Atacando e defendendo redes definidas por software

Abstract

Software Defined Networks (SDN) facilitate network management by decoupling the data plane which forwards packets using efficient switches from the control plane by leaving the decisions on how packets should be forwarded to a (centralized) controller. However, due to limitations on the number of forwarding rules a switch can store in its Ternary Content-Addressable Memory (TCAM), SDN networks have been subject to saturation and TCAM exhaustion attacks where the attacker is able to deny service by forcing a target switch to install a great number of rules. An underlying assumption is that these attacks are carried out by sending a high rate of unique packets. This work shows that this assumption is not necessarily true and that SDNs are vulnerable to a novel attack, called Slow TCAM exhaustion attacks (Slow-TCAM) in which existing defenses for saturarion and TCAM exhaustion attacks are not able to mitigate it due to its relatively low traffic rate and similarity to legitimate clients. In this work is also proposed a novel defense called SIFT based on selective strategies demonstrating its effectivenes against the SlowTCAM attack in different scenarios, obtaining levels of availability above 92% (worst case scenario)when the network is under attack while having low memory and CPU consumption.