Keywords

1 Introduction

IT has evolved exponentially through the Cloud, Internet of Things (IoT), Big Data, virtualization, block chain, etc. The number of devices connected to the internet has increased considerably, to more than 74,44 billion devices in 2025 [1]. In addition, modern applications make further demands on the availability of bandwidth. Despite this, traditional computer networks have remained static for decades. This is because its network architectures operate hierarchically and vertically [2]. The design, evaluation and deployment of a protocol can take 5 to 10 years in today's networks [3] as the IPV4 to IPV6 transition takes place. The difficulty of updating existing network security policies lies in the CLI command line [4]. These limitations have resulted in a lack of flexibility and agility in traditional networks.

The SDN was born in this context to overcome the monotony of traditional networks. SDN is a network architecture where the control plane is dissociated from the transfer plane and is directly programmable. All the intelligence of the SDN network is logically centralized on the software controller. The router and switches become simple packet transfer devices. The SDN has lots of strengths but also still faces security issues. Indeed, the centralized nature of the controller, its programmability, the decoupling of the control from the data planet and the lack of intelligence of the SDN transfer equipment [5] amplify its vulnerability and introduce new security flaws [6]. Research in the field of performance, virtualization, loadbalacing and the network supervision has been carried out in the SDN. One of the broadest fields of research concerns SDN security in general and more specifically DoS/DDoS attacks, to assure the transition between traditional network and the SDN.

Most of the DoS/DDoS attacks perpetrated in the SDN network are issues out on the controller, or on the transfer equipment [7]. This paper presents security in the SDN network in general and more specifically in DoS/DDoS attacks. We will focus on the different types of DoS/DDoS attack on the SDN communication layers and interfaces. This document is organized as follows: Sect. 2 presents the SDN network; Sect. 3 describes security in SDN. Section 4 classifies the modus operandi and different types of DoS/DDoS attacks. Section 5 discusses the different security threats and the corresponding mitigation mechanisms. Section 6 proposes the contribution of the authors and opens the perspectives of research in the field.

2 Presentation of the SDN Architecture

The SDN architecture has three main layers which are the Infrastructure, Control, and Application.

Fig. 1.
figure 1

Layered view of SDN architecture

Full size image

2.1 Infrastructure Layer or Data Transfer Layer

The data layer is made up of various network devices that form the underlying network to carry traffic. Switches or routers and are linked by either physically wired or wireless media. Each switch is a simple packet transfer device, which has one or more flow tables within it. Each switch flow table contains a set of flow entries with packet routing rules [2].

2.2 Control Layer

The control layer is the intelligent part of the SDN network [3], because it maintains the entire structure of the network. All network management decisions are made by one or more controllers on the SDN network. The interaction between the controller and the deployed switches is called the southbound interface. The OpenFlow protocol is the most widely used between the control and transfer layer. This protocol was proposed by researchers at CleanState at Stanford University because of its flexibility and programmability. Its success is due to the support of certain technology giants such as Microsoft and Google [9], who quickly adopted it in their datacenters. A consortium called ONF has been set up for the standardization of the OpenFlow protocol [10]. On the opposite side, we have the Northbound API [11], which links the communication of business applications to the controller. There are two other interfaces in the case of a multi-controller network called Eastbound and Westbound respectively. Since the controller is the brain of the SDN network, its centralized nature creates a single point of failure in the network. To avoid network downtime most recent controller implementations offer the possibility of having multiple and distributed controllers such as NOX, POX [12], FLOODLIGHT [13], OPENDAYLIGHT [14].

2.3 Application Layer

It is the layer where all innovative network applications are developed. These applications can be used in the field of security, network load balancing, quality of service, etc. [15]. The application layer communicates with the control layer through the Northbound interface.

