U-TRI

Abstract

Traffic analysis within switches is threatening the security of large enterprise networks built with SDN. Adversaries are able to monitor all traffic traversing a switch by exploiting just one vulnerability in it and obtain linkage information for further attacking, while administrators have to patch all switches as soon as possible in hope of eliminating the vulnerability in time. Moving Target Defense (MTD) is a novel theory for re-obtaining the upper hand in network defense by dynamically changing attack surfaces of the network. In this paper, we propose U-TRI (Unlinkability Through Random Identifier) as a moving target technique for changing the identifier, which is one of the most vital attack surfaces of traffic privacy, within packet data units. U-TRI employs an independent, hierarchically-structured, periodically and randomly changing identifier to replace the original static data link layer addresses. It also hides all other identifiers in the network and transport layer by obfuscating them. Such a combination of hierarchical random address and obfuscated identity enables U-TRI to provide unlinkable communications among hosts. The result of experiments indicates that U-TRI is capable of defending traffic analysis with very little burdens on network performance.