# Toward an SDN-Based Web Application Firewall: Defending against SQL Injection Attacks
###### Abstract  
Web attacks pose a significant threat to enterprises, as attackers often target web applications first. Various solutions have been proposed to mitigate and reduce the severity of these threats, such as web application firewalls (WAFs). On the other hand, software-defined networking (SDN) technology has significantly improved network management and operation by providing centralized control for network administrators. In this work, we investigated the possibility of using SDN to implement a firewall capable of detecting and blocking web attacks. As a proof of concept, we designed and implemented a WAF to detect a known web attack, specifically SQL injection. Our design utilized two detection methods: signatures and regular expressions. The experimental results demonstrate that the SDN controller can successfully function as a WAF and detect SQL injection attacks. Furthermore, we implemented and compared ModSecurity, a traditional WAF, with our proposed SDN-based WAF. The results reveal that our system is more efficient in terms of TCP ACK latency, while ModSecurity exhibits a slightly lower overhead on the controller.  
web application firewall; software-defined network; network security +
Footnote †: journal: Software-defined network; network security  
help to reduce operational and management costs, particularly the costs of configuring each network device in large networks. Specifically, SDN can be used to enhance network security by providing the centralized visibility, control, and management of security policies. It enables a dynamic enforcement of security policies based on network traffic patterns, application types, and user behaviors, improving threat detection and response capabilities [7]. The OpenFlow protocol facilitates communication between SDN controllers and switches by granting the controller access to the data plane [8,9].  
However, the application of traditional security solutions to protect web applications or web servers using SDN has not been thoroughly explored in the literature. Existing research primarily focuses on improving malware/ransomware detection [10,11], implementing firewalls to protect networks from external attacks such as DDoS attacks [12, 13, 14, 15], designing flexible honeynets [16], and developing generic moving target defense (MTD) systems [17,18]. Therefore, the design and implementation of an SDN-based WAF is a significant objective for establishing a primary security architecture for future SDN deployments. This work aims to be a pioneering step toward designing an SDN-based WAF specifically focused on defending against SQL injection attacks. The developed prototype was also experimentally compared with ModSecurity, a popular WAF.  
This work aims to address the crucial question of whether a controller can reach or exceed the efficiency of traditional WAFs in detecting SQL injection attacks. Therefore, we did not aim to design a more complex configuration of SDN switches. Moreover, by presenting custom SDN-based security solutions, we demonstrate the potential to protect against these attacks without relying on expensive corporate software and hardware.  
The rest of the paper is organized as follows. Section 2 briefly presents background information on SQL injections, WAFs, and DPI. Section 3 reviews related works, discusses their limitations, and highlights the novelty of our work. Section 4 clarifies our motivation and contribution. Section 5 presents our conceptual design of an SDN-based WAF. Section 6 provides implementation details. Section 7 presents our experimental setup and validation results. Section 8 presents evaluation results for our solution and compares them with ModSecurity WAF. Sections 9 and 10 conclude the paper and discuss future research directions.