entry and exit ports.

(4) Compile all the transmission paths generated by tracing Packet-In messages. When many data packets with different destinations are found to be originating from the same edge switch, this switch is identified as the access switch of the attack source. The host connected to the data packet reception port is the source host initiating the IP spoofing attack.

3.2 Mitigation strategy based on dynamic restriction

After tracing the source host that initiates the IP spoofing attack to the switch and port connected to the SDN, execute a restriction policy on the port connected to that switch. For a certain period, discard any packets from that port without matching rules and prohibit the switch from sending Packet_In messages to the controller, as described in Algorithm 1.

Algorithm 1 IP Spoofing Attack Mitigation Algorithm

Purpose: To mitigate IP spoofing attacks in SDN by dynamically restricting the access of suspected attackers.

Inputs:

• source_ip: The source IP address suspected of initiating the spoofing attack.

• switch_id: The identifier of the switch where the suspicious traffic is detected.

• port_no: The port number on the switch where the suspicious traffic is detected.

• T: The dynamic restriction time (in seconds) for which the restriction policy will be enforced.

• controller: Reference to the SDN controller object.

Outputs:

• Enforcement of a restriction policy on the identified switch port.

Steps:

1. Detection and Tracing:

o Detect suspicious IP traffic.

o Trace the source of the suspicious traffic to switch_id and port_no.

2. Policy Enforcement:

o For switch_id and port_no:

Install a flow entry on the switch with the following properties:
priority: High enough to ensure it takes precedence over other rules.
match: Source IP = source_ip.
instructions: Drop the packet.
timeout: T.
Update the switch configuration to block Packet_In messages from port_no for T.

3. Monitoring:

o Continuously monitor the traffic on port_no during the T period.

o If additional suspicious activity is detected, extend the duration or take further action.

4. Review and Adjustment:

o After T expires, review the traffic behavior.

o If the suspicious activity has ceased, remove the restriction policy.

o If the suspicious activity continues, reapply the restriction policy or escalate the response.

5. Reporting:

o Log the details of the attack and the actions taken to the controller's log file.

6. Reset:

o Reset the switch configuration to allow normal traffic through port_no if the restriction period ends and no further suspicious activity is detected.

When the prohibition time exceeds the set restriction time, the forwarding function of the switch is restored. The initial restriction time (${T_{{\text{set}}}}$) is manually set, and subsequently, each time the switch is prohibited, the restriction time doubles, i.e., ${T_{\lim }}={T_{{\text{set}}}}*{2^{n - 1}}$, where ${T_{{\text{set}}}}$ is the initial restriction time when first detected as an attack source, which is manually set and defaults to 20 seconds; n is the number of times the switch has been detected as an attack source.

This mitigation strategy is not limited by the topology of the SDN network. It can promptly isolate new flow requests from the source host initiating IP spoofing attacks on any switch, preventing new attack traffics from entering the SDN network. This helps maintain the performance of the switches and the controller without it constantly declining due to attack behaviors, making it widely applicable. Additionally, the affected switches can still provide continuous forwarding services for legitimate flows corresponding to flow table entries, effectively ensuring the normal operation of legitimate network services during the restriction period. This is also well-suited for SDN networks with high requirements for network service stability.

Additionally, while the mitigation algorithm can intercept new attack data streams, the flow table entries generated by early attack traffics are still stored in the switch's flow table. These entries do not automatically delete immediately; they are only overwritten when their lifetime expires. However, before that, they continue to occupy the switch's storage space, affecting the switch's forwarding performance and also increasing the risk of flow table overflow. The characteristic of these flow table entries is that the number of packets forwarded recorded in the counter is very few, mostly only once, and some are even zero times. Therefore, we use a dynamic deletion strategy to periodically clean up those flow table entries in the switch that have not been matched for a long time, as described in Algorithm 2.

Algorithm 2 Malicious Flow Table Entry Dynamic Deletion Algorithm

Purpose: To periodically clear flow table entries in the switch that have not been matched for a long time, particularly those created by early attack traffics.

Inputs:

• switch_id: Identifier of the switch to clean up.

• controller: Reference to the SDN controller object.

• cleanup_interval: The interval (in seconds) at which the cleanup process should run.

• min_packet_count: The minimum number of packets that must have been forwarded according to the flow entry's counter to consider it active.

Outputs:

• Cleanup of inactive flow table entries in the specified switch.

Steps:

1. Initialization:

o Set the cleanup_interval and min_packet_count parameters.

2. Periodic Cleanup:

o Every cleanup_interval:

For each flow table entry in the switch (switch_id):
Check the packet count in the flow entry's counter.
If the packet count is less than or equal to min_packet_count:
Delete the flow table entry.

3. Verification:

o Verify that only flow table entries with a low packet count (often 1 or 0) are removed.

