# Packet Injection Exploiting Attack and Mitigation in Software-Defined Networks
## 4 Countermeasures
### Injection Detection  
Attackers can easily inject fake hosts by maliciously injecting manipulated packets into SDN. The injection detection module monitors and implements the verification of _Packet-In_ messages and _OFPT_PORT_STATUS_ messages to detect this attack. By verifying the _Packet-In_ message, it is possible to find whether an injection attack occurs. By ascertaining the _OFPT_PORT_STATUS_ message, it is possible to track host location changes dynamically and prevent attackers from bypassing the static matching strategy. **(1) Packet-In Message Verification:** The injection detection module constructs and maintains the mapping table _MT_ between the switch and the host connected. Each mapping entry in _MT_ is composed of \(maci\), \(dpid_{j}\), and \(port_{ij}\). Among them, \(maci\) represents the MAC address of host \(h_{i}\), \(dpid_{j}\) represents the DPID (datapath ID) of switch \(s_{j}\), and \(port_{ij}\) represents the port number where host \(h_{i}\) is connected to switch \(s_{j}\). The verification process \begin{table}
\begin{tabular}{c c} \hline \hline
**Notations** & **Definition** \\ \hline \(S\) & Switches in the network \\ \(s_{j}\) & Switch \(j\) \\ \(h_{i}\) & Host \(i\) \\ \(mac_{i}\) & MAC address of \(h_{i}\) \\ \(dpid_{i}\) & DPID of of \(s_{j}\) \\ \(port_{ij}\) & Port which connected from \(h_{i}\) to \(s_{j}\) \\ \(MT\) & Mapping table of switches and hosts \\ \(interval\) & Time interval \\ \(PINum\) & Number of Packet-In messages \\ \(PMNum\) & Number of Packet-Mod messages \\ \(IFNum\) & Number of irreversible flows \\ \(FlowNum\) & Number of flows \\ \(Flou_{i}\) & The \(i_{th}\) flow \\ \(Tp_{N}\) & Threshold of packets number \\ \(PacketsNum_{i}\) & Total packets of \(i_{th}\) flow \\ \(T_{FL}\) & Threshold of flow lifetime \\ \(Lifetime_{i}\) & Lifetime of \(i_{th}\) flow \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Notations. Figure 7: Architecture of the packet injection exploiting attack defender (PIEDefender). is shown in Algorithm 1. When receiving a _Packet-In_ message from switch \(s_{j}\), the injection detection module first extracts mac, dpid, and port. Then according to dpid and port, it queries \(mac_{i}\) from \(MT\). It needs to be emphasized that the compromised target for the packet injection exploiting attack is the host, not the switch. Since the switch generates the _Packet-In_ message, the dpid and port where the host connects to the switch are factual information, and the attacker spoofed only the host's mac address. There are three cases in the verification process. **Case 1:** There is no entry found in \(MT\). For this case, we consider a new host to join the network or migrate to a new location. We will create a new entry in \(MT\) and forward the message to subsequent modules for processing. **Case 2:** There is an entry in \(MT\), and the \(mac_{i}\) and mac are the same. For this case, we think that the _Packet-In_ message is legal and then forward it to the next module for processing. The reason is that the host's identification has been consistent since joining the network. **Case 3:** There is an entry in \(MT\), but the \(mac_{i}\) is different from mac. For this case, we consider that an injection attack occurs and then forwards the malicious host information to the flow Rule management module. We agree that the host information may change. For example, a host location migrates, or the network user changes the host mac address. The latest mapping information will be stored in \(MT\) if it is a regular migration after passing _port-status_ message verification. Therefore, we have strong reasons to believe that an attack occurs when the information is inconsistent.