Saturation Attack Research Articles

Unmasking SDN flow table saturation: fingerprinting, attacks and defenses

Software-Defined Networking stands as a pivotal technology in attaining the essential levels of flexibility and scalability demanded by pervasive and high-performance network infrastructure required for digital connected services. Nonetheless, its disaggregated and layered architecture makes it open to the time-based fingerprinting attacks. Besides, limited flow table capacity of the switches alleviates table saturation attacks. In this paper, an automated attacker tool called TASOS is proposed to infer flow table utilization rate, size and replacement algorithm. With this set of information, the attacker can conduct intelligent saturation attacks. Furthermore, a lightweight defense mechanism (LIDISA) for proactively deleting flow rules is described. A comprehensive simulation setup with different network conditions shows that the proposed techniques achieve superior success rate in diverse settings.

Distributed SDN Security Frameworks: A Survey

Software-Defined Networks (SDN) have recently received much attention and deployment as a new technology that offers more flexibility and efficiency than traditional networks. SDN is a paradigm shift that revolutionizes traditional network design and makes future networks programmable, manageable, and affordable. The use of the SDN in modern networks provides much needed flexibility and transparency to organize and deploy network solutions. It is a new model that separates forwarding & controlling planes, and centralized architecture designed to increase network speed and programming capability. However, from the current security point of view, the SDN still has some problems, especially for the advanced persistent attacks such as the DDOS, the side channel attacks in Clouds, the SDN stack control plane saturation attacks, and the switch flow table exhaustion attacks. Also, the existing SDN-based security systems are constrained by a central framework that provides significant overheads for the control plane, leading to the breakdown of vital control links. In this paper, we will present the vulnerabilities and security threats in the SDN network, define the various approaches to solve these problems, and deploy the SDN securely in the production environments. We will survey existing research on distributed SDN security frameworks, there is a number of security frameworks and applications that have been proposed previously, and each one of them builds on a selection of the SDN characteristics.

TITAN: Combining a bidirectional forwarding graph and GCN to detect saturation attack targeted at SDN.

The decoupling of control and forwarding layers brings Software-Defined Networking (SDN) the network programmability and global control capability, but it also poses SDN security risks. The adversaries can use the forwarding and control decoupling character of SDