# Packet Injection Exploiting Attack and Mitigation in Software-Defined Networks
## 1 Introduction  
Software-defined networking (SDN) has arisen as a revolutionary networking paradigm that can meet escalating demands of future networking [1]. Unlike a traditional network, it separates the network's control plane from the embedded nodes and replaces the classical control plane based on system embedding with an open and programmable soft control plane [2, 3]. Thanks to the openness and programmability of SDN, it has been applied to various fields, such as enterprise networks and data centers. However, the idea of separation of logical control and forwarding function expands the attack surface [4], and the control plane, data plane, and application plane will face security challenges. For example, since the controller has global network visibility, the entire network can be controlled once it is hijacked. With the deep research and broad application of SDN architecture, security has gradually become a fundamental factor restricting its growth [5, 6]. Both academia and the industry have made many efforts and proposed many solutions to enhance SDN security. TopoGuard [7] and the correlation-based topology anomaly detection (CTAD) [8] solve topological attacks in SDN. The saturation attacks detector (SA-Detector) [9], vSwitchGuard [10], FTGuard [11], and SDNGuardian [12] are responsible for defending against data plane saturation attacks and flow table overflow attacks. BWMManager [13], DETPro [14], FloodDefender [15], and DoSDefender [16] adopt different ideas to realize the detection and defense of distributed denial of service (DDoS)/DoS attacks in SDN. PacketChecker [17] and INSPECTOR [18] focus on solving the problem of packet injection attacks. These existing works provide reliable mechanisms from different aspectsand strengthen SDN security. However, novel attack methods and defense strategies still need to be discovered and studied. The authors of [17] first proposed the packet injection attack. They point out that attackers can inject fake nodes into the SDN by maliciously manipulating packets. We continue to carry out research on this basis and consider whether attackers can further exploit these non-existing hosts. The answer is positive. On the one hand, the SDN controller with the OpenFlow protocol as the southbound interface maintains the Host Profile file to track the host's location [7]. When attackers inject spoofed packets by modifying the header's information (e.g., media access control, MAC address), it assumes that a new host joins the network and creates a new Host Profile file. On the other hand, the attacker can quickly establish communication with these non-existent hosts due to a lack of verification of _Packet-In_ messages. As these false hosts have been added to the SDN network topology, the controller will generally route and forward the associated communication behaviors. Once enough false hosts are injected, an attacker can use them to generate plenty of new flows in a short period. For the control plane, since the SDN switch sends all packets with unknown flows to the controller, it will overload the controller's processing capabilities with high CPU consumption and not respond quickly to the legitimate user. For the data plane, because the controller must install many flow entries for each spoofed flow, the flow table of the switches with scarce resources can easily overflow [16]. In addition, these unmatched flows would consume an excessive bandwidth of the secure channel [19]. These limited resources will become the bottleneck of the network. To defend against such an attack that injects and utilizes false hosts to perform malicious behavior, we propose the packet injection exploiting attack defender (PIEDefender). As a lightweight component of the SDN controller, PIEDefender comprises three modules: Injection detection, simplified DoS detection, and flow rule management. The injection detection module constructs and maintains the mapping information between the data plane switch and the host.