3 Generality on SDN Security

DDoS attacks are increasing continuously with sophisticated characteristics. These attacks concern all digital services with heterogeneous devices (computers, phones, cameras, etc.). This motivates researchers and equipment manufacturers namely CISCO, IBM, DELL, HUAWEI to focus more on this question. According to Yao et al. [16], there are three types of security issues: SDN intrusion, denial of service, and application trust management. A network intrusion is any action aimed at compromising the availability, integrity and confidentiality of any network resource or service [17]. There are other types of security issues in SDN. Those are applications, developed by third parties which make the application layer vulnerable. According to Li et al. [18], the security challenges in the SDN architecture based on OpenFlow are security issues on switches, controllers, applications and communications interfaces.

Table 1. The various security issues by layer and interface.
Full size table

3.1 Fields of Attack in the Architecture of SDN

In the SDN all layers and interfaces can be attacked. There are six DDoS attack points according to Shu et al. [19].

  • Attacks on SDN switches: A SDN switch is typically a separate device made up of related hardware and software, which are vulnerable to DDoS attacks. An example of a vulnerability is the small size of the SDN switch flow table and the resources of CPU, memory CAM/TCAM (Ternary Content Address Memory) [20].

  • Attacks on links between SDN switches: the Packets transmitted between SDN switches are not encrypted and may contain sensitive user information. These packets can be intercepted by attackers easily, especially when the links between switches are wireless [21].

  • Attacks on the SDN controller: all network management is done at the level of the controller, so it constitutes a potential target for attackers. Any attack on the control layer will have a direct impact on the operation of the SDN. Since each new flow is sent to the controller for decision, this leads to the saturation of the controller resources [20].

  • Attacks between SDN controller’s links: In a multi-controller environment, communication between different controllers is necessary to maintain the consistent state of the entire SDN. In the event of an attack, packets can be intercepted via the Eastbound and Westbound APIs.

  • Attacks between Controller and links: SDN centralizes all network intelligence on the controller. All new transfer rules are inserted into the switches by the controller via the Southbound API [19]. Data packets that contain these rules can be modified or tampered with by a malicious attacker who listens on the link between the controller and the switch.

  • Attacks on SDN applications: It constitutes the added value in SDN, because it allows the development of innovative applications of the network. When applications solicit the controller through the Northbound malicious code can be embedded in the controller. The lack of a security mechanisms to ensure a relationship of trust between controllers and applications is at the root of these kinds of attacks [19].

3.2 Discussions on SDN Security

The SDN network offers more flexibility and programmability compared to the one in traditional network but the security issue in the SDN is almost identical to traditional network. We can have several types of attacks in SDN (see Table 1). The data layer is presented as the weakest link of the SDN chain in terms of security. There are many Southbound API solutions like OpenFlow, Open vSwitch Database Management Protocol (OVSDB), Path Computation Element Protocol (PCEP), Interface to the Routing System (I2RS) that exist [18]. However, not all these APIs are reliable and address security concerns. Several types of attacks can occur at this level, compromising switches or hosts. According to Dayal et al. [22] these are mainly denial of service, Man in the Middle (MIM), data modification, repudiation and side channel attacks.

4 Overview of DoS/DDoS Attacks in the SDN Security

A DDoS attack aims to make a server, service unavailable to legitimate users [4]. We will speak of a distributed DoS attack, any attack that is carried out remotely from several sources consisting of several hundred or even thousands of devices [23]. According to Saman et al. [24], the DDoS attack aims to disrupt the connectivity of legitimate users by depleting network resources. In this section, we describe the classification of DDoS attacks on the different layers and interfaces.

4.1 DDoS Security Threats on the Infrastructure Layer

This consists of networking devices that control the forwarding and data processing capabilities for the network. The attack against SDN data plane takes place at two levels, either on the CAM/TCAM memory of the switch by its overload on the one hand, and on the other hand, the saturation of its flow table. In the process of the Openflow switches, each new flow without correspondence in the flow table is sent to the controller for decision. The new rules can be inserted in the flow table via the interface southbound. In the event of a DDoS attack, the attacker can easily fill the flow table with new flow and saturate the switch. In addition, if the switch memory is saturated, instead of sending just the packet header, the entire packet will be sent to the controller [25].

