Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with SoftwareDefined Network Network reconnaissance aims at gathering as much information as possible before an attack is launched. Meanwhile, static host address configuration facilitates network reconnaissance. Currently, more sophisticated network reconnaissance has been emerged with the adaptive and cooperative features. To address this, in this paper, we present Hiding and Trapping (HaT), which is a deceptive approach to disrupt adversarial network reconnaissance with the help of the softwaredefined networking (SDN) paradigm. HaT is able to hide valuable hosts from attackers and to trap them into decoy nodes through strategic and holistic host address mutation according to characteristic of adversaries. We implement a prototype of HaT, and evaluate its performance by experiments. The experimental results show that HaT is capable to effectively disrupt adversarial network reconnaissance with better deceptive performance than the existing address randomization approach.

Towards Trusted and Efficient SDN Topology Discovery: A Lightweight Topology Verification Scheme Abstract   Discovering network topology is critical for Softwaredefined Networking (SDN) controllers to establish the centralized network visibility. However, during the process of SDN topology discovery, SDN controllers tend to suffer from the topology poisoning attacks due to a lack of authentication. Existing methods can hardly solve the problems of SDN topology poisoning attacks in a comprehensive and lightweight manner. To fill this gap, we propose TrustTopo, a lightweight and efficient SDN topology verification scheme. Specifically, we first establish a security threat model to analyze key service vulnerabilities in the SDN controller. Then, we design two verification strategies (i.e., host location verification and link verification) to cope with the host hijacking attack and link fabrication attack, respectively. In more detail, our host location verification strategy is based on the path tracking and asynchronous rollback technique, while our link verification strategy is designed using the chaotic model and dynamic password generation technique. We implement TrustTopo in the mainstream SDN controller (i.e., Floodlight). Experimental results in the Mininet virtual network environment show that TrustTopo can effectively secure the network topology against the representative topology poisoning attacks, while bringing negligible runtime overhead.