OpenFlow Security Threat Detection and Defense Services
1 like121 views
The paper discusses security threats in Software Defined Networks (SDN) focused on OpenFlow and proposes detection and defense strategies against ARP spoofing and dynamic flow tunneling attacks. It introduces a prototype called FlowEye that utilizes simulation tests to explore these vulnerabilities and suggests methods for monitoring and defending against malicious behaviors. The research aims to enhance SDN security by leveraging centralized control while addressing the unique challenges posed by its architecture.
![Int. J. Advanced Networking and Applications
Volume: 6 Issue: 3 Pages: 2347-2351 (2014) ISSN : 0975-0290
2347
OpenFlow Security Threat Detection and
Defense Services
Wanqing You
Department of Computer Science, Southern Polytechnic State University, Georgia
Email: wyou@spsu.edu
Kai Qian
Department of Computer Science, Southern Polytechnic State University, Georgia
Email: kqian@spsu.edu
Xi He
Department of Computer Science, Georgia State University, Georgia
Email: xhe8@student.gsu.edu
Ying Qian
Department of Computer Science, East China Normal University, China
Email: yqian@cs.ecnu.edu.cn
-------------------------------------------------------------------ABSTRACT--------------------------------------------------------------
The emergence of OpenFlow-capable switches de- couples control plane from the data flow plane so that they
support programmable network and allow network administrators to have programmable central control of
network traffic via a controller. The controller and its communication with switches and users become a
malicious attack target. This paper explores major possible security threats and attacks on the controller of SDN
and proposes a new approach to automatically and dynamically detect and monitor malicious behaviors on flow
message passing and defend such attacks to ensure the security of SDN. We have built a FlowEye prototype at
service level on Mininet API, and simulation tests are done on two feasible attacks on OpenFlow Beacon
platform. The paper provides the feasibility study of such attacks and defense protection strategies in SDN
security research.
Keywords - OpenFlow; Software Defined Network; security
-------------------------------------------------------------------------------------------------------------------------------------------------
Date of Submission: September 09, 2014 Date of Acceptance: November 13, 2014
---------------------------------------------------------------------------------------------------------------------------------------------------
I. INTRODUCTION
The advent of SDN (Software Defined Network) brings
a set of concepts of network organizing techniques. It
breaks up the limitations of traditional network framework
and pulls out the controlled units to a logically centralized
controller plane, which aims to separate control plane from
data plane. While a centralized controller provides great
flexibility to manage the entire network, there are also
many concerns in SDN security. OpenFlow is the
communication protocol between network devices and
controllers. It defines message format and the associated
action upon receiving messages, and is considered an
important implementation of SDN.
The position paper [1] classifies potential SDN threats into
seven categories. Shown in Fig. 1, these SDN threats can
happen on the data plane, on the control plane or the
communication between the data plane and the control
plane. Some of the threats only exist in SDN, while the
impact of the other traditional threats is potentially
augmented in SDN. The dynamic flow tunneling attack we
are discussing in this paper is the attack introduced in
SDN, which attacks on vulnerabilities in controllers.
The advent of SDN has brought the network security
community both opportunities and challenges. On one
hand, the centralized network management offers a
platform for addressing the traditional network concerns.
New approaches to defending network attacks are enabled
with global data collected from the whole network. On the
other hand, the controller components and its connection
with network devices have become the main targets of
new network attacks. Potential software bugs or backdoor
in the controller can make the entire network vulnerable to
network attacks.
In this paper, we discuss two kinds of network attacks,
ARP spoofing and dynamic flow tunneling Attack. We
propose the corresponding detection and defense strategies
for them. ARP spoofing attack is a typical network attack
that also exists in the traditional network. Dynamic flow
tunneling Attack is caused by the malicious software and
is specific to SDN. We design new approaches to
detecting two attacks in the SDN, and implement defense
strategies. The rest of the paper is organized as follows:
Section II briefly reviews the recent work on SDN attack
and defense. Then two kinds of network attacks are
discussed and analyzed in Section III and IV. Detailed
implementation is presented in V. We offer some
conclusions and future roadmap in Section VI.](https://image.slidesharecdn.com/v6i3-10-160401103253/85/OpenFlow-Security-Threat-Detection-and-Defense-Services-1-320.jpg)
![Int. J. Advanced Networking and Applicatio
Volume: 6 Issue: 3 Pages: 2347-2351 (20
Fig. 1. SDN Main Threat Map [1]. Seven types of
identified.
