Attack Resilience of Statistics-based Recently Used Cache Replacement Policy in Software-Defined Networks

Software-Defined Networking is a networking innovation that separates the traditional network into data plans and a controller. The data plans are used to forward data across the network based on flow entries generated by the controller and stored in the Ternary Content Addressable Memory (TCAM). However, since TCAM has a limited capacity, the switch is easily overflowed by creating high-rate malicious traffic causing frequent rule miss for legitimate traffic. When there is not enough space in the switch, it uses one of the eviction mechanisms to remove some entries to free up space. According to some studies, the Least Recently Used (LRU) outperforms other replacement algorithms and increases the switch-hit ratio by maintaining recently used rules in the switch. However, the LRU mechanism may be more vulnerable to attacks that intentionally request unpopular content. This paper evaluates the performance of LRU under DoS attacks when taking into account the rule statistics information over the last period of time in order to understand how well they improve the hit ratios and reduces the communication overhead for legitimate traffic. The simulation results show that using the statistics information along with recently used time can improve the cache attack resistance.