4.1.1 Detection Mechanisms and Threats Against DDoS Attacks on the Infrastructure Layer

Several detection and defense mechanisms against DDoS attacks have been developed by researchers and industry. According to R. Swami et al. [4], these mechanisms can be classified into three main categories which are mechanism based on statistics, Machine Learning, or specific applications. Statistics-based detection mechanisms are statistical analyzes, which collect, and exploit data samples based on network traffic in order to make a decision on DDoS attacks. The work of several authors [26, 27] are algorithms based on statistics such as entropy, chi-square, which are used to detect DDoS attacks in the SDN.

These statistical techniques commonly used in the work are based on adaptive correlation analysis, standard deviation, probability, and entropy measures. Network features such as source IP address, destination IP address, and port numbers are used to calculate entropy with predefined thresholds to identify the presence or absence of DDoS attacks [28]. Another technique based on machine learning are used recent years due to their effectiveness in detecting DDoS attacks in SDN. These algorithms can be used to detect malicious traffic from legitimate traffic in the SDN. The algorithms used are artificial neural networks [41], Bayesian networks [42], self-organizing map (SOM) [29],and fuzzy logic [30, 31]. Other techniques use the intrinsic characteristics of SDN with specific applications for detection and defense against DDoS attacks.

According to Chen et al. [32], they proposed Flexprotect to protect data centers. They used the intrinsic features of SDN and NFV to protect the data center network from DDoS attacks. Two modules are offered by Flexprotect, the first one for detection and the second for mitigation, that are deployed separately in the system. A solution to defend against DDoS attacks with the monitoring tool named sFlow was proposed by Aizuddin et al. [33]. The proposed system used SDN features to support DDoS attacks against DNS amplification. It collects and processes header flows to check whether they originate from a DNS server. Zheng et al. [34] have implemented a solution to mitigate DDoS attacks by applying a real time adaptive correlation analysis called RADAR (Reinforcing Anti-DDoS Actions in Realtime). It consists of three main modules which are the collector, detector, and locator. RADAR can identify several types of attacks in real time, such as SYN flood, UDP flood and DNS amplification. The FlowTrApp tool [35] is an SDN-based DDoS defense mechanism for protecting data centers. FlowTrApp uses two parameters which are the rate and the duration of a flow. The characteristics of OpenFlow [36] are coupled with those of sFlow [37] for the collection of flow statistics. A tool called Woodpecker [38] is proposed by L. Wang et al. to detect and mitigate the type of DDoS flood attack using the characteristics of the SDN. Several selected ordinary switches are upgraded to SDN compatible switches. With the help of the global view provided by the SDN controller, Woodpecker locates the location of the bottleneck and identifies whether the congestion is really caused by link flooding. Woodpecker uses heuristic traffic engineering as an application on the controller to mitigate the impacts of the attack. The work of J. Liu et al. [39] focused on a modular tool called Floodlight Guard, which was implemented for detection and defense against DDoS attacks in SDN. FLGUARD applies dynamic IP address binding to solve the problem of IP address spoofing and uses the C-SVM algorithm to detect attacks. According to the authors Q. Niyaz et al. [40] their work is based on machine learning, the SAE (Stacked Autoencoder) to detect multi vector attacks in SDN. The packet headers are extracted classified in an unsupervised way by machine learning. SAE can detect DDoS attacks on control and data plane.

4.1.2 Summary Table of the Detection and Defense Mechanisms Against DDoS on the Infrastructure Layer

Security at the infrastructure layer is summarized as mentioned in the table below, DDoS attacks are the pure enemies of SDN. Because in the event of successful attacks on this layer, the entire network is crippled. This amplification of DDoS attacks on this layer could be explained by the non-intelligence of the switches. Several efforts are being deployed by researchers and industry to ensure the security of the SDN against DDoS attacks, but we mention some shortcomings in the work carried out.