4. Logging:

o Log the details of the deleted flow table entries to the controller's log file.

5. Repeat:

o Repeat the process at regular intervals as defined by cleanup_interval.

Through the dynamic deletion strategy, the switch's flow table can be periodically "slimmed down," freeing up more available space for the switch, which helps the switch maintain a more reliable forwarding function and ensures that the SDN network can provide higher-quality network services.

4.1 Experimental Setup and Network Architecture

The server configuration for our experiments is as follows: Intel Core i9-12900F, 128GB RAM, NVIDIA RTX3090; CUDA 11.2, Pytorch 1.8. We use Mininet to construct the experimental environment, adopting a Fat-Tree network architecture, which is a bandwidth non-converging network architecture that can be built using multi-level switch designs to create large-scale non-blocking networks. Since the Fat-Tree structure is more scalable than traditional hierarchical structures, it is widely adopted in the design of data center networks. Like traditional hierarchical structures, the Fat-Tree also includes core, aggregation, and access layers, but there are cross-connections between devices in different layers. A k-ary Fat-Tree structure network (where k is an even number), includes k core layer switches and k pods; each pod contains k switches, with k/2 aggregation layer switches and k/2 access layer switches; the number of network devices in the Fat-Tree structure is shown in Table 2. Our experiment uses a 4-ary structure, so there are a total of 20 switch nodes in the network topology, numbered sequentially according to their level and position, as shown in Fig. 3. All host IP addresses (including the controller) are set to the 192.168.10.0/24 IP subnet.

Table 2

Network Parameters of k-ary Fat-Tree
Parameter Name	quantity
Switch Port	k
Core Layer Switch	k²/4
pod	k
Aggregation Layer Switch	k²/2
Access Layer Switch	k²/2
Host	k³/4
the path between any two pods	k

4.2 Results and Discussion

Let host h101 run the Hping3 attack program, sending a large number of packets with random source and destination IP addresses into the SDN network to simulate IP spoofing attack traffic. Other hosts run Python programs to communicate normally according to fixed matching relationships, such as h102 sending legitimate UDP packets to h202. When the system detects an attack in the network, it initiates a trace-back mechanism to identify the attack source, restricts the ability of the attack host to send new traffics, and prevents further attack traffic from entering the network. To ensure the normal operation of the SDN, the maximum forwarding rate of the switches is set to 40 Kp/s (Kilo packets per second). Figure 4 illustrates the process of attack mitigation. The metric used for detection is the number of packets sent or received per unit time, measured in Kp/s.

(1) During the first 30 seconds, host h101 sends new traffic packets into the network at a lower attack rate of 20 Kp/s. At this stage, the switches forward the new flow requests from host h101 to the controller for handling. As a result, it can be seen from Fig. 4 that the number of flows received by the controller in the first 30 seconds is close to the number of new flows sent by host h101.

(2) The attack host h101 gradually increases the rate of sending new flows starting from 30 seconds, reaching a maximum rate of 95 Kp/s at 55 seconds, and maintains a high sending rate until after 180 seconds, when it returns to a lower rate of approximately 20 Kp/s.

During this process, the switch initially tries to meet the forwarding requests of host h101, so the number of Packet-In packets received by the controller keeps increasing. Since the switch was set with a maximum forwarding rate of 40Kp/s, the number of Packet-In packets received by the controller between 41 and 49 seconds did not significantly increase, and at the 50th second, the number of packets received suddenly became 0. This is because after the attack was detected, the mitigation mechanism was activated, and the controller restricted the new stream function sent by the attacking host, preventing new requests from reaching the controller. After the first restriction period expired, the switch lifted the forwarding restriction on the host, and the controller received requests at the maximum rate, immediately triggering the second attack mitigation, with the restriction duration doubled from the first time. The third attack mitigation followed the same pattern. The difference was that even after the attack had ended, the host's data-sending restriction was not lifted in time due to the restriction period not being over; instead, its function of forwarding new streams was restored only after the restriction period expired.

This approach only restricts the host's ability to forward new flows and does not affect the operation of other normal services on the host, nor does it affect data transmission between other hosts in the SDN network, as shown in the figure where communication between h102 and h202 does not exhibit any significant changes. Additionally, since it is only necessary to perform attack detection on the port after the restriction period has expired, this reduces the computational overhead on the server where the controller is located and the bandwidth resources required for transmitting detection data on shared links.

(3) After the attack has ended and the restriction period has expired, host h101 resumes its pre-attack data-sending state, and the flow rate received by the controller is roughly equal to the rate at which new flows are emitted by host h101.

(4) During periods (1), (2), and (3), a dynamic deletion policy is regularly executed on the switch's flow table, deleting flow table entries generated by the attack traffics, thus reducing malicious consumption of the switch's storage space.

