SDN Switch Attack Stream Identification via Invalid Filter Table
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined networks, illegal attacks lead to a broadcast storm and resource wastage due to the amplification of ARP packets, causing switches to send multiple Packet in messages to the controller, which results in a significant burden on calculation and bandwidth resources.
Innovation Solution
An attack stream identification method where a switch maintains an invalid stream filter table with state fields, rate fields, and traffic fields to determine if a data stream is an attack stream, and only sends report messages when the state is suspected or non-attack, preventing further report messages when identified as an attack stream, thus reducing resource waste.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the switch sends Packet in messages to the controller for every packet with no matching flow entry during an attack, then the controller can attempt to find forwarding paths, but the controller's calculation resources and network bandwidth are greatly wasted due to the large quantity of attack packets
Solution Approach 1:
The patent applies preliminary action by having the switch proactively identify and mark attack packets before they reach the controller. The switch maintains an invalid stream filter table that pre-identifies packets with fictitious destination addresses as potential attacks, setting a flag bit in advance. This prevents the controller from being overwhelmed by processing every attack packet, as the switch has already performed preliminary filtering and marking.
Solution Approach 2:
The patent extracts the attack packet identification function from the controller and places it in the switch. By extracting this function, the switch can independently identify attack packets using the invalid stream filter table and only send Packet in messages for non-attack packets that genuinely need controller assistance, thereby separating the attack detection responsibility from the controller's path calculation responsibilities.
2Adaptability or versatility
If the switch forwards ARP data packets to multiple switches in a complex topological network, then the ARP packets can reach potential destinations, but multiple switches receive the same ARP packets through multiple ports, causing repeated flow entry queries and wasting switch resources
Solution Approach 1:
The patent applies preliminary action by having the switch check the invalid stream filter table before forwarding ARP packets. If the source or destination address of an ARP packet matches an entry in the invalid stream filter table (indicating a fictitious address), the switch marks the packet as an attack packet in advance and does not forward it. This preliminary identification prevents the amplification effect where the same ARP packet would be repeatedly processed by multiple switches.
3Measurement precision
If the switch sends report messages to the controller for every suspected attack stream, then the controller can identify attack patterns, but the frequent report messages increase network traffic and controller processing load
Solution Approach 1:
The patent applies periodic action by implementing rate limiting on report messages. Instead of sending a report message for every single suspected attack packet, the switch limits the reporting rate to a predetermined threshold. This periodic reporting mechanism maintains attack detection capability while preventing the network from being overwhelmed by excessive report messages during large-scale attacks.
Data Source
AI summary
An attack stream identification method, apparatus, and device on a software defined network is presented, where an invalid stream filter table is stored in a switch, and the method includes the steps of the switch receives a data packet of a data stream and searches, according to a characteristic value of the data packet, the invalid stream filter table for a state field of a filter entry; when the state field is a suspected attack stream state or a non-attack stream state, the switch sends a report message to a controller, determines a rate value for sending the report message to the controller, and fills the rate value in a rate field of the filter entry; and when the rate value is greater than a preset rate threshold, the switch changes the state field of the filter entry to an attack stream state.