The decoupling of SDN control plane and data plane allows control to be carried out independently, enhancing the programmability and manageability of the whole network. However, though this new architecture brings convenience for control, it also sets a pool for attacks. Due to the expensive and resource-consumption characteristics, SDN switches usually have a limited ternary content addressable memory to cache the flow rules in the data plane. Attackers can launch a space-consuming attack to maliciously preempt the flow table, forcing switches to reduce the quality of service. Among them, DDoS attacks should be taken seriously, especially the low-rate ones that have a lower attack rate with stronger concealment. In this paper, an architecture named MWD-CFM is proposed to protect against low-rate DDoS attacks in the switch flow tables. Multi-windows work collaboratively to improve detection performance. The feature of flow rules is corrected to do better classification, improving the effectiveness of attack traffic removal. Experiments based on real network topology and datasets are conducted to verify the deployment of MWD-CFM. Results prove that our architecture can greatly reduce the survival time of attack flows and ensure the availability of flow tables for legitimate services.

Low-rate Denial of Service (DoS) attacks can significantly compromise network availability and are difficult to detect and mitigate due to their stealthy exploitation of flaws in congestion control mechanisms. Software-Defined Networking (SDN) is a revolutionary architecture that decouples network control from packet forwarding, emerging as a promising solution for defending against low-rate DoS attacks. In this paper, we propose Trident, a low-rate DoS attack mitigation scheme based on port and traffic state in SDN. Specifically, we design a multi-step strategy to monitor switch states. First, Trident identifies switches suspected of suffering from low-rate DoS attacks through port state detection. Then, it monitors the traffic state of switches with abnormal port states. Once a switch is identified as suffering from an attack, Trident analyzes the flow information to pinpoint the malicious flow. Finally, Trident issues rules to the switch's flow table to block the malicious flow, effectively mitigating the attack. We prototype Trident on the Mininet platform and conduct experiments using a real-world topology to evaluate its performance. The experiments show that Trident can accurately and robustly detect low-rate DoS attacks, respond quickly to mitigate them, and maintain low overhead.

The TCP protocol’s inherent lack of built-in security mechanisms has rendered it susceptible to various network attacks. Conventional defense approaches face dual challenges: insufficient line-rate processing capacity and impractical online deployment requirements. The emergence of P4-based programmable data planes now enables line-speed traffic processing at the hardware level, creating new opportunities for protocol protection. In this context, we present MARS -a data plane-native TCP abuse detection and mitigation system that synergistically combines the Beaucoup traffic monitoring algorithm with artificial neural network (ANN) based anomaly detection, enhanced by adaptive heuristic mitigation rules. Through comprehensive benchmarking against existing TCP defense mechanisms, our solution demonstrates 12.95% higher throughput maintenance and 25.93% improved congestion window recovery ratio during attack scenarios. Furthermore, the proposed framework establishes several novel evaluation metrics specifically for TCP protocol protection systems.