II. RELATED WORK
While the emergence of SDN brings netw
more flexibility to program their ne
capabilities actually introduce new fault an
enabling threats that did not exist or were ha
in the traditional networks. A few relat
targeting at the prevention and detection of
attacks.
FortNOX [2] is a security enforcement ker
by extending the NOX [3] controller. It
prioritizing the flow rule installed on switc
to different type of applications, and chec
contradictions in real time. FRESCO [4] is
security application development framewo
facilitate the creation and deployment of s
in SDN. CloudWatcher [5] is a framework
security monitoring services for large and
networks and detour network packets to b
pre-installed network security devices
PermOF [6], a fine-grained permission
OpenFlow network, minimizes the privileg
to mitigate the privilege abuse problems. A
[7] presented by Princeton University
unmodified controller applications in an
systematic way, which applies the mode
explore the state space of the entire network
III. ARP SPOOFING ATTACK AND DETECT
APPLICATION
An ARP Spoofing or ARP Poisoning
egression of unsolicited ARP messages
messages contain IP addresses of network r
as the default gateway, or a DNS server, a
MAC address of the corresponding network
its own MAC address.
Fig. 2 shows what is ARP and when an AR
happen. In the Fig. 2, Host 1 wants to send p
2, but without any knowledge of the MAC a
ons
14) ISSN : 0975-0290
f SDN threats are
work operators
etworks, these
nd attack plane
arder to exploit
ted works are
f SDN network
rnel developed
is capable of
ches according
cking flow rule
s an OpenFlow
ork which can
security service
k that provides
dynamic cloud
e inspected by
automatically.
n system on
ges applications
A NICE system
aims to test
efficient and
el checking to
k system.
TION
attack is the
. These ARP
resources, such
and replace the
k resource with
RP spoofing can
packets to Host
address of Host
2. It would send out an ARP request
MAC address of Host 2. At this time
network pretends to be Host 2 and se
Thus the packets from Host 1 would
destination. This is ARP spoofing.
We propose a new approach to detect
and a simple defense strategy which pr
we can detect the ARP spoofing.
defense strategies should be designe
possible solution (illustrated in Fig
follows:
1) ARP Spoofing defense appli
buffer which saves the IP addresses an
all network resources. Let the ARP
application collect every ARP reply me
2) ARP Spoofing defense applic
MAC) pair from the ARP reply mes
pair with buffered (IP, MAC) pairs
pairs have same IP address but differ
If yes, prompt an alert. Otherwise, add
pair into the buffer.
Fig. 2. ARP Spoofing.
Fig. 3. Simple simulation of ARP Spoofing det
2348
t in order to get the
e, the attacker in the
ends back its MAC.
be sent to a wrong
t the ARP spoofing,
rompts an alert when
More systematical
ed in the future. A
g. 3) is shown as
ication manages a
nd MAC addresses of
P Spoofing defense
essage.
cation extracts (IP,
ssage. Compare this
to check if any two
rent MAC addresses.
d the new (IP, MAC)
tection.](https://image.slidesharecdn.com/v6i3-10-160401103253/85/OpenFlow-Security-Threat-Detection-and-Defense-Services-2-320.jpg)
![Int. J. Advanced Networking and Applicatio
Volume: 6 Issue: 3 Pages: 2347-2351 (20
IV. DYNAMIC FLOW TUNNELING ATTACK
DETECTION
A new evasion scenario in SDN is describe
al. in [2]. By injecting fake flow rules int
malicious applications on controllers, hack
the firewall, and invade the network s
imaginary network shown in Fig. 4, for ex
computer A is trying to illegally access
(10.0.0.2 → 10.0.0.4). Because the firewal
packets originally from computer A arrivin
C, direct communication between these t
will be denied by the firewall. One possib
hacker computer A to bypass the firewall is
to send packets to computer B (10.0.0.2 →
these packets can go through the firewall
switch. On the other hand, the malicious app
controllers has forged rules on the switch
One set of such rules changes the destin
address of the packets that are from c
computer B, so that these packets are
computer C. Once computer C receives
computer A, it will send reply packets to co
other set of fake rules are then applied
packets, and replace the source IP/MAC
computer B’s. As a result, the reply
camouflaged to be the ones from compute
through the firewall.
Fig. 4. An Evasion Scenario in SDN.
Our basic idea for detecting such networ
maintain an adjacent matrix that keeps
connectivity between any pair of computers
system. If any new rules are about to wri
these rules are intercepted and used to upda
matrix. By comparing the connectivity info
adjacent matrix with the firewall policy,
evasion can be detected. In the next parag
algorithm for maintaining the adjacent m
explained by a concrete example.
