Probing the configurations of the Software-Defined Networking (SDN) switches is the essential preliminary for attacking SDN. This study points out a critical bottleneck in detecting probing attack: the dynamically changing character of different kinds of probing attacks makes the existing detection methods fail to detect probing attack. In this paper, we propose Tide, a probing attack detection method based on a Dynamic Flow-Packet graph (DFP-Graph), along with an intra-and inter-timeslot enhanced node embedding strategy. Tide constructs a (FP-Graph) across multiple timeslots, thereby modeling the intra-timeslot DFP-Graph consisting of multiple static Flow-Packet Graphs correlations that include the flow to flow, packet to packet, flow to packet, and packet to flow relationships while representing the inter-timeslot correlation of flows. Furthermore, Tide proposes an intra-timeslot node embedding module, an inter-timeslot node embedding module, and a probing attack flow detection module. The intra-timeslot node embedding module is designed to update the node representations based on the intra-timeslot correlation among different flows, while the inter-timeslot node embedding module is proposed to track the time-varying characters of a single flow. Finally, the probing attack flow detection module is employed to integrate the flow nodes’ representations in each timeslot and identify the probing attack flows. The experimental results demonstrate that Tide can effectively detect probing attack. It achieves the average detection accuracy at 87.51%, which outperforms the state-of-the-art methods.

Singing voice synthesis and singing voice conversion technologies have raised significant concerns regarding music copyright and authenticity. While extant research has predominantly focused on detecting spoofing speech, much less attention has been given to deepfake singing voice. Moreover, conventional techniques frequently prove incapable of capturing the intricate temporal relationships inherent in vocalisation, thus impeding their capacity to effectively extract both local and global characteristics. To address these challenges, this paper introduces a novel deepfake detection method of singing voice called GASGM-GFT (Gaussian Attenuation Singing Graph Model and Graph Fourier Transform). In this approach, a singing graph model between sampling points of the original singing is creatively constructed using a Gaussian attenuation function. This model captures the complex temporal relationships of the singing signal. Next, the Graph Fourier Transform (GFT) is applied to map the singing signal into the graph frequency domain. This helps capture both local and global frequency features within the singing graph model, revealing hidden deepfake properties of the signal. The one-dimensional graph frequency domain signals are then expanded into two dimensions and processed through residual blocks for feature enhancement. Finally, the graph attention module is utilized to model node relationships, compute attention weights, and aggregate features through graph pooling layers to produce the final discrimination result. The experimental results demonstrate that GASGM-GFT outperforms existing advanced methods for spoofing speech detection and singing voice deepfake detection on the CtrSVDD dataset. It achieves an equal error rate (EER) of only 2.53% on the Vocals test set and surpasses other systems on the Mixture test set.

As a new network structure, the decoupling of the control plane and forwarding plane makes Software-Defined Networking (SDN) widely used in large-scale network scenarios. However, the decoupling network architecture also brings new vulnerabilities. The flow table overflow attack is an attack strategy that can overwhelm SDN switches. Nevertheless, the existing flow table overflow attacks may fail in probing timeouts and match fields of flow entries, due to link failure, measurement of the round-trip time (RTT) of different packets, interference of hard-timeout and idle-timeout. Meanwhile, the stealthiness of the existing attacks may also reduce, as these attacks use fixed attack rate. To improve the timeout probing accuracy and the stealthiness of attack, a new flow table overflow attack strategy, DUDFTO, is proposed to accurately probe timeout settings and match fields, then stealthily overflow SDN flow tables. Firstly, it probes the match fields by measuring the one-sided transmission delay of the packets. After that, DUDFTO designs a down-to-up feedback-based timeout probing algorithm to eliminate the issues caused by high RTT, link failure, interference between hard-timeout and idle-timeout. Then, DUDFTO designs a dynamic attack packets sending algorithm to improve its stealthiness. Finally, DUDFTO probes the flow table state to stop sending new attack packets. The evaluation results demonstrate that DUDFTO outperforms the existing attacks in terms of match fields probing ability, timeout probing relative error, number of packet_in and flow_mod messages generated by the attack, rate distribution of packet_in and flow_mod messages generated during the attack, and number of detected attack packets.

Software-defined networking for IoT (SD-IoT), as an emerging architecture, is suffering from numerous security issues. Saturation attacks against the SDN switches and controllers are major security concerns in SD-IoT. When using the Dempster–Shafer evidence theory (DSE) to detect various saturation attacks, the simple mutual information calculation may cause information loss problem, leading to the decrease of detection accuracy. Therefore, how to avoid information loss problem to improve the detection performance is a key issue. Aiming to solve the above-mentioned issues, we propose KIND, a novel image mutual information-based decision fusion method for saturation attack detection in SD-IoT. The main idea of KIND is that it converts the probability matrix of binary classifiers to images and detects the saturation attacks by fusing these images. More specifically, when executing the evidence fusion, each evidence is converted to an image by a nonlinear transformation method. Each image is converted from the related probability-supported matrix. Then, the evidence can be fixed by comparing structural similarities among different images. After that, all evidence can be utilized to obtain the final detection results using the conducted combination rule. The evaluation results demonstrate that KIND can achieve high detection performance, which outperforms other state-of-the-art methods, in terms of TPR, TNR, FPR, FNR, accuracy, precision, recall, F-score, confusion matrix, ROC curves, PR curves, Chi-square test, correlation coefficient, and the quantitative strategy test. In conclusion, KIND can detect saturation attacks with high precision while causing acceptable storage overload.

As one of the next generation of network architectures, Software-Defined Networking (SDN) decouples the forwarding and control function of the traditional network device. However, it also faces new threats from network attacks, such as the Low-rate Distributed Denial of Service (L-DDoS) attack. To resist L-DDoS attack in SDN, this work proposes METER, an enseMble discrEte wavelet Transform-based method for idEntifying low-Rate DDoS attack in SDN. The rationale for METER is to identify L-DDoS attacks based on a new metric referred to as the Ensemble Wavelet Energy Entropy set (EWEEs), which is calculated by a novel ensemble DWT method. Firstly, the ensemble wavelet coefficients matrix is attained by METER using the ensemble DWT method. After that, METER combines the related entropy values with wavelet energy of the ensemble wavelet coefficients matrix to obtain EWEEs. Furthermore, to increase the precision of the L-DDoS detection method, machine learning methods are used to mine the correlation between EWEEs and L-DDoS attacks for identifying L-DDoS. The experiments were implemented on the RYU controller and Mininet, which demonstrates that METER outperforms the baseline method, in terms of precision, accuracy, F -score, recall, ROC curve, and P-R curve.