Table 2. Detection and defense mechanisms against DDoS attacks on data layer
Full size table

4.2 Security Threats at the Control Plane in SDN

Control plane security has a direct impact on the data and application layer. If one controller is compromised, the entire network, including switches, is affected. This is because when an Openflow switch can no longer receive forwarding rules from the controller, it will not know how to handle packets. Therefore, due to its important role, the controller is a key target for attackers. Hence the need to protect the control layer to preserve the security of SDN. There are several types of DDoS attack threats that still weigh heavily on the control layer. DDoS attacks generate an enormous amount of packets to overwhelm the resources of the controller in order to make network services or interface bandwidth unavailable to legitimate users [53]. In the SDN architecture, all packets management commands are concentrated on the controller. Most DDoS attacks on the controller try to saturate the controller with the arrival of new packets to increase the CPU workload and creat a botlneck between the control plane and the data plane. This separation of control over packet forwarding is one of the strengths of SDN [57], yet it is also one of the weaknesses of the SDN architecture.

4.2.1 Security Threat Detection Mechanisms Against DDoS Attacks on the Control Layer

The control plane is the most critical in the SDN architecture, as all the intelligence of the network is focused on it. Several tools have been developed to protect this plane against DoS/DDoS attacks in order to avoid its downtime. A tool called DBA (DDoS Application Blocking) has been proposed by Lim et al. [53], which consists of blocking DDoS attacks from the abnormal traffic. The architecture requires communication between the DDoS blocking application running on the SDN controller and the server to be protected. The other exchanges are carried out through the standard interfaces of Openflow. L. Dridi et al. [58] focuses on the development of an effective tool called SDNGUARD. This tool helps to protect SDN networks from DDoS attacks simultaneously and mitigate DoS impact on SDN controller and bandwidth between data layer and switch control. SDNGUARD also dynamically manages flow routes, rule entry delays, and aggregate flow rule entries. This tool performs well in protecting switch controller and bandwidth during DDoS attacks. To solve the bottleneck problem between the data plane and the control plane, the authors of [59] introduce Avant-Guard, an extension of the Openflow data plane called “connection migration”. The purpose of this connection migration is to add intelligence to the switches in the data plane, in order to prevent the TCP based DDoS attacks. The objective of the Avant-Guard is to reduce the spoofing of IP addresses, by effectively delete a quantity of data to be transferred to the control plane during a DDoS attack.

FloodDefender [60] is an effective, protocol independent defense tool for SDN / Openflow networks that helps mitigate DDoS attacks. It sits between the control plane and the other controller applications, and can protect both the data layer, memory and CPU resources of the control plane using three new techniques that are: “table engineering-miss”, “packet filtering”, and finally “management of the flow rule”. According to Celyn et al. [24], they implemented a tool for intrusion detection and prevention against certain types of TCP-based DoS attacks in the SDN network. Two connection techniques were used for IPDS namely CB-TRW (Credit-Based Threshold Random Walk) and RL (Rate Limiting), a port scanning detection technique that the authors call Port Bingo (PB), and a QoS technique that relies on throughput statistics to mitigate DoS attacks.

4.2.2 Summary of the Table of the Mechanisms for Detecting and Defending Threats Against DDoS Attacks on the Control Layer (See Table 3)

In the SDN network, the controller is the intelligent part of the SDN. All network management décisions are made by the controller. This makes the controller a potential point of attack. In addition, in the case of an SDN network with a single controller, the latter is a single point of failure of the network. These attacks are mainly focused on saturating the resources of the controller. Another DDoS attack angle on the control layer is the saturation of the bandwidth of the Openflow channel that links the data layer to the controller. Several techniques are used to ensure the security of the controller against DDoS attacks, mainly detection and defense mechanisms. These mechanisms used are IDS, IPS and NIDS tools, for the detection and mitigation of DDoS attacks. Other techniques are used to strengthen the detection and mitigation of DDoS attacks on the controller and interfaces (Table 4).

