An early detection of low rate DDoS attack to SDN based data center networks using information distance metrics

Highlights

• Investigated different control plane security issues of SDN.

• Highlighted the importance of GE metric and implement on incoming packets.

• The results are compared with Shannon metric for performance comparison.

• Our result also compared with other information distance metrics.

Abstract

The primary innovations behind Software Defined Networks (SDN) are the decoupling of the control plane from the data plane and centralizing the network management through a specialized application running on the controller. In spite of many advantages, SDN based data centers’ security issues is still a matter of concern among the research communities. Although SDN becomes a valuable tool to defeat attackers, at the same time SDN itself becomes a victim of Distributed Denial-of-Service (DDoS) attacks due to the potential vulnerabilities exist across various SDN layer. The logically centralized controller is always an attractive target for DDoS attack. Hence, it is important to have a fast as well as accurate detection model to detect the control layer attack traffic at an early stage. We have employed information distance (ID) as a metric to detect the attack traffic at the controller. The ID metric can quantify the deviations of network traffic with different probability distributions. In this paper, taking the advantages of flow based nature of SDN, we proposed a Generalized Entropy (GE) based metric to detect the low rate DDoS attack to the control layer. The experimental results show that our detection mechanism improves the detection accuracy as compared to Shannon entropy and other statistical information distance metrics.

Introduction

Safeguarding the network security is a rat race process between attackers and victims for many years. Advancement of the technology, open up new attack tools to launch various attacks, consequently, the defenders require sophisticated and up-to-date defense mechanism to countermeasure the attack. As contrasting to other attacks, DDoS attack, can cause a massive interruption in any kind of network infrastructure. With the recent advancement of virtualization-based cloud computing, SDN paradigm is being adopting as an security solutions by the modern data centers [[1], [2], [3]]. In SDN the entire control decisions are made by a separate entity called controller [4]. This decoupling framework brings many benefits to the network management and provides an easy solution to improve the overall network efficiency [5]. As the control plane separate from the data plane, it is believed that a flexible and scalable network can be designed to meet the requirement of the ever-changing business need. On one hand, the programmability and logically centralized architecture help controller to easily detect the attack, on the other hand the control layer of SDN paradigm itself is likely to targeted by DDoS attacker [6].

All the forwarding decision are taken by the controller and managed by flow tables of OpenFlow switches. There is a search in the flow table for every new packet to the switch. For a successful match, the flow action will carry out. Otherwise, the packet will be sent to the controller for further instructions. The Fig. 1 shows the header fields that are used during matching period. During DDoS attack, spoofing the source IP address is a common practice. In SDN based data center scenario, for spoofed address there is a mismatch each time on the flow table. Therefore, for each unmatched flow, a packet_in is sent to the controller [7]. If the arrival rate of packet_in is very high in case of DDoS attack, the controller resources will start to deplete soon. A high rate IP spoofed may overwhelm the controller and as a result, it disconnects from the data plane. In a centralized SDN controller architecture single point of failure will defunct the entire network [8]. Hence, it is necessary to identify the DDoS traffic from the benign traffic (see Fig. 2).

In anomaly detection usually the threshold is fixed, and any abnormal deviation of some statistical features of the incoming traffic, can help to identify attack traffic [9]. Therefore, the choice of statistical techniques is so vital in case of DDoS detection. The information theory based metrics can identify more accurately the variations of the traffic behavior of such events. In this work, we have extended the idea of [10], and explore the Generalized Entropy (GE) and Generalized Information Divergence (GID) metrics to detect low rate DDoS attacks. The main contribution of the paper are:

• Investigate different control plane security issues of SDN.

• Highlight the importance of GE metric and implement it on the incoming packets coming to the controller for identifying the low rate attack traffic.

• Compare the result with Shannon metric. In addition to this we compare our result with other information distance metrics.

• We simulate the above scenario on Mininet emulator with POX controller.

The rest of the paper is organized as follows. Section 2 describes the motivation behind this work and related work. Section 3 discussed the information metrics used in the work. The detection procedure explains in Section 4. The experimental setup is mentioned in Section 5. The performance of the algorithms and results are well discussed in Section 6. Finally, Section 7 ends with concluding remarks.