In a small network G with computer nodes
(left-hand side of Fig. 5), two compu
ons
14) ISSN : 0975-0290
K AND
ed by Porras et
to switches via
kers can bypass
system. In an
xample, hacker
s computer C
ll prohibits any
ng at computer
two computers
ble strategy for
s, on one hand,
→ 10.0.0.3), and
and reach the
plication on the
h’s flow table.
nation IP/MAC
computer A to
redirected to
packets from
omputer A. The
to these reply
addresses with
y packets are
er B, and pass
rk attack is to
track of the
in the network
ite to switches,
ate the adjacent
ormation in the
, this network
graph, detailed
matrix will be
A, B, C and D
ter nodes are
connected with a dotted line if t
connected but not allowed to commu
are connected with a solid line if the
with each other. (We skip switches th
nodes) The right-hand side of Fig. 5
representation of G, where one com
neighbor of another computer node if
connection between these two compu
hand side adjacent matrix in Fig. 6 is
matrix. If at some point the communi
B and C is enabled, then the co
between B and C’s neighbors, and b
neighbors are also enabled. I
communication paths of (A, C), (B,
connected. For those computer nodes
node A and D) involved in the pr
updates also involve their neighb
continues recursively until all related
Finally, the changes on node connect
the adjacent matrix. The right-hand s
updated adjacent matrix after enabl
path (B, C).
Fig. 5. The topology of a sample network and i
Adjacent matrix before and after enab
path (B, C). 1/0 denotes two co
connecting/disconnecting.
V. IMPLEMENTATION
A. Environment Setup
We use Mininet as the network sim
experiments to build a virtual Open
interact with it via command line inte
Python scripts specifying the netw
customized OpenFlow network such a
Fig. 2 or Fig. 4 can be constructed
computer node in the virtual network
in the same way as in the real network
not only provides default OpenFlow
2349
they are physically
unicate, while nodes
ey can communicate
at connect computer
5 is the adjacent-list
mputer node is the
f there is a physical
uter nodes. The left-
s the initial adjacent
ication path between
ommunication paths
between C and B’s
In this example,
D), and (A, D) are
s (such as computer
revious update, the
bors. The process
d nodes are visited.
tivity are updated to
side of Fig. 6 is the
ling communication
it adjacent-list.
bling communication
omputer nodes are
mulation tool in our
nFlow network, and
erface or APIs. With
work architecture, a
as the one shown in
d in Mininet. Each
can be manipulated
k. Moreover, Mininet
w controller to the](https://image.slidesharecdn.com/v6i3-10-160401103253/85/OpenFlow-Security-Threat-Detection-and-Defense-Services-3-320.jpg)
![Int. J. Advanced Networking and Applicatio
Volume: 6 Issue: 3 Pages: 2347-2351 (20
virtual network, but also allows other co
Beacon, Floodlight, Trema) connecting
network. In addition, the firewall in Fig.
configured inside a switch in Mininet virt
network.
We choose Beacon [8], a java-based open
as our OpenFlow controller. Considered
operating system, Beacon not only has
efficient I/O operation, communicating
devices, but also integrates seamlessly with
Spring framework, providing easy-to-use
developers to develop and deploy app
enabling dynamic addition or remova
applications. To develop a new Beaco
developer usually only need to implem
IOFMessageListener, and handle the incom
from OpenFlow switches in accordance t
specific business logic.
B. ARP Spoofing Detection Application
Due to the limitation of Mininet virtu
network, traditional ARP attack tools are
working in the network setting of our exper
purpose of the demonstration, we simulate A
deploying a special Beacon application, w
two ARP messages with same host IP
different MAC addresses.
We implement another Beacon applicati
detection program. It overrides the rece
declared in the Interface IOFMessageListe
the ARP-specific OpenFlow messages, and
MAC) pairs to the global (IP, MAC) ta
pairs in the (IP, MAC) table with same I
different MAC addresses are identified, it
Beacon system that an ARP spoofing attack
At the same time, potential hacker hosts, w
ARP reply messages, are recorded in th
further investigation.
