Adaptive Suspicious Prevention for Defending DoS Attacks in SDN-Based Convergent Networks

PLoS One. 2016 Aug 5;11(8):e0160375. doi: 10.1371/journal.pone.0160375. eCollection 2016.

Abstract

The convergent communication network will play an important role as a single platform to unify heterogeneous networks and integrate emerging technologies and existing legacy networks. Although there have been proposed many feasible solutions, they could not become convergent frameworks since they mainly focused on converting functions between various protocols and interfaces in edge networks, and handling functions for multiple services in core networks, e.g., the Multi-protocol Label Switching (MPLS) technique. Software-defined networking (SDN), on the other hand, is expected to be the ideal future for the convergent network since it can provide a controllable, dynamic, and cost-effective network. However, SDN has an original structural vulnerability behind a lot of advantages, which is the centralized control plane. As the brains of the network, a controller manages the whole network, which is attractive to attackers. In this context, we proposes a novel solution called adaptive suspicious prevention (ASP) mechanism to protect the controller from the Denial of Service (DoS) attacks that could incapacitate an SDN. The ASP is integrated with OpenFlow protocol to detect and prevent DoS attacks effectively. Our comprehensive experimental results show that the ASP enhances the resilience of an SDN network against DoS attacks by up to 38%.

MeSH terms

  • Algorithms
  • Computer Communication Networks*
  • Computer Security*
  • Software
  • Workflow

Grants and funding

This research was supported by the Chung-Ang University Young Scientist Scholarship (CAYSS) Program, Korea Electric Power Corporation through Korea Electrical Engineering & Science Research Institute (grant number: R15XA03-69), and the MSIP (Ministry of Science, ICT and Future Planning), Korea, under the ITRC (Information Technology Research Center) support program (IITP-2016-H8501-16-1007, IITP-2016-H8501-16-1008) supervised by the IITP (Institute for Information & communications Technology Promotion).