Towards Trusted and Efficient SDN Topology Discovery: A Lightweight Topology Verification Scheme Abstract   Discovering network topology is critical for Softwaredefined Networking (SDN) controllers to establish the centralized network visibility. However, during the process of SDN topology discovery, SDN controllers tend to suffer from the topology poisoning attacks due to a lack of authentication. Existing methods can hardly solve the problems of SDN topology poisoning attacks in a comprehensive and lightweight manner. To fill this gap, we propose TrustTopo, a lightweight and efficient SDN topology verification scheme. Specifically, we first establish a security threat model to analyze key service vulnerabilities in the SDN controller. Then, we design two verification strategies (i.e., host location verification and link verification) to cope with the host hijacking attack and link fabrication attack, respectively. In more detail, our host location verification strategy is based on the path tracking and asynchronous rollback technique, while our link verification strategy is designed using the chaotic model and dynamic password generation technique. We implement TrustTopo in the mainstream SDN controller (i.e., Floodlight). Experimental results in the Mininet virtual network environment show that TrustTopo can effectively secure the network topology against the representative topology poisoning attacks, while bringing negligible runtime overhead.

A Framework for Distributed Denial of Service Attack Detection and Reactive Countermeasure in Software Defined Network Software Defined Network is an evolving and promising architecture which allows greater control over network entities by centralising the control plane. Although on the surface SDN provides a simple framework for network programmability and monitoring, few has been said about security measures to make it more robust to hitherto security flaws. Among the identified security flaws, DDoS flooding attack continue to be one of the major security concerns as attack volumes are increasing year on year. In this paper, we developed and implement the feasibility of spoofing and flooding DDoS attack on data plane devices using Mininet emulator, floodlight and network performance testing tools. We further developed a mitigation mechanism to counter these attacks by pushing reactive flow through the controller to the attacking switch port. Our result shows that pushing flows through the controller mitigates the flooding attack with low performance overheads, and requires no change to the controllers mode of operation for deployment, which indicates a good performance of our model.