# FEAROL: Aging Flow Entries Based on Local Staircase Randomized Response for Secure SDN Flow Tables
## 2 Background and Related Work
### Flow Table Overflow LDoS Attacks  
In addition to the centralized controller and the centralized mechanisms in collecting network statistics and controlling the policy enforcement [36; 37; 38], recent research found that flow table overflow LDoS attacks can be organized and eventually exhaust the flow table space when the flow-entry timeouts are sniffed [14].  
As shown in Figure 3, flow table overflow LDoS attacks can have multiple long or short attack flows. While each of the long flows continuously occupies the space of a flow entry, the short flows are carefully organized to ensure that the space of a timed-out flow entry must be occupied by the entry of a short attack flow. By synchronizing the attack period and the timeouts of normal flow entries, the flow table space will eventually be exhausted by the attack flow entries, and the legitimate incoming packets will be dropped due to the lack of flow table space [39].  
Since current SDN controllers typically configure static timeouts across flow entries, the flow-entry timeouts can be easily sniffed using the ping utility [12]. If the flow table size is also detected by applying the combination detection approaches as proposed in [40], attackers can effectively synchronize the attack period and the flow-entry timeouts; thus, the difficulty of overflowing the flow table becomes low in reality.  
The state of the art in protecting flow tables from overflow by LDoS attacks typically relies on machine-learning algorithms to model and detect LDoS attack flows. However, this often suffers from a low detection accuracy [32; 33; 34] because the long attack flows used in LDoS attacks can mimic the flows that monitor the various devices in IoT networks, and the short attack flows used in flow table overflow LDoS attacks are very similar to the network legitimate short flows, in their packet inter-arrival time, packet count, flow count and packet size.  
Although the detection accuracy can be improved by effectively monitoring the changes in the overall network performance [35], such approaches suffer from a long detection delay, causing late detection that can only be mitigated by using the flow table space-management mechanisms introduced in Section 2.2, rather than predicting or preventing flow table overflow attacks in advance. This work fills this gap.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Approach** & **Type** & **Feature** & **Strength** & **Weakness** \\ \hline
[5; 19] & a & dynamic timeout & better table use & affect other metric \\
[20; 21] & a & entry eviction & better table use & affect other metric \\ \hline
[4; 24] & a & flow aggregation & flow based & entry invisibility \\
[25; 26; 27] & a & flow aggregation & address based & entry invisibility \\ \hline
[28; 29] & a & entry distributing & long latency & inter-switches cooperation \\
[30; 31] & a & entry caching & low latency & table-cache cooperation \\ \hline
[32; 33; 34] & a & ML alg. involved & identify attacks & low accuracy \\
[35] & a & monitor network & identify attacks & late detection \\ \hline FEAROL & b & randomized aging & destroy attacks & overhead on switches \\ \hline \hline \end{tabular}
\end{table}
Table 1: Approaches to detect and mitigate flow table overflow LDoS attacks (a—reactive defense and b—proactive defense).