C. Dynamic Flow Tunneling Detection and
Service
The dynamic flow tunneling detection and d
is developed inside the Beacon system. Fi
the basic workflow inside the Beacon
Controller class periodically queries if these
messages. If yes, it will receive message and
to the application if the messages are packe
Otherwise, other handlers will process the
applications process the packet-in message
determined order, and pass the outgo
messages to the OFMessageAsyncStream cl
in turn write these messages to the switches
flow tunneling detection and defense service
OFMessageAsyncStream class. The write()
the OFMessageAsyncStream is overridden
that when a new flow-mod message is pass
execute the dynamic flow tunneling detect
as discussed in Section IV, before actual
message to the switches.
ons
14) ISSN : 0975-0290
ntroller (POX,
to the virtual
4 can be also
tual OpenFlow
source project,
as a network
s implemented
with network
h Equinox and
e platform for
plications and
al of Beacon
on application,
ment Interface
ming messages
to application-
ual OpenFlow
e not properly
iments. For the
ARP attacks by
which produces
addresses yet
ion: the ARP
eive() function
ener, scans all
adds the (IP,
able. Once two
IP address but
t will alert the
k is happening.
hich issue fake
he log file for
d Defense
defense service
ig. 7 describes
system. The
e are incoming
d forward them
et-in messages.
messages. The
es in some pre-
ing flow-mod
lass, which will
s. The dynamic
e lies inside the
function inside
in such a way
sed to it, it will
tion algorithm,
lly writing the
VI. CONCLUSION
In this paper, we examine two import
in SDN and propose respective det
strategies. More comprehensive exp
carried out to evaluate the proposed
Other than these two attacks, much m
building a rich suite of applications
range of security issues. Although dyn
attack is specific to SDN while AR
exists in both SDN and traditional net
proposed defense approaches rely on
controller which can provide network-
and data access.
We believe that a network security in
the centralized controller would prov
for defending network attacks in
constructing a network security in
become our next step.
Fig.7. The data flow inside the Beacon
represent Beacon class instances.
REFERENCES
[1] D. Kreutz, F. Ramos, and P. V
secure and dependable software
Proc. the second ACM SIG- CO
Hot topics in software defined n
2013, pp. 55–60.
[2] P. Porras, S. Shin, V. Yegnesw
Tyson, and G. Gu, A security enf
openflow networks, Proc. the firs
topics in software defined networ
121–126.
[3] N. Gude, T. Koponen, J. Pe
Casado, N. McKeown, and S. Sh
an operating system for networks
Computer Communication Review
105–110, 2008.
[4] S. Shin, P. Porras, V. Yegneswara
and M. Tyson, Fresco: Modular c
services for software-defined
Network and Distributed Security
2350
tant network attacks
tection and defense
periments are being
d defense strategies.
more work remains in
s that cover a wide
namic flow tunneling
RP Spoofing attack
twork, we think both
n SDN’s centralized
-wise device control
nfrastructure built on
vide a good solution
n SDN. Therefore,
nfrastructure would
n. The rectangles
Verissimo, Towards
e-defined networks,
OMM workshop on
networking, ACM,
waran, M. Fong, M.
forcement kernel for
st workshop on Hot
rks, ACM, 2012, pp.
ttit, B. Pfaff, M.
henker, Nox: towards
s, ACM SIGCOMM
w, vol. 38, no. 3, pp.
an, M. Fong, G. Gu,
composable security
networks, Proc.
Symposium, 2013.](https://image.slidesharecdn.com/v6i3-10-160401103253/85/OpenFlow-Security-Threat-Detection-and-Defense-Services-4-320.jpg)
![Int. J. Advanced Networking and Applications
Volume: 6 Issue: 3 Pages: 2347-2351 (2014) ISSN : 0975-0290
2351
[5] S. Shin and G. Gu, Cloudwatcher: Network security
monitoring using openflow in dynamic cloud
networks (or: How to provide security monitoring as a
service in clouds?), Proc. 2012 20th IEEE
International Conference on Network Protocols
(ICNP), IEEE, 2012, pp. 1–6.
[6] X. Wen, Y. Chen, C. Hu, C. Shi, and Y. Wang,
Towards a secure controller platform for openflow
applications, Proc. the second ACM SIGCOMM
workshop on Hot topics in software defined
networking. ACM, 2013, pp. 171–172.
[7] M. Canini, D. Venzano, P. Peresini, D. Kostic, and J.
Rexford, A nice way to test openflow applications,
Proc. the 9th USENIX conference on Networked
Systems Design and Implementation, Apr, 2012.
[8] D. Erickson, The Beacon OpenFlow Controller, Proc.
of the second ACM SIGCOMM workshop on Hot
topics in software defined networking, ACM, 2013,
pp. 13-18
Biographies and Photographs
Wanqing You is a graduate student in the department of
computer science & software engineering at Southern
Polytechnic State University. She got her bachelor degree
in software engineering at Xiamen University, China,
2013.
