Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 4) Spoofing Attacks in SDN: <s> Static configurations serve great advantage for adversaries in discovering network targets and launching attacks. Identifying active IP addresses in a target domain is a precursory step for many attacks. Frequently changing hosts' IP addresses is a novel proactive moving target defense (MTD) that hides network assets from external/internal scanners. In this paper, we use OpenFlow to develop a MTD architecture that transparently mutates host IP addresses with high unpredictability and rate, while maintaining configuration integrity and minimizing operation overhead. The presented technique is called OpenFlow Random Host Mutation (OF-RHM) in which the OpenFlow controller frequently assigns each host a random virtual IP that is translated to/from the real IP of the host. The real IP remains untouched, so IP mutation is completely transparent for end-hosts. Named hosts are reachable via the virtual IP addresses acquired via DNS, but real IP addresses can be only reached by authorized entities. Our implementation and evaluation show that OF-RHM can effectively defend against stealthy scanning, worm propagation, and other scanning-based attack. <s> BIB001 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 4) Spoofing Attacks in SDN: <s> In Software Defined Networking (SDN) architecture, the control plane is separated from the data plane. On one hand, OpenFlow switches can only store and forward packets, which leaves all decisions to be made by the controller. On the other hand, the controller has a global view over the SDN. But if any switch is captured by an adversary, it may mislead the controller to make inaccurate decisions which may have terrible influences on the overall networks. In this paper, we elaborate on these problems and propose methods to detect malicious OpenFlow switches. We set a threshold value of the traffic-flows across an OpenFlow switch. If the switch’s current traffic-flows exceed the threshold value, the controller has reasons to believe that this switch is suspicious and may monitor it intensively. Another scheme is to add a third-party server to accept users’ report to warn the controller. In SDN, the controller cannot communicate with users directly, and sometimes users need to feed back their experience to the controller to help improve the SDN. In this case, it is necessary to set a third-party server in SDN to act as a middle role. These two schemes help to detect malicious switches. The controller can analyze the flow table of the suspicious switch and identify whether it is really malicious before isolating it. <s> BIB002 </s> Software Defined Networking Architecture, Security and Energy Efficiency: A Survey <s> 4) Spoofing Attacks in SDN: <s> Software-defined networks (SDNs) allow greater control over network entities by centralizing the control plane, but place great burden on the administrator to manually ensure security and correct functioning of the entire network. We list several attacks on SDN controllers that violate network topology and data plane forwarding, and can be mounted by compromised network entities, such as end hosts and soft switches. We further demonstrate their feasibility on four popular SDN controllers. We propose SPHINX to detect both known and potentially unknown attacks on network topology and data plane forwarding originating within an SDN. SPHINX leverages the novel abstraction of flow graphs, which closely approximate the actual network operations, to enable incremental validation of all network updates and constraints. SPHINX dynamically learns new network behavior and raises alerts when it detects suspicious changes to existing network control plane behavior. Our evaluation shows that SPHINX is capable of detecting attacks in SDNs in realtime with low performance overheads, and requires no changes to the controllers for deployment. <s> BIB003
Spoofing attacks are kind of attacks in which attacker uses the identity of a legitimate user to inject fake packets and malicious applications into the network. Because of flexibility that SDN offers, spoofing attacks are easy to implement in the software defined networks. The OpenFlow switches in SDN are data forwarding devices with no intelligence programs. They can be spoofed and used for sending requests to controller. The controller also cannot block these fake packets as it lacks basic components like middle boxes. The other kind of switches in OpenFlow network are soft switches which are responsible for network virtualization. These switches are connected to the controller directly, becoming the attractive target for the attackers. These switches pave a direct way to the attackers into the controller where the attackers can configure the routing policy of the switches misleading all the packets in the network BIB003 . The effect caused due to these attacks can be reduced by early detection of malware switches. For this purpose all packets flowing into the network should be carefully inspected. Two schemes for finding suspicious switches have been proposed in BIB002 . In the first scheme, malicious switches in the system are detected based on the traffic flow higher than a given threshold value. The second scheme in the network involves embedding the third party server to monitor the switches to find any malicious actions. A technique called Sphinx has been proposed in BIB003 for spoofing threats/vulnerabilities detection in network topology and communication interface between data plane and control plane. It takes the advantage of the flow graphs to monitor each and every flow. It also uses four important OpenFlow commands such as FLOW_MOD, PACKET_IN, STATS_REPLY and FEATURES_REPLY to obtain all required data from the switch and alert the controller if any suspicious activity is detected near the switches BIB003 . All of these attacks can be avoided to some extent by maintaining the privacy of users' contents. Most dangerous attacks in the networks are targeted to IP-based networks. This necessitates the need for protecting the IP as a whole. In SDN the special mechanism called OpenFlow random host mutation (OF-RHM) is implemented which hides the actual IPs and uses the random virtual IP addresses BIB001 that prevents the attacks to some extend. 