Early detection of DDoS attacks against SDN controllers

A Software Defined Network (SDN) is a new network architecture that provides central control over the network. Although central control is the major advantage of SDN, it is also a single point of failure if it is made unreachable by a Distributed Denial of Service (DDoS) Attack. To mitigate this threat, this paper proposes to use the central control of SDN for attack detection and introduces a solution that is effective and lightweight in terms of the resources that it uses. More precisely, this paper shows how DDoS attacks can exhaust controller resources and provides a solution to detect such attacks based on the entropy variation of the destination IP address. This method is able to detect DDoS within the first five hundred packets of the attack traffic.

I. Introduction

Software Defined Networks (SDN) provide a new and novel way to manage networks. In SDN, switches do not process incoming packets - they simply look for a match in their forwarding tables. If there is no match, packets are sent to the controller for processing. The controller is the operating system of SDN. It processes the packets and decides whether the packets will be forwarded in the switch or dropped. By applying this procedure, SDN separates the forwarding and the processing planes [1]. If the connection between the switches and the controller is lost, the network will lose its processing plane. This means that packet processing is no longer done in the controller and by losing the controller, the SDN architecture is lost.