Defense Against Software-Defined Network Topology Poisoning Attacks

Software-Defined Network (SDN) represents a new network paradigm. Unlike conventional networks, SDNs separate control planes and data planes. The function of plane is enabled using switches, whereas that facilitated by controller. controller learns topologies makes traffic forwarding decisions. However, some serious vulnerabilities are gradually exposed in the topology management services current SDN designs. These mainly exist host tracking link discovery services. Attackers can exploit these weak points to poison information controllers. In this study, novel solution proposed defend against poisoning attacks. By analyzing existing attack principles threat models, work constructs legal conditions for migration detect hijacking checking Link Layer Discovery Protocol (LLDP) source integrity designed fabrication A relay-type detection method based on entropy also designed. Results show effectively topological attacks provide complete comprehensive security protection.