DoS attack defense framework for SDN infrastructure

To further mitigate the dedicated denial-of-service (DoS) attack (data-to-control plane saturation attack)against SDN infrastructure, a controller and switch cooperative defense framework, that is, FloodShield, is presented. In this attack, a large number of packets are flooded by attacker to trigger massive table-misses and packet-in messages in the data plane, which would exhaust resources of different components of SDN infrastructure, including TCAM in the data plane, bandwidth of the control channel, and CPU cycles of the controller. With the extensive analysis of the vulnerability of SDN against the saturation attack, a deployable, comprehensive and lightweight SDN defense framework, FloodShield, is proposed and designed. The following two techniques are combined with FloodShield: 1) source address validation for filtering forged packets directly in the data plane, and 2) stateful packet supervision for monitoring traffic states of real addresses and performing dynamic countermeasures based on evaluation scores and network resource usage. Experimental results show that, compared with previous defense framework, FloodShield provides an effective protection for data plane, control channel and control plane of SDN infrastructure, meanwhile consuming less resource.