# Mitigating Timing Side-Channel Attacks in Software-Defined Networks: Detection and Response +
###### Abstract
Attackers can also exploit security vulnerabilities in software-defined switches to interfere with traffic and obtain unauthorised network access. Moreover, the dynamic nature of SDN renders real-time identification and response to security attacks a formidable challenge. Therefore, specialised security measures, such as network segmentation, access control, and threat intelligence, are required in SDN networks to address these threats and guarantee the confidentiality, availability, and integrity of network resources. Several solutions have been proposed to effectively mitigate security challenges in SDN [1]. The majority of existing research on SDN security is primarily concentrated on network segmentation, which involves dividing the network into smaller and more isolated units, thus hindering the spread of an attack. Additionally, Network Access Control (NAC) measures are employed to restrict network access based on predefined policies, thereby ensuring that only authorised devices are permitted to access the network. Furthermore, Intrusion Detection and Prevention Systems (IDPS) are implemented to detect and prevent attacks in SDN. Such systems leverage both signature-based and behavioural techniques to detect and impede malicious activity before it can cause damage. Current solutions place considerable emphasis on encryption, which involves converting sensitive data into an unreadable format. To achieve this, transport layer security (TLS) and virtual private network (VPN) technologies have been used. Within the framework of an SDN environment, an attacker could exploit the centralised nature of the controller to obtain classified data. Through a careful examination of the time patterns of packet transmissions, adversaries can deduce sensitive attributes such as the structure of the network or even the nature of the applications being executed. Furthermore, a comprehensive analysis of the controller's packet response mechanism has the potential to reveal firewall configurations or even identify specific network assets that may be susceptible to future attacks. Owing to the separation of the control and data planes, SDNs are vulnerable to timing side-channel attacks. In conventional networking, control and data planes are implemented on physical infrastructure, such as switches and routers. Therefore, conventional networks are not immune to timing attacks. The architectural differences between SDN and traditional networks have resulted in the disregard for side-channel attacks in SDN deployment. Nonetheless, researchers have identified this as a potential SDN adoption barrier [2]. To date, only a limited number of detection and response techniques have been investigated and implemented [3]. Although these techniques can eliminate time side-channels in an SDN, they cannot determine an adversary's presence or detect the timing probe activity in the network. In this study, we present a novel intrusion detection and response solution designed to handle timing-probe activities in an SDN environment. The key contributions of this study are as follows:  
* To detect the timing side-channel attacks, this solution employs machine learning techniques to accurately predict the network timing probe activity. First, we review, the currently available SDN datasets for the timing side-channel attack parameters. Subsequently, we generated a dataset and utilised our labelling algorithm. We evaluated the effectiveness of four commonly used machine learning methods: random forest [4], decision tree [5], XGBoost [6], and bagging [7]. The processed dataset and information from the SDN topology were utilised to detect probe activity and identify the adversary's source machine. * A response mechanism is implemented to respond to the identified side-channel attack probes. This mechanism involves developing a feedback-oriented response, designed to block or divert the identified source, while minimising any adverse effects on legitimate network traffic.