SPHINX: Detecting Security Attacks in Software-Defined Networks

22nd Annual Network and Distributed System Security Symposium, NDSS 2015

Volumn , Issue , 2015, Pages

  Dhawan, Mohan ^a   Poddar, Rishabh ^a   Mahajan, Kshiteej ^a   Mann, Vijay ^a  

^a IBM RESEARCH   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; FLOW GRAPHS; NETWORK TOPOLOGY; SOFTWARE DEFINED NETWORKING;

CONTROL OVER NETWORKS; CONTROL PLANES; DATA PLANES; DATA-PLANE; FLOW-GRAPHS; NETWORK DATA; NETWORK TOPOLOGY; SECURITY ATTACKS; SOFTWARE-DEFINED NETWORKS; UNKNOWN ATTACKS;

CONTROLLERS;

EID: 84943292313     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.14722/ndss.2015.23064     Document Type: Conference Paper

References (44)

1. “ARP poisoning attack, ” http://goo.gl/p4AVhf.
2. “Cbench, ” http://www.openflowhub.org/display/floodlightcontroller/Cbench+(New).
3. “CRATE datasets, ” ftp://download.iwlab.foi.se/dataset.
4. ∼tbenson/IMC10_Data.html.
5. “Dynamic ARP Inspection, ” http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/122SX/configuration/guide/book/dynarp.html.
6. “Fake topology attack, ” http://goo.gl/zRG8bz.
7. “LBNL/ICSI Enterprise Tracing Project, ” http://www.icir.org/enterprise-tracing/.
8. “Maestro, ” https://code.google.com/p/maestro-platform/.
9. “Mausezahn, ” http://www.perihel.at/sec/mz/.
10. “Mininet, ” http://mininet.org/.
11. “Netty, ” http://netty.io/.
12. “Open DOVE, ” https://wiki.opendaylight.org/view/Open_DOVE:Main.
13. “Open vSwitch, ” http://openvswitch.org/.
14. “OpenDaylight, ” http://www.opendaylight.org/.
15. “OpenFlow switch specification, ” http://openflow.org/documents/openflow-spec-v1.1.0.pdf.
16. “POX, ” http://www.noxrepo.org/pox/about-pox/.
17. “Project Floodlight, ” http://www.projectfloodlight.org/floodlight/.
18. “Tcpreplay, ” http://tcpreplay.synfin.net/.
19. “VXLAN: A Framework for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks, ” http://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-05.
20. E. Al-Shaer and S. Al-Haj, “FlowChecker: Configuration Analysis and Verification of Federated Openflow Infrastructures, ” in SafeConfig'10.
21. E. Al-Shaer, W. Marrero, A. El-Atawy, and K. Elbadawi, “Network Configuration in A Box: Towards End-to-End Verification of Network Reachability and Security, ” in ICNP'09.
22. M. Canini, D. Venzano, P. Perešíni, D. Kostić, and J. Rexford, “A NICE Way to Test Openflow Applications, ” in NSDI'12.
23. S. Chowdhury, M. Bari, R. Ahmed, and R. Boutaba, “PayLess: A Low Cost Network Monitoring Framework for Software Defined Networks, ” in IEEE NOMS'14.
24. N. Feamster and H. Balakrishnan, “Detecting BGP Configuration Faults with Static Analysis, ” in NSDI'05.
25. N. Foster, R. Harrison, M. J. Freedman, C. Monsanto, J. Rexford, A. Story, and D. Walker, “Frenetic: A Network Programming Language, ” in ICFP'11.
26. A. Guha, M. Reitblatt, and N. Foster, “Machine-Verified Network Controllers, ” in PLDI'13.
27. S. Hong, L. Xu, H. Wang, and G. Gu, “Poisoning Network Visibility in Software-Defined Networks: New Attacks and Countermeasures, ” in NDSS'15.
28. P. Kazemian, M. Chang, H. Zeng, G. Varghese, N. McKeown, and S. Whyte, “Real Time Network Policy Checking Using Header Space Analysis, ” in NSDI'13.
29. P. Kazemian, G. Varghese, and N. McKeown, “Header Space Analysis: Static Checking for Networks, ” in NSDI'12.
30. A. Khurshid, X. Zou, W. Zhou, M. Caesar, and P. B. Godfrey, “VeriFlow: Verifying Network-wide Invariants in Real Time, ” in NSDI'13.
31. R. Kloti, “OpenFlow: A Security Analysis, ” Master's thesis, ETH, Zurich, 2012.
32. D. Kreutz, F. M. Ramos, and P. Verissimo, “Towards Secure and Dependable Software-Defined Networks, ” in HotSDN'13.
33. LBNL, “arpwatch, ” http://ee.lbl.gov/.
34. H. Mai, A. Khurshid, R. Agarwal, M. Caesar, P. B. Godfrey, and S. T. King, “Debugging the Data Plane with Anteater, ” in SIGCOMM'11.
35. N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner, “OpenFlow: Enabling Innovation in Campus Networks, ” SIGCOMM Comput. Commun. Rev., April 2008.
36. C. Monsanto, N. Foster, R. Harrison, and D. Walker, “A Compiler and Run-time System for Network Programming Languages, ” in POPL'12.
37. S. Natarajan, X. Huang, and T. Wolf, “Efficient Conflict Detection in Flow-Based Virtualized Networks, ” ICNC'12.
38. P. Porras, S. Shin, V. Yegneswaran, M. Fong, M. Tyson, and G. Gu, “A Security Enforcement Kernel for OpenFlow Networks, ” in HotSDN'12.
39. J. Rasley, B. Stephens, C. Dixon, E. Rozner, W. Felter, K. Agarwal, J. Carter, and R. Fonseca, “Planck: Millisecond-scale Monitoring and Control for Commodity Networks, ” in SIGCOMM'14.
40. G. P. Reyes, “Security assessment on a VXLAN-based network, ” Master's thesis, University of Amsterdam, Amsterdam, 2014.
41. S. Shin, P. Porras, V. Yegneswaran, M. Fong, G. Gu, and M. Tyson, “FRESCO: Modular Composable Security Services for Software-Defined Networks, ” in NDSS'13.
42. S. Shin, V. Yegneswaran, P. Porras, and G. Gu, “AVANT-GUARD: Scalable and Vigilant Switch Flow Management in Software-Defined Networks, ” in CCS'13.
43. A. Voellmy and P. Hudak, “Nettle: Taking the Sting out of Programming Network Routers, ” in PADL'11.
44. G. G. Xie, J. Zhan, D. A. Maltz, H. Zhang, A. Greenberg, G. Hjalmtysson, and J. Rexford, “On Static Reachability Analysis of IP Networks, ” in INFOCOM'05.