Dr. Kai Qian is a computer science professor in the
department of computer science & software engineering at
Southern Polytechnic State University. He got his Ph.D in
computer science and engineering at University of
Nebraska-Lincoln, 1990. His research areas include
computer network and mobile security, big data analysis
for security, machine learning, and pattern recognition. He
has published about 100 research papers in these areas in
many journals and conferences. He has received a number
of research projects on the cybersecurity from NSF these
years.
Xi He is a CS research assistant and instructor at Georgia
State University. He is specialized in parallel and
distributed computing, network architecture, and grid
computing. He has many year industrial experiences as
a software engineer and has published papers in his
research areas.
Dr. Ying Qian is an Associate Professor in the Department
of Computer Science and Technology, at East China
Normal University, Shanghai, China. She received her
Master and Ph.D. degree in Department of Electrical &
Computer Engineering from Queen’s University,
Kingston, Ontario, Canada. Her research interests include
Software Defined Network, high-performance scientific
computation, and parallel programming. She has published
about 20 research papers in these areas in many journals
and conferences.](https://image.slidesharecdn.com/v6i3-10-160401103253/85/OpenFlow-Security-Threat-Detection-and-Defense-Services-5-320.jpg)
OpenFlow Security Threat Detection and Defense Services
- 1. Int. J. Advanced Networking and Applications Volume: 6 Issue: 3 Pages: 2347-2351 (2014) ISSN : 0975-0290 2347 OpenFlow Security Threat Detection and Defense Services Wanqing You Department of Computer Science, Southern Polytechnic State University, Georgia Email: wyou@spsu.edu Kai Qian Department of Computer Science, Southern Polytechnic State University, Georgia Email: kqian@spsu.edu Xi He Department of Computer Science, Georgia State University, Georgia Email: xhe8@student.gsu.edu Ying Qian Department of Computer Science, East China Normal University, China Email: yqian@cs.ecnu.edu.cn -------------------------------------------------------------------ABSTRACT-------------------------------------------------------------- The emergence of OpenFlow-capable switches de- couples control plane from the data flow plane so that they support programmable network and allow network administrators to have programmable central control of network traffic via a controller. The controller and its communication with switches and users become a malicious attack target. This paper explores major possible security threats and attacks on the controller of SDN and proposes a new approach to automatically and dynamically detect and monitor malicious behaviors on flow message passing and defend such attacks to ensure the security of SDN. We have built a FlowEye prototype at service level on Mininet API, and simulation tests are done on two feasible attacks on OpenFlow Beacon platform. The paper provides the feasibility study of such attacks and defense protection strategies in SDN security research. Keywords - OpenFlow; Software Defined Network; security ------------------------------------------------------------------------------------------------------------------------------------------------- Date of Submission: September 09, 2014 Date of Acceptance: November 13, 2014 --------------------------------------------------------------------------------------------------------------------------------------------------- I. INTRODUCTION The advent of SDN (Software Defined Network) brings a set of concepts of network organizing techniques. It breaks up the limitations of traditional network framework and pulls out the controlled units to a logically centralized controller plane, which aims to separate control plane from data plane. While a centralized controller provides great flexibility to manage the entire network, there are also many concerns in SDN security. OpenFlow is the communication protocol between network devices and controllers. It defines message format and the associated action upon receiving messages, and is considered an important implementation of SDN. The position paper [1] classifies potential SDN threats into seven categories. Shown in Fig. 1, these SDN threats can happen on the data plane, on the control plane or the communication between the data plane and the control plane. Some of the threats only exist in SDN, while the impact of the other traditional threats is potentially augmented in SDN. The dynamic flow tunneling attack we are discussing in this paper is the attack introduced in SDN, which attacks on vulnerabilities in controllers. The advent of SDN has brought the network security community both opportunities and challenges. On one hand, the centralized network management offers a platform for addressing the traditional network concerns. New approaches to defending network attacks are enabled with global data collected from the whole network. On the other hand, the controller components and its connection with network devices have become the main targets of new network attacks. Potential software bugs or backdoor in the controller can make the entire network vulnerable to network attacks. In this paper, we discuss two kinds of network attacks, ARP spoofing and dynamic flow tunneling Attack. We propose the corresponding detection and defense strategies for them. ARP spoofing attack is a typical network attack that also exists in the traditional network. Dynamic flow tunneling Attack is caused by the malicious software and is specific to SDN. We design new approaches to detecting two attacks in the SDN, and implement defense strategies. The rest of the paper is organized as follows: Section II briefly reviews the recent work on SDN attack and defense. Then two kinds of network attacks are discussed and analyzed in Section III and IV. Detailed implementation is presented in V. We offer some conclusions and future roadmap in Section VI.
