Preventing Malicious SDN Applications From Hiding Adverse Network Manipulations
(Aug 24, 2018)Abstract
In Software-Defined Networks (SDN), so called SDN controllers
are responsible for managing the network devices
building such a network. Once such a core component of
the network has been infected with malicious software (e.g.,
by a malicious SDN application), an attacker typically has a
strong interest in remaining undetected while compromising
other devices in the network. Thus, hiding a malicious network
state and corresponding network manipulations are important
objectives for an adversary. To achieve this, rootkit
techniques can be applied in order to manipulate the SDN
controller’s view of a network. As a consequence, monitoring
capabilities of SDN controllers as well as SDN applications
with a security focus can be fooled by hiding adverse network
manipulations.
To tackle this problem, we propose a novel approach capable
of detecting and preventing hidden network manipulations
before they can attack a network. In particular,
our method is able to drop adverse network manipulations
before they are applied on a network. We achieve this by
comparing the actual network state, which includes both
malicious and benign configurations, with the network state
which is provided by a potentially compromised SDN controller.
In case of an attack, the result of this comparison
reveals network manipulations which are adversely removed
from an SDN controller’s view of a network. To demonstrate
the capabilities of this approach, we implement a prototype
and evaluate effectiveness as well as efficiency. The evaluation
results indicate scalability and high performance of our
system, while being able to protect major SDN controller
platforms.
Links and resources
Tags
community
@savolainenpekka's tags highlighted