# FEAROL: Aging Flow Entries Based on Local Staircase Randomized Response for Secure SDN Flow Tables
###### Abstract
Although case (1) can be avoided by generating and installing flow entries proactively, cases (2) and (3) are strongly influenced by the flow-entry timeouts set by the controllers when the flow entries are created. Although current research has made great efforts to optimize flow-entry management and timeouts and to achieve a low network-forwarding latency under the constraints of flow table space, such approaches are often designed for normal SDN systems without considering possible cyber attacks [5]. Since flow tables are a critical resource in SDN systems, they have become one of the potential targets for attacks. For example, flow tables can be flooded by the DoS attacks, which use one or more sources to send a large volume of flow packets to a target SDN switch during a very short period of time [6], resulting in cases (2) and (3) and causing the legitimate flow packets to be dropped and significantly increasing the network-forwarding latency. Since the DoS attacks are often accompanied by the rapidly and significantly increased network packet rate, they can be detected quickly and accurately. Therefore, Low-rate Denial-of-Service (LDoS) attacks, which are not sensitive to the existing DoS attack detection techniques, were developed to attack networks in a \"hidden\" manner [7]. Typical LDoS attacks aim to significantly increase the network-forwarding latency by using low-rate pulse packets to periodically attack the network adaptive mechanisms,  
Figure 1: The security issues in SDN systems. such as the congestion control in TCP protocols [8], the keepalive mechanism in HTTP protocols [9], border router buffers [10] and application server queues [11], instead of flooding the entire network in the DoS attacks. In SDN systems, flow-entry timeouts are the network settings that can be adjusted by the controllers. Therefore, LDoS attacks can exploit them to overflow the flow tables and degrade the network performance. Typical flow table overflow LDoS attacks must first sniff the flow-entry timeouts of the target switch and then generate the attack flows to overflow the switch's flowTable [12]. The attack flows used in such LDoS attacks can be the long flows that have a packets inter-arrival time is shorter than the configured flow-entry timeout. Although such flow table overflow LDoS attacks make the overall network packet rate only slightly higher than the normal networks without the attack, the attack flows can occupy most of the flow table space to significantly increase the likelihood of case (3). Although current research has proposed some approaches to detect such LDoS attacks and alleviate the flow table space shortage under attack, such approaches typically work in attacked networks and often suffer from poor efficiency and accuracy in many network scenarios because attack flows can mimic the flows that periodically monitor the status of devices in today's cloud data centers [13], Internet of Things (IoT) and Industry IoT Networks [14]. Instead of reactively detecting LDoS attacks and mitigating the flow table space shortage, this paper proposes a proactive approach that considers the lifespans of flow entries as the privacy of SDN systems and applies the local staircase randomized response to the aging process of each flow entry, so that the true lifespans of flow entries can be protected from sniffing, and the LDoS attacks cannot be effectively organized to overflow the flow tables. The major contributions of this paper are three-fold:  
* A staircase randomized response mechanism [15; 16] is proposed to protect the true lifespan of a flow entry from sniffing. This is a local mechanism that should be used in the aging process of each flow entry in an SDN switch. To the best of our knowledge, this work is the first effort that considers the lifespans of flow entries as the network privacy and proactively protects them from flow table overflow LDoS attacks. * A Flow-Entry Aging RandOmization Layer (FEAROL) is proposed.