Guizhou Xiangming Technology Co., Ltd, Guiyang, Guizhou, China.
State Key Laboratory of Big Data, College of Computer Science and Technology, Guizhou University, Guiyang, Guizhou, China.
PLoS One. 2024 Apr 26;19(4):e0299846. doi: 10.1371/journal.pone.0299846. eCollection 2024.
The decoupling of control and forwarding layers brings Software-Defined Networking (SDN) the network programmability and global control capability, but it also poses SDN security risks. The adversaries can use the forwarding and control decoupling character of SDN to forge legitimate traffic, launching saturation attacks targeted at SDN switches. These attacks can cause the overflow of switch flow tables, thus making the switch cannot forward benign network traffic. How to effectively detect saturation attack is a research hotspot. There are only a few graph-based saturation attack detection methods. Meanwhile, the current graph generation methods may take useless or misleading information to the attack detection, thus decreasing the attack detection accuracy. To solve the above problems, this paper proposes TITAN, a bidirecTional forwardIng graph-based saturaTion Attack detectioN method. TITAN defines flow forwarding rules and topology information, and designs flow statistical features. Based on these definitions, TITAN generates nodes of the bi-forwarding graph based on the flow statistics features and edges of the bi-forwarding graph based on the network traffic routing paths. In this way, each traffic flow in the network is transformed into a bi-directional forwarding graph. Then TITAN feeds the above bidirectional forwarding graph into a Graph Convolutional Network (GCN) to detect whether the flow is a saturation attack flow. The experimental results show that TITAN can effectively detect saturation attacks in SDNs with a detection accuracy of more than 97%.
控制层和转发层的解耦为软件定义网络（SDN）带来了网络可编程性和全局控制能力，但也带来了 SDN 安全风险。攻击者可以利用 SDN 的转发和控制解耦特性伪造合法流量，针对 SDN 交换机发起饱和攻击。这些攻击会导致交换机流表溢出，从而使交换机无法转发良性网络流量。如何有效地检测饱和攻击是一个研究热点。目前基于图的饱和攻击检测方法较少。同时，当前的图生成方法可能会将无用或误导性的信息引入攻击检测中，从而降低攻击检测的准确性。为了解决上述问题，本文提出了 TITAN，一种基于双向转发图的饱和攻击检测方法。TITAN 定义了流量转发规则和拓扑信息，并设计了流量统计特征。基于这些定义，TITAN 根据流量统计特征生成基于流的双向转发图的节点，并根据网络流量路由路径生成基于流的双向转发图的边。这样，网络中的每个流量流都转换为一个双向转发图。然后，TITAN 将上述双向转发图输入到图卷积网络（GCN）中，以检测流量是否为饱和攻击流量。实验结果表明，TITAN 可以有效地检测 SDN 中的饱和攻击，检测准确率超过 97%。
