In software-defined networking (SDN), emerging new-flow attacks aim at exhausting the resources of switches and controllers through massive packet-in messages. To detect new-flow attacks, SDNGuardian was proposed as a protocol-independent defense method, which uses entropy to detect anomalies and mitigate attacks with rate limits. In this paper, we introduce a crafty new-flow attack named timeout-aware attack that SDNGuardian cannot detect. We, therefore, propose a novel defense method: SDNSnapshot. Through simulations, we show that SDNSnapshot can successfully detect the timeout-aware attack. The number of dropped benign packet-in messages in SDNSnapshot is around one third of that in SDNGuardian. Besides, a snapshot only consumes 0.9Mb static random access memory (SRAM) for each anomalous sensitive field. The results indicate that SDNSnapshot is a feasible solution to mitigate new-flow attacks in practice.

SYN flooding and UDP flooding are common malicious attacks in networks. The attacks not only consume a large amount of network bandwidth and system resources of the target server but also cause network paralysis. To defend the network against the SYN flooding and UDP flooding, many new defense systems in software-defined networking (SDN) are proposed. However, most of the defense systems are only applicable to the attacks over a specific protocol such as TCP or UDP. In this paper, we therefore propose a widely applicable defense system in P4-based SDN. Through experiments, we show that the proposed defense system can effectively mitigate SYN flooding and UDP flooding. For the SYN flooding, the proposed system can release server's resources six times earlier than the related work after detecting the attack. For the UDP flooding, the proposed defense system can reduce the amount of malicious traffic by approximately two thirds compared to the related work.

Port scanning is a well-known behavior when a botnet searches target devices. To detect port scanning accurately, data with high discriminatory power are indispensable. Most related works, however, focus on data analysis methods but neglect storage limitations of switches, which makes their methods impractical. Therefore, we propose a new data collection method for collecting network information of port scanning in P4-based SDN named 0-replacement. Through simulations, we compare the 0-replacement method with two classic data collection methods. Results show that the 0-replacement method improves the true positive ratio by at least 25 percentage points but only consumes 0.36% memory space.

As the number of network devices increases rapidly, it becomes more and more difficult to defend network attacks. Large-scaled attacks, such as SYN flooding, may lead to heavy burden to the switches as well as the controller in a software defined network (SDN). In this paper, we investigate the SYN flooding and Address Resolution Protocol (ARP) spoofing attacks in SDN, and then propose mechanisms to address these two attacks. We also present a new scheme to detect SYN flooding by using only a few forwarding rules. Moreover, we utilize the Programming Protocol-independent Packet Processors (P4) technique to mitigate the burden of the controller.

Software-defined Network (SDN) is considered as a promising technology to provide a flexible network for 5G. However, as the resource of flow entries in switches is limited in SDN, a novel flow management method is required when facing massive amounts of IoT devices. To the best of our knowledge, existing methods designed for IoT can only be applied to uncomplicated network environments without multiple periodic traffic flows. In this paper, we propose Periodic Subflow-based Proactive Flow Installation Mechanism (PSPFIM), a more widely applicable method with better performance. Compared to related works, we improve the hit ratio by 45% and installation efficiency by 6.19 times according to results of simulations, which means PSPFIM can reduce the average network latency with even less flow entries.

As the popularity of mobile applications, Wi-Fi has become one of the major access methods for many users. When a large amount of users move in public places together, such as classrooms or meeting rooms, severe load imbalance of Wi-Fi Access Points (APs) and unfair bandwidth allocation are likely to occur consequently. Software Defined Networking (SDN) is a new networking paradigm which allows the network administrators to write programs for controlling the behaviors of network devices. In this paper, we propose an adaptive load balancing scheme through association control in wireless software defined network. The proposed scheme consists of an event detection mechanism and an adaptive load balancing algorithm on controller. In our algorithm, controller can derive an optimal association solution based on the traffic load and number of users on each AP. To observe the effects of population distribution and user mobility, we propose a simulation model to investigate the performance in terms of average AP load, user bandwidth and user throughput. Our simulation results show that our scheme has better performance than other three methods and performs better in imbalanced environment.