The aforementioned experiments demonstrate that the attack mitigation mechanism we designed can effectively alleviate the impact of IP spoofing attacks on SDN without affecting normal communication between other devices within the network, ensuring that SDN has sufficient available resources to provide normal network services. Additionally, since there is no need for real-time monitoring of the attack source host (port) during the mitigation period, the computational overhead and bandwidth usage are relatively lower compared to real-time monitoring, featuring a lightweight and low-consumption characteristic.

4.3 Comparing with Other Mitigation Methods

We compare our proposed method with other mitigation methods. The main aspects of comparison include the ability to prevent attack traffics from entering the network, the computational and bandwidth consumption on the network system, the maintenance of switch performance, and the treatment of legitimate hosts, as shown in Table 3.

Table 3

Comparison with Other Mitigation Methods
Mitigation method	Prevent attack traffic from entering the network	Maintaining the performance of switching equipment	Computational and bandwidth consumption	Restore legitimate hosts	Reduce false positives	Automatically eliminate malicious flow table entries	Risk management
Load balancing method ^[7]	✗	✗	More	✗	✗	✗	General
Traditional restriction strategy ^[11]	✓	✓	Many	✗	✗	✗	General
Rerouting method ^[16]	✗	✗	More	✗	✓	✗	Good
This method	✓	✓	Fewer	✓	✓	✓	Better

The mitigation method we propose can effectively isolate the attack data from entering the SDN network, automatically eliminate malicious (invalid) flow table entries in the switch and will not put pressure on the performance of network forwarding devices. It can automatically "restore" the forwarding function of misjudged hosts or hosts that have returned to normal, and it features low computational cost and minimal bandwidth consumption.

As SDN becomes a trend in future network development, there is an urgent need for rapid and efficient protection mechanisms to maintain its security. Building upon attack detection, we propose an IP spoofing attack mitigation method based on a dynamic restriction strategy. First, we use the triplet information extracted from Packet-In messages received by the controller to trace back the path of the network attack and pinpoint the origin of the attack. Then, we apply a transmission restriction policy to limit the forwarding of new flows on the switch ports connected to the attack source, dropping new flow requests during the restriction period, and restoring the ability to send new flows after the restriction period expires. The duration of the restriction period increases with the number of times the device is detected as an attack source. Additionally, during the restriction period, we continuously perform abnormal detection and attack mitigation on other devices in the network to ensure real-time isolation of attack traffics entering the network, thereby effectively avoiding the overload of SDN switches, controllers, and links. At the same time, we execute a dynamic deletion strategy on the switch's flow table to promptly release the storage space consumed by malicious activities.

Experimental results indicate that the proposed method can effectively, and promptly isolate attack traffics from entering the SDN, ensuring the normal operation of the SDN network.

Future research will focus on how to apply the proposed method to large-scale SDN environments, with a particular emphasis on solving the issue of intelligent coordination among multiple controllers during network attack detection and mitigation processes.

Conflict of interest

The authors declare no competing interests.

Ethics approval

This material is the authors’ own original work, which has not been previously published elsewhere. The paper reflects the authors’ own research and analysis in a truthful and complete manner.

Funding

This work was supported by National Key Research and Development Program of China (Grant numbers 2018YFB0804104) and Henan Province Key Science and Technology Research Projects of China (Grant numbers 242102211070).

Author Contribution

Conceptualization: Y.F. and K.W.; Methodology: K.W. and X.Y.D.; Formal analysis and investigation: K.W. and X.Y.D.; Data curation: K.W. and X.Y.D.; Experiments and Results: K.W. and X.Y.D.; Verification of Results: T.T.L and K.W.; Writing - original draft preparation: K.W. and X.Y.D.; Writing - review and editing: All authors; Funding acquisition: Y.F. and X.Y.D.

Data Availability

The data needed in the experiment were simulated data packets generated by data simulation software, and can be provided as needed if necessary.

