# Mitigating Timing Side-Channel Attacks in Software-Defined Networks: Detection and Response +
## 2 Related Work
The compilation and categorisation of network traffic data is a time-intensive and expensive undertaking that presents a challenge to the coverage and scalability of security solutions that rely on machine learning. In the following section, we present a thorough examination of the currently accessible datasets for SDN, along with a critique of their characteristics and features. This section also highlights the need for creating a self-generated dataset. We reviewed current response methodologies to enhance the effectiveness of the detection solution. We observed that the response mechanisms for SDN security breaches have not received sufficient attention. In this review, we have presented two major observations. First, an IDS implemented for SDN security lacks a concrete response mechanism. The emphasis has been on dropping or redirecting the entire traffic from the attacking IP address, which does not facilitate the development of granular flows owing to the performance overhead [42]. Second, existing solutions focus primarily on the fastest response time and neglect the integrity of the responses. Hence, once a response or flow is sent, it remains until the network administrator performs manual actions to remove it. They lack a verification layer that can validate whether responses should be permanent or transient based on the feedback received from previous responses [43]. Table 1 highlights the gaps in response mechanisms. To date, focus on response mechanisms for SDN security breaches has been inadequate. The inadequacy of concrete response mechanisms is a significant issue and existing solutions fail to preserve the response integrity. Emphasis on rapid response times has led to solutions that disregard the importance of the response integrity. Owing to the performance overhead, an IDS implemented for SDN security fails to develop granular flows. Despite the increased prevalence of these attacks, little effort has been made to mitigate them. The emphasis has predominantly been on modifying the network architecture to prevent such attacks rather than devising remedies to combat them. To detect timing-side \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Title** & **Solution and Features** & **Issues and Limitations** \\ \hline Timing-based Reconnaissance and Defense in Software-defined Networks [44] & OpenFlow Timeout Proxy: Sends default responses if the controller is taking more time. & Limited responses: An attacker can generate traffic to fill the switch flow table. Limited to less than 10,000 packets/s. \\ SDN/NFV security framework for fog-to-things computing infrastructure [45] & DDoS/botnets detection and response: Detects attacks and installs Drop rules. & Sends drop rules that can drop legitimate traffic. Also, there is no revision of the drop rule suggested. \\ A Framework for Real-Time Intrusion Response in Software-defined Networking Using Precomputed Graphical Security Models [46] & Real-time intrusion response in SDN using precomputation: Estimates possible attack paths. & Response drops all outgoing traffic from the affected VM, which impacts all services. \\ A Security Architecture Proposal for Detection and Response to Threats in SDN Networks [13] & Network architecture for SDN with detection/protection mechanisms, including IDS technology. & The solution has a high response time (6–7 s) and the response drops all traffic from the node. \\ Counteracting Attacks From Malicious End Hosts in Software-defined Networks [42] & Propose techniques for securing the Controller, switches, and legitimate end hosts from malicious end host attacks in SDNs & The solution drops incoming flow requests as a proactive response. No feedback or monitoring is used on the dropped flow request. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Overview of Recent Response Mechanisms in SDNschannel attack activity, a machine learning-based approach was proposed as an initial effort [47].