FlowMon: Detecting Malicious Switches in Software-Defined Networks

Software-Defined Networking (SDN) introduces a new com-munication network management paradigm and has gained much attention recently. In SDN, a network controller over-looks and manages the entire network by configuring rout-ing mechanisms for underlying switches. The switches re-port their status to the controller periodically, such as port statistics and flow statistics, according to their communica-tion protocol. However, switches may contain vulnerabilities that can be exploited by attackers. A compromised switch may not only lose its normal functionality, but it may also maliciously paralyze the network by creating network con-gestions or packet loss. Therefore, it is important for the system to be able to detect and isolate malicious switches. In this work, we investigate a methodology for an SDN con-troller to detect compromised switches through real-time analysis of the periodically collected reports. Two types of malicious behavior of compromised switches are investi-gated: packet dropping and packet swapping. We proposed two anomaly detection algorithms to detect packet drop-pers and packet swappers. Our simulation results show that our proposed methods can effectively detect packet droppers and swappers. To the best of our knowledge, our work is the first to address malicious switches detection using statistics reports in SDN