Table 3. Different sources of SDN attacks on the SDN control and data layer
Full size table
Table 4. The various security issues by layers and interfaces
Full size table

4.3 Security Threats on the Application Layer

In the SDN architecture, the application layer is a critical point of DDoS attack. This is due to the variety of applications supported by this layer. A DDoS attack can occur either on different applications or on the Northbound API between the control plane and the application. The diversification of applications and their design by several stakeholders lead to a notorious security breach on the application layer, application can contain malicious code, which can spread throughout other applications.

4.3.1 Security Threat Detection Solutions Against DDoS Attacks on the Application Layer

Nowadays, computer applications are diverse and multiple in all areas. This exposes the SDN network to face DDoS attacks from them. Thus, several studies have been carried out in the context of securing SDN applications. The FLOVER [48] is a model verification system that verifies the global disconnection policies instantiated in OpenFlow network do not violate the network security policy. Another tool VERICON [49] is a system which verifies that the SDN network is indeed properly configured. Adel et al. have proposed an OrchSec tool [50], an orchestrator module developed in the application layer which uses the functionalities of the Openflow controller (redirects or blocks packets) and SFlow-RT for monitoring. It aims to improve network security by reducing overloads on SDN controllers by decoupling the control and monitoring functions. Another technique using WILDCARD, to access the information level by sampling a packet and keep its visibility on the Openflow network has been proposed by Sajad et al. FleXam [51]. Flexam collects network statistics efficiently.

5 Panoply of Open Issues on the Control Layer, Data Layer, and Southbound Interface in SDN

The SDN network presents a lot of openness in terms of vulnerabilities for attackers in general and more specifically for DDoS attacks. This is how several researches are carried out or underway to mitigate DDoS attacks in SDN. Most of these DDoS attacks happen on the control plane, the bandwidth of the interface between the controller and the switches.. Most of the research for the detection and mitigation of DDoS attacks has been carried out for the control layer, data and their link interface. It is clear that these DDoS attacks are constantly being improved by attackers in order to bypass detection and defense measures. The most widespread attacks are above all TCP, ICMP, UDP floods (see Tables 2 and 3).

6 Contribution of This Document and Future Research Perspectives

In this paper we have seen the security challenges that abounds in the SDN network in general and more specifically against DoS/DDoS attacks. We have reviewed the security issues by layer and by interfaces between layers. Most detection mechanisms use the intrinsic characteristics of the openflow based SDN in order to collect statistics and information based on the openflow protocol. Once a certain number of conditions are met, mitigation tools such as IDS, NIDS or IPS are mobilized to mitigate attacks. Our future research will focus on the detection and mitigation of DDoS attacks in the two SDN layers as well as the link interface between them.

7 Conclusion

SDN is the latest trend in computer networking, its adoption as a new paradigm is shaking up the habits of traditional networking. The separation of the control plane from the data plane is the most interesting advantage of the SDN. The centralization of control makes it possible to better secure the SDN from different types of attacks, in general and to bring innovations in its management through network programming. In this article we have reviewed the architecture of the SDN network and DDoS attack. This showed that the separation of the control plane from the data plane, which is one of the biggest strengh of the SDN, can also be at the same time, the biggest weakness of the SDN. In recent years, several researchers have initiated research with a particular focus on fighting DDoS attacks, but much research remains to be done in this area. In this paper we have focused on the two planes of the SDN architecture namely the control plane and the data plane. We have noticed that most DDoS attacks take place on these two planes on the one hand, and on the other hand between the communication interface between these two planes.

In addition, most of the proposed detection and defense solutions to mitigate DDoS attacks in the SDN manage the rates of the inbound flows to determine the attack. Other solutions combine input streams with either NIDS, IDS, IPS, packet filtering, machine learning, or statistical tools to define the attack. Some proposed mitigation tools also make it possible to add a little intelligence at the level of data plane or use additional equipment for the detection of DDoS attacks.

In this context we will propose a tool, which can use the intrinsic characteristics of SDN, Openflow protocol and sFlow for the detection and mitigation of DDoS attacks. The combination of SDN and sFlow makes this possible whitout the need for additional equipment, just the intrinsic characteristics of SDN.