- 2. Int. J. Advanced Networking and Applicatio Volume: 6 Issue: 3 Pages: 2347-2351 (20 Fig. 1. SDN Main Threat Map [1]. Seven types of identified. II. RELATED WORK While the emergence of SDN brings netw more flexibility to program their ne capabilities actually introduce new fault an enabling threats that did not exist or were ha in the traditional networks. A few relat targeting at the prevention and detection of attacks. FortNOX [2] is a security enforcement ker by extending the NOX [3] controller. It prioritizing the flow rule installed on switc to different type of applications, and chec contradictions in real time. FRESCO [4] is security application development framewo facilitate the creation and deployment of s in SDN. CloudWatcher [5] is a framework security monitoring services for large and networks and detour network packets to b pre-installed network security devices PermOF [6], a fine-grained permission OpenFlow network, minimizes the privileg to mitigate the privilege abuse problems. A [7] presented by Princeton University unmodified controller applications in an systematic way, which applies the mode explore the state space of the entire network III. ARP SPOOFING ATTACK AND DETECT APPLICATION An ARP Spoofing or ARP Poisoning egression of unsolicited ARP messages messages contain IP addresses of network r as the default gateway, or a DNS server, a MAC address of the corresponding network its own MAC address. Fig. 2 shows what is ARP and when an AR happen. In the Fig. 2, Host 1 wants to send p 2, but without any knowledge of the MAC a ons 14) ISSN : 0975-0290 f SDN threats are work operators etworks, these nd attack plane arder to exploit ted works are f SDN network rnel developed is capable of ches according cking flow rule s an OpenFlow ork which can security service k that provides dynamic cloud e inspected by automatically. n system on ges applications A NICE system aims to test efficient and el checking to k system. TION attack is the . These ARP resources, such and replace the k resource with RP spoofing can packets to Host address of Host 2. It would send out an ARP request MAC address of Host 2. At this time network pretends to be Host 2 and se Thus the packets from Host 1 would destination. This is ARP spoofing. We propose a new approach to detect and a simple defense strategy which pr we can detect the ARP spoofing. defense strategies should be designe possible solution (illustrated in Fig follows: 1) ARP Spoofing defense appli buffer which saves the IP addresses an all network resources. Let the ARP application collect every ARP reply me 2) ARP Spoofing defense applic MAC) pair from the ARP reply mes pair with buffered (IP, MAC) pairs pairs have same IP address but differ If yes, prompt an alert. Otherwise, add pair into the buffer. Fig. 2. ARP Spoofing. Fig. 3. Simple simulation of ARP Spoofing det 2348 t in order to get the e, the attacker in the ends back its MAC. be sent to a wrong t the ARP spoofing, rompts an alert when More systematical ed in the future. A g. 3) is shown as ication manages a nd MAC addresses of P Spoofing defense essage. cation extracts (IP, ssage. Compare this to check if any two rent MAC addresses. d the new (IP, MAC) tection.
