# Packet Injection Exploiting Attack and Mitigation in Software-Defined Networks
## 2 Background and Related Works
### Related Works  
Due to centralized control and programmability features, SDN can provide more advanced functions, such as network monitoring, flow control, and security analysis. Therefore, early research mainly focused on using SDN to empower traditional networks. With the widespread application of SDN, its security problems have become increasingly prominent, and an increasing number of scholars have researched the security of SDN from different aspects. For the topology security in SDN, TopoGuard [7] can automatically discover topology poisoning attacks in real-time. However, it ignored the origin of _Packet-In_ messages in handling the host location hijacking attack. In [21], [PERSON] proposed solving the host usurp attack. It implemented the confirmation for legal hosts by providing an authentication server and authentication log. However, [PERSON] requires additional measures to ensure the authentication server does not become damaged. In [22], the authors demonstrated the persona hijacking, and presented SECUREBINDER, which prevented identifier binding problems. What needs to be emphasized is that the target must be using DHCP for Persona Hijacking to be applicable. CTAD [8] detected different topology attack types by analyzing the relevance of network traffic and verifying link layer discovery protocol (LLDP) frames. TrustTopo [23] as a lightweight and efficient SDN topology verification scheme, coped with  
Figure 1: Software-defined networking (SDN) architecture [20]. the host hijacking and link fabrication attacks. However, this schema did not consider the threats in the startup stage of the network. For resource saturation attacks in SDN, the SA-Detector [9] calculated the self-similarity of regular and abnormal traffic and analyzed the difference against saturation attacks. However, this scheme did not considered the origin of the attack during a saturation attack. In [12], the authors described an enhanced saturation attack and proposed an efficient defense framework named SDNGuardian. vSwitchGuard [10] aimed to identify the compromised switches targeted by foregone or unknown types of saturation attacks with machine learning classifiers. However, the paper only studied five saturation attacks in the SDN environment, and more types of attacks need to be investigated. For the flow table security in SDN, FTGuard [11] implemented a behavior-based priority-aware defense strategy to cope with the flow table overflow attack. WedgeTail [24] distinguished malicious forwarding devices by computing the expected and actual trajectories of packets, effectively protecting the data plane. This approach is helpful, but its deployment in a real-world network is a challenge. The authors of [25] proposed a flow table sharing mechanism, which effectively mitigates the damage to the normal network caused by the flow table overloading attack. In [26], the authors proposed a quality of service (QoS) aware mitigation mechanism, which combined all available flow table resource to solve overloading attacks on a single switch of the system. However, due to the timeout operation, legitimate flows faced the possibility of being denied into the network. For research on denial of service (DoS) attacks in SDN, the authors of [27] proposed a machine learning approach to detect a DoS attack on SDN data plane switches using flow-table information and OpenFlow traffic. In [28], the authors build a mechanism that monitors the network and can differentiate DoS traffic from benign traffic using entropy in an SDN environment. Neural networks were used to detect DoS attacks in [29; 30]. SDN-Guard [31] and FloodDefender [15] mitigated DoS attacks in SDN by dynamically managing flow rules. Although they performed well in defending against DoS attacks, they required additional hardware equipment. In addition, the BWManager [13] proposed an innovative scheduling algorithm for a controller based on bandwidth prediction.