Yuhua Xu, Sun Zhixin.: Research Development of Abnormal Traffic Detection in Software Defined Networking. Journal of Software. 31(01), 183-207(2020). https://doi.org/10.13328/j.cnki.jos.005879
Vergara, Jaime, Christian Garzón, Juan Felipe Botero.: A hybrid strategy for DoS attacks detection and mitigation on SDN enabled real scenarios. International Congress on Information and Communication Technology. Singapore: Springer Nature Singapore. 705-714(2023, February). https://doi.org/10.1007/978-981-99-3091-3_58
Ali, Tariq Emad, Ameer Hussein Morad, Mohammed A. Abdala.: Load balance in data center SDN networks. International Journal of Electrical and Computer Engineering (IJECE). 8(5), 3086-3092 (2018). https://doi.org/10.11591/ijece.v8i5.pp.3086-3092
Fouladi, Ramin Fadaei, Orhan Ermis, Emin Anarim.: A DDoS attack detection and countermeasure scheme based on DWT and auto-encoder neural network for SDN. Computer Networks. 214, 109140 (2022). https://doi.org/10.1016/j.comnet.2022.109140
Bianchi, Giuseppe, et al.: Openstate: Programming platform-independent stateful openflow applications inside the switch. ACM SIGCOMM Computer Communication Review. 44(2), 44-51 (2014). https://doi.org/10.1145/2602204.2602211
Filali, Abderrahime, et al.: SDN controller assignment and load balancing with minimum quota of processing capacity. 2018 IEEE International Conference on Communications (ICC). IEEE Press. 1-6 (2018). https://doi.org/10.1109/ICC.2018.8422750
El Kamel, Ali, Habib Youssef.: Improving switch-to-controller assignment with load balancing in multi-controller software defined WAN (SD-WAN). Journal of Network and Systems Management. 28(3), 553-575 (2020). https://doi.org/10.1007/s10922-020-09523-2
Yuan, Bin, et al. Resource investment for DDoS attack resistant SDN: a practical assessment. Science China Information Sciences. 66(7), 172103 (2023). https://doi.org/10.1007/s11432-022-3593-7
Gillani, Fida, Ehab Al-Shaer, Qi Duan.: In-design resilient SDN control plane and elastic forwarding against aggressive DDoS attacks. Proceedings of the 5th ACM Workshop on Moving Target Defense. New York: ACM Press. 80-89 (2018). https://doi.org/10.1145/3268966.3268968
Joseph, Katongole, et al.: A link fabrication attack mitigation approach (LiFAMA) for software defined networks. Electronics. 11(10), 1581(2022). https://doi.org/10.3390/electronics11101581
Cao Y, Jiang H, Deng Y, et al.: Detecting and mitigating DDoS attacks in SDN using spatial-temporal graph convolutional network. IEEE Transactions on Dependable and Secure Computing. 19(6), 3855-3872 (2022). https://doi.org/10.1109/TDSC.2021.3108782
Yungaicela-Naula, Noe M., et al.: A flexible SDN-based framework for slow-rate DDoS attack mitigation by using deep reinforcement learning. Journal of network and computer applications. 205, 103444 (2022). https://doi.org/10.1016/j.jnca.2022.103444
Sudar, K. Muthamil, P. Deepalakshmi.: Flow-Based Detection and Mitigation of Low-Rate DDOS Attack in SDN Environment Using Machine Learning Techniques. IoT and Analytics for Sensor Networks. Proceedings of ICWSNUCA 2021. Springer Singapore. 193-205 (2022). https://doi.org/10.1007/978-981-16-2919-8_18
Lixia Xie, Ying Ding.: Software defined network moving target defense mechanism against link flooding attacks. Journal of Tsinghua University (Science and Technology). 59(1), 36-43 (2019). DOI: https://doi.org/10.16511/j.cnki.qhdxxb.2018.25.062
Zhang Y, Qiu L, Xu Y, Wang X, Wang S, Paul A, et al.: Multi-Path Routing Algorithm Based on Deep Reinforcement Learning for SDN. Applied Sciences. 13(22), 12520 (2023). https://doi.org/10.3390/app132212520
Bhayo J, Jafaq R, Ahmed A, et al. A time-efficient approach toward DDoS attack detection in IoT network using SDN. IEEE Internet of Things Journal. 9(5), 3612-3630 (2021). https://doi.org/10.1109/JIOT.2021.3098029

No competing interests reported.

Download PDF

Reviews received at journal
24 Aug, 2024
Reviews received at journal
18 Aug, 2024
Reviewers agreed at journal
13 Aug, 2024
Reviewers agreed at journal
08 Aug, 2024
Reviewers agreed at journal
08 Aug, 2024
Reviewers invited by journal
08 Aug, 2024
Editor assigned by journal
08 Aug, 2024
Submission checks completed at journal
06 Aug, 2024
First submitted to journal
02 Aug, 2024

You are reading this latest preprint version

Lightweight Detection and Mitigation Method for IP Spoofing Attacks in Software Defined Network

Status:

Version 1

Abstract

Figures

1 Introduction

2 Related works

2.1 OpenFlow Protocol and Its Vulnerabilities

2.2 Research on Network Attack Mitigation

3 IP Spoofing Attack Mitigation Based on Dynamic Restriction Strategy

3.1 Attack Tracing Based on Packet-In Messages

3.2 Mitigation strategy based on dynamic restriction

4 Experiments and Result Analysis

4.1 Experimental Setup and Network Architecture

4.2 Results and Discussion

4.3 Comparing with Other Mitigation Methods

5 Conclusions

Declarations

Conflict of interest

Ethics approval

Funding

Author Contribution

Data Availability

References

Additional Declarations

Status:

Version 1