- 3. Int. J. Advanced Networking and Applicatio Volume: 6 Issue: 3 Pages: 2347-2351 (20 IV. DYNAMIC FLOW TUNNELING ATTACK DETECTION A new evasion scenario in SDN is describe al. in [2]. By injecting fake flow rules int malicious applications on controllers, hack the firewall, and invade the network s imaginary network shown in Fig. 4, for ex computer A is trying to illegally access (10.0.0.2 → 10.0.0.4). Because the firewal packets originally from computer A arrivin C, direct communication between these t will be denied by the firewall. One possib hacker computer A to bypass the firewall is to send packets to computer B (10.0.0.2 → these packets can go through the firewall switch. On the other hand, the malicious app controllers has forged rules on the switch One set of such rules changes the destin address of the packets that are from c computer B, so that these packets are computer C. Once computer C receives computer A, it will send reply packets to co other set of fake rules are then applied packets, and replace the source IP/MAC computer B’s. As a result, the reply camouflaged to be the ones from compute through the firewall. Fig. 4. An Evasion Scenario in SDN. Our basic idea for detecting such networ maintain an adjacent matrix that keeps connectivity between any pair of computers system. If any new rules are about to wri these rules are intercepted and used to upda matrix. By comparing the connectivity info adjacent matrix with the firewall policy, evasion can be detected. In the next parag algorithm for maintaining the adjacent m explained by a concrete example. In a small network G with computer nodes (left-hand side of Fig. 5), two compu ons 14) ISSN : 0975-0290 K AND ed by Porras et to switches via kers can bypass system. In an xample, hacker s computer C ll prohibits any ng at computer two computers ble strategy for s, on one hand, → 10.0.0.3), and and reach the plication on the h’s flow table. nation IP/MAC computer A to redirected to packets from omputer A. The to these reply addresses with y packets are er B, and pass rk attack is to track of the in the network ite to switches, ate the adjacent ormation in the , this network graph, detailed matrix will be A, B, C and D ter nodes are connected with a dotted line if t connected but not allowed to commu are connected with a solid line if the with each other. (We skip switches th nodes) The right-hand side of Fig. 5 representation of G, where one com neighbor of another computer node if connection between these two compu hand side adjacent matrix in Fig. 6 is matrix. If at some point the communi B and C is enabled, then the co between B and C’s neighbors, and b neighbors are also enabled. I communication paths of (A, C), (B, connected. For those computer nodes node A and D) involved in the pr updates also involve their neighb continues recursively until all related Finally, the changes on node connect the adjacent matrix. The right-hand s updated adjacent matrix after enabl path (B, C). Fig. 5. The topology of a sample network and i Adjacent matrix before and after enab path (B, C). 1/0 denotes two co connecting/disconnecting. V. IMPLEMENTATION A. Environment Setup We use Mininet as the network sim experiments to build a virtual Open interact with it via command line inte Python scripts specifying the netw customized OpenFlow network such a Fig. 2 or Fig. 4 can be constructed computer node in the virtual network in the same way as in the real network not only provides default OpenFlow 2349 they are physically unicate, while nodes ey can communicate at connect computer 5 is the adjacent-list mputer node is the f there is a physical uter nodes. The left- s the initial adjacent ication path between ommunication paths between C and B’s In this example, D), and (A, D) are s (such as computer revious update, the bors. The process d nodes are visited. tivity are updated to side of Fig. 6 is the ling communication it adjacent-list. bling communication omputer nodes are mulation tool in our nFlow network, and erface or APIs. With work architecture, a as the one shown in d in Mininet. Each can be manipulated k. Moreover, Mininet w controller to the
- 4. Int. J. Advanced Networking and Applicatio Volume: 6 Issue: 3 Pages: 2347-2351 (20 virtual network, but also allows other co Beacon, Floodlight, Trema) connecting network. In addition, the firewall in Fig. configured inside a switch in Mininet virt network. We choose Beacon [8], a java-based open as our OpenFlow controller. Considered operating system, Beacon not only has efficient I/O operation, communicating devices, but also integrates seamlessly with Spring framework, providing easy-to-use developers to develop and deploy app enabling dynamic addition or remova applications. To develop a new Beaco developer usually only need to implem IOFMessageListener, and handle the incom from OpenFlow switches in accordance t specific business logic. B. ARP Spoofing Detection Application Due to the limitation of Mininet virtu network, traditional ARP attack tools are working in the network setting of our exper purpose of the demonstration, we simulate A deploying a special Beacon application, w two ARP messages with same host IP different MAC addresses. We implement another Beacon applicati detection program. It overrides the rece declared in the Interface IOFMessageListe the ARP-specific OpenFlow messages, and MAC) pairs to the global (IP, MAC) ta pairs in the (IP, MAC) table with same I different MAC addresses are identified, it Beacon system that an ARP spoofing attack At the same time, potential hacker hosts, w ARP reply messages, are recorded in th further investigation. C. Dynamic Flow Tunneling Detection and Service The dynamic flow tunneling detection and d is developed inside the Beacon system. Fi the basic workflow inside the Beacon Controller class periodically queries if these messages. If yes, it will receive message and to the application if the messages are packe Otherwise, other handlers will process the applications process the packet-in message determined order, and pass the outgo messages to the OFMessageAsyncStream cl in turn write these messages to the switches flow tunneling detection and defense service OFMessageAsyncStream class. The write() the OFMessageAsyncStream is overridden that when a new flow-mod message is pass execute the dynamic flow tunneling detect as discussed in Section IV, before actual message to the switches. ons 14) ISSN : 0975-0290 ntroller (POX, to the virtual 4 can be also tual OpenFlow source project, as a network s implemented with network h Equinox and e platform for plications and al of Beacon on application, ment Interface ming messages to application- ual OpenFlow e not properly iments. For the ARP attacks by which produces addresses yet ion: the ARP eive() function ener, scans all adds the (IP, able. Once two IP address but t will alert the k is happening. hich issue fake he log file for d Defense defense service ig. 7 describes system. The e are incoming d forward them et-in messages. messages. The es in some pre- ing flow-mod lass, which will s. The dynamic e lies inside the function inside in such a way sed to it, it will tion algorithm, lly writing the VI. CONCLUSION In this paper, we examine two import in SDN and propose respective det strategies. More comprehensive exp carried out to evaluate the proposed Other than these two attacks, much m building a rich suite of applications range of security issues. Although dyn attack is specific to SDN while AR exists in both SDN and traditional net proposed defense approaches rely on controller which can provide network- and data access. We believe that a network security in the centralized controller would prov for defending network attacks in constructing a network security in become our next step. Fig.7. The data flow inside the Beacon represent Beacon class instances. REFERENCES [1] D. Kreutz, F. Ramos, and P. V secure and dependable software Proc. the second ACM SIG- CO Hot topics in software defined n 2013, pp. 55–60. [2] P. Porras, S. Shin, V. Yegnesw Tyson, and G. Gu, A security enf openflow networks, Proc. the firs topics in software defined networ 121–126. [3] N. Gude, T. Koponen, J. Pe Casado, N. McKeown, and S. Sh an operating system for networks Computer Communication Review 105–110, 2008. [4] S. Shin, P. Porras, V. Yegneswara and M. Tyson, Fresco: Modular c services for software-defined Network and Distributed Security 2350 tant network attacks tection and defense periments are being d defense strategies. more work remains in s that cover a wide namic flow tunneling RP Spoofing attack twork, we think both n SDN’s centralized -wise device control nfrastructure built on vide a good solution n SDN. Therefore, nfrastructure would n. The rectangles Verissimo, Towards e-defined networks, OMM workshop on networking, ACM, waran, M. Fong, M. forcement kernel for st workshop on Hot rks, ACM, 2012, pp. ttit, B. Pfaff, M. henker, Nox: towards s, ACM SIGCOMM w, vol. 38, no. 3, pp. an, M. Fong, G. Gu, composable security networks, Proc. Symposium, 2013.
- 5. Int. J. Advanced Networking and Applications Volume: 6 Issue: 3 Pages: 2347-2351 (2014) ISSN : 0975-0290 2351 [5] S. Shin and G. Gu, Cloudwatcher: Network security monitoring using openflow in dynamic cloud networks (or: How to provide security monitoring as a service in clouds?), Proc. 2012 20th IEEE International Conference on Network Protocols (ICNP), IEEE, 2012, pp. 1–6. [6] X. Wen, Y. Chen, C. Hu, C. Shi, and Y. Wang, Towards a secure controller platform for openflow applications, Proc. the second ACM SIGCOMM workshop on Hot topics in software defined networking. ACM, 2013, pp. 171–172. [7] M. Canini, D. Venzano, P. Peresini, D. Kostic, and J. Rexford, A nice way to test openflow applications, Proc. the 9th USENIX conference on Networked Systems Design and Implementation, Apr, 2012. [8] D. Erickson, The Beacon OpenFlow Controller, Proc. of the second ACM SIGCOMM workshop on Hot topics in software defined networking, ACM, 2013, pp. 13-18 Biographies and Photographs Wanqing You is a graduate student in the department of computer science & software engineering at Southern Polytechnic State University. She got her bachelor degree in software engineering at Xiamen University, China, 2013. Dr. Kai Qian is a computer science professor in the department of computer science & software engineering at Southern Polytechnic State University. He got his Ph.D in computer science and engineering at University of Nebraska-Lincoln, 1990. His research areas include computer network and mobile security, big data analysis for security, machine learning, and pattern recognition. He has published about 100 research papers in these areas in many journals and conferences. He has received a number of research projects on the cybersecurity from NSF these years. Xi He is a CS research assistant and instructor at Georgia State University. He is specialized in parallel and distributed computing, network architecture, and grid computing. He has many year industrial experiences as a software engineer and has published papers in his research areas. Dr. Ying Qian is an Associate Professor in the Department of Computer Science and Technology, at East China Normal University, Shanghai, China. She received her Master and Ph.D. degree in Department of Electrical & Computer Engineering from Queen’s University, Kingston, Ontario, Canada. Her research interests include Software Defined Network, high-performance scientific computation, and parallel programming. She has published about 20 research papers in these areas in many journals and conferences.