Software-defined Networking (SDN) is an emerging network architecture. The decoupled data and control plane provide flexible manageability and programmability to the network. One of the core components in SDN switches to direct traffic forwarding is the flow table, which is usually stored in the ternary content addressable memory (TCAM) with limited space and high power consumption, making the flow table a potential target for attacks. This paper examines the Low-Rate Flow Table Overflow (LRFTO) attacks, which fill the flow table and render it unavailable by continuously sending attack rules to occupy the space. We propose a quantitative model of LRFTO attacks to describe the attack behavior, analyze its difference from legitimate traffic, and summarize some key aspects and features to distinguish attack rules from legitimate rules. We also propose LRFTO-ADMS, a system that utilizes machine learning-based classification as its core to evict suspicious rules, thereby ensuring flow table availability. Experimental results show that the threat model can adapt correctly to the network environment. The proposed LRFTO-ADMS can evict attack rules with an accuracy of more than 95% and low overhead while protecting the flow table and the legitimate rules from being unavailable.

DNS recursive resolver plays the role of intermediary agent in domain name query service, making it easy to observe various DNS flooding attack behaviors. The programmable data plane has promoted innovation in in-band attack detection, but previous work has not concentrated on DNS services, and there are concerns with mistakenly killing benign traffic and low classification accuracy. In this paper, we propose DNSGreen, a comprehensive defense system against bounce-style DNS DDoS attacks in the programmable data plane. DNSGreen discusses flow and packet characteristics under anomalous behavior, employing a “flow-detection and packet-filtering” pattern to ensure effective defense while allowing benign traffic to pass through as much as possible. Furthermore, DNSGreen designs a whitelist collection module, which eliminates the need to inspect trusted streams in subsequent filtering and thereby reducing the occurrence of false positives. Finally, DNSGreen improves the allocation method of the statistical structure to enhance the accuracy of system alarms. We deploy DNSGreen on BMv2 switches and conduct tests in three attack scenarios, demonstrating that DNSGreen safeguards normal users with excellentF0:5score while filtering attack traffic.

Software-Defined Network (SDN) revolutionizes traditional network structures by isolating the data plane and the control plane, which offers greater flexibility in managing network resources. Nevertheless, SDN remains vulnerable to certain threats inherited from the traditional network, including Distributed Low-rate Denial-of-Service (DLDoS) attack. This attack is more subtle and harder to detect than traditional Distributed Denial-of-Service (DDoS) attacks, because it employs a lower average attack rate. We design a real-time detection and mitigation system named DOE-DTL specifical for the DLDoS attack in SDN. For the DLDoS attack detection, we utilize Machine-Learning (ML) methods to construct a detection model and introduce it in DOE-DTL. In the construction, we leverage Extreme Learning Machine (ELM) and make a dual optimization using Whale Optimization Algorithm (WOA). For the DLDoS attack mitigation, we use double thresholds to determine the attack sources and make corresponding mitigation rules. DOE-DTL innovatively combines the Programmable Data Plane (PDP) in detection and mitigation, shifting some control plane tasks to the data plane. Performance assessments reveal that DOE-DTL ensures fast, accurate attack identification and low-latency mitigation while maintaining low resource usage.

As the first satellite specifically designed to serve Sustainable Development Goals (SDGs), the Sustainable Development Science Satellite 1 (SDGSAT-1) has attracted numerous attention by providing panchromatic glimmer imagery with a unprecedented clarity of 10 meters. However, unsatisfactory positional accuracy of glimmer imagery hinder further fine-grained studies. This study identifies the cause of these positional errors as misalignments generated during the data production process, and thus proposes a correction method based on deep learning object detection and cross-correlation. The method achieves accurate measurements of the position, direction, and distance of the misalignment, which are used to correct the glimmer imagery and to effectively improve the positional accuracy. In this study, we (1) propose a simulated misalignment dataset which demonstrated with excellent performance during the training of multiple deep learning object detection models, reaching up to 99.44% average precision (AP); (2) propose pixel brightness correlation coefficient based on cross-correlation and validate its effectiveness to characterize misalignments; (3) improve detection efficiency by the threshold design of window average brightness and object detection confidence; (4) explore the reasons for the misalignment suggests that it is the difference between the satellite’s designed operating time and the actual operating time that leads to the Charge-coupled Device(CCD) stitching flaw. Our proposed method can contribute to evaluating and improving the positional accuracy of SDGSAT-1 panchromatic glimmer imagery, providing a way to obtain datasets with good spatial consistency and to conduct related research.