# FEAROL: Aging Flow Entries Based on Local Staircase Randomized Response for Secure SDN Flow Tables
###### Abstract  
Software-Defined Networking (SDN) systems are sensitive to the lifespans of flow entries in flow tables as such lifespans affect the overall network-forwarding latency and the flow table space usage, particularly when the systems are under cyber attack. Instead of developing extra approaches to reactively detect the attacks and mitigate the impact of the attacks, this paper views the lifespans of flow entries as the privacy of the SDN systems and proposes a Flow-Entry Aging RandOmization Layer (FEAROL), which applies the staircase randomized response mechanism in the flow-entry-aging process at switches. FEAROL locally perturbs the lifespan of each flow entry in the flow table. Since the true lifespan of each flow entry is different from the lifespan set in the entry by the controller and dynamically perturbed by FEAROL, Low-rate Denial-of-Service (LDoS) attacks based on the sniffed flow-entry timeouts cannot be effectively organized. FEAROL proactively prevents LDoS attacks from overflowing the flow tables and legitimate flow packets from being dropped due to the broken synchronization between attack flows and the network settings. FEAROL can adjust its aging policies and privacy budget based on the real-time monitored network performance. FEAROL is prototyped in an open-source soft switch (OpenVSwitch) and evaluated through simulations on real network traces. The results show that FEAROL increases the overhead of aging a flow entry. However, this overhead can be significantly reduced by adjusting the interval at which the aging process is triggered. FEAROL also effectively defends against flow table overflow LDoS attacks by significantly reducing the table usage of LDoS attack flows. When the aging strategy is carefully chosen, the table space used by attack flow entries can be reduced to 0. Software-Defined Networking; staircase randomized response, local differential privacy; flow-entry timeouts; LDoS attacks; flow table overflow LDoS attacks Article  
FEAROL: Aging Flow Entries Based on Local Staircase Randomized Response for Secure SDN Flow Tables [PERSON] Liao Liao Liao Ma  
Flow tables are the places where SDN switches maintain the forwarding rules used to process the packets they receive. The forwarding rules, also known as flow entries, are typically generated by SDN controllers and installed on the switches in a reactive manner, since switches in the data plane are \"dumps\" with no \"brains\". SDN switches typically store flow tables in their Ternary Content Addressable Memory (TCAM). As TCAM is expensive and power hungry, TCAM has limited space. Since SDN systems need to enable flow-based entries to provide network flexibility, while the number of flows in SDN systems increases as things increasingly join the networks, it is difficult for an SDN switch to maintain the fine-grained flow entries for all received flow packets. Therefore, SDN systems enforce each flow entry in the flow table to have a lifespan defined by the flow-entry timeouts to better utilize the flow table space [3]. Flow-entry timeouts are extremely critical for SDN systems, because they determine the lifespan of flow entries, which significantly affect the flow table space utilization and the network-forwarding latency. SDN systems typically enable a flow setup procedure in which the controller reactively generates and installs an appropriate flow entry for each new flow in the network. This procedure is triggered by a flow-entry-lookup miss at a switch and adds an extra flow setup delay that increases the overall network-forwarding latency [4]. In current SDN systems, a flow-entry-lookup miss can occur in three typical cases: (1) the received packet belongs to a new flow that has never appeared on the network; (2) the received packet belongs to an old flow that has appeared on the network but its matching flow entry has been removed from the flow table due to the timeout; and (3) the received packet belongs to an old flow but its matching flow entry has never been installed due to lack of flow table space.