# Packet Injection Exploiting Attack and Mitigation in Software-Defined Networks
## 4 Countermeasures
### Simplified DoS Detection  
The injection detection module authenticates the _Packet-In_ and _OFPT_PORT_STATUS_ messages and realizes the detection of injection attacks. However, the detection accuracy is related to the threshold setting, and there is still the possibility of successful injection. Therefore, PIEDefender implements the simplified DoS detection module to detect malicious hosts that conduct DoS attacks based on injected hosts. The attacker only needs to construct specific packets with MAC addresses pointing to these injected hosts and randomly forge the IP and port, and they can generate numbers of new flows soon. In this way, these unmatched flows would overload the flow table of the switches and excessively consume the controller CPU and the secure channel bandwidth. We extracted the five-tuple as the feature vector to indicate whether the attack occurred by comprehensively analyzing the attack method and the effect. The detailed description and judgment methods are as follows. (1) Rate of _Packet-In_ messages (\(RPI\))  
When a DoS attack occurs, the switch will frequently request the controller via _Packet-In_ messages, increasing the message rate significantly. Therefore, we take the rate of _Packet-In_ messages (\(RPI\)) as an essential parameter to identify the occurrence of an attack and use the following formula for calculation:  
\[RPI=\frac{PINum}{interval} \tag{1}\]where \(PINum\) denotes the sum number of _Packet-In_ messages, and _interval_ indicates the time interval. (2) Rate of _Flow-Mod_ messages (\(RFM\))  
When an attacker launches a DoS attack, the controller must install some flow entries via _Flow-Mod_ messages to establish routes for spoofed flows, increasing the message rate significantly. Therefore, the rate of _Flow-Mod_ messages is an essential characteristic to distinguish attack traffic. The equation of \(RFM\) is as follow:  
\[RFM=\frac{FMNum}{interval} \tag{2}\]  
where \(FMNum\) denotes the sum number of _Flow-Mod_ messages. (3) Percentage of irreversible flows (\(PIRF\))  
We define that the two flows \(flow_{x}\) and \(flow_{y}\) are irreversible if they satisfy any of the following conditions:  
* \(\text{SrcIP}(flow_{x})\
eq\text{DstIP}(flow_{y})\);
* \(\text{DstIP}(flow_{x})\
eq\text{SrcIP}(flow_{y})\);
* \(\text{SrcPort}(flow_{x})\
eq\text{DstPort}(flow_{y})\);
* \(\text{DstPort}(flow_{x})\
eq\text{SrcPort}(flow_{y})\). An attacker sends false packets to implement DoS attacks, only to ensure that the MAC addresses of the packets point to injected hosts and randomly generate IP addresses and ports number. In this case, they cannot establish a complete two-way connection with the target. Thus, the percentage of irreversible flows (\(PIRF\)) sharply increases during the attack and use the following formula for calculation:  
\[PIRF=\frac{IFNum}{FlowNum} \tag{3}\]  
where \(IFNum\) denotes the number of irreversible flows, and \(FlowNum\) denotes the sum number of flows. (4) Percentage of flows with small packets (\(PFSP\))  
A DoS attack usually generates plenty of new flows with a high rate, and the number of packets in each flow is minor (e.g., about 1\(\sim\)3 packets per flow) [13]. Therefore, we can select the percentage of flows with small packets to reveal attack severity. The equation of \(PFSP\) is as follow:  
\[PFSP=\frac{\sum\limits_{i}^{FlowNum}Flow_{i}(PacketsNum_{i}<T_{PN})}{FlowNum} \tag{4}\]  
where \(Flow_{i}\) is the \(i_{th}\) flow, \(PacketsNum_{i}\) denotes the packets number of \(i_{th}\) flow, and \(T_{PN}\) is a threshold value. (5) Percentage of flows with a short lifetime (\(PFSL\))  
Since most attack packets with the same information appear only once, corresponding flow rules installed by the controller will not stay for a long time before timeout. When a DoS attack occurs, massive invalid packets make the percentage of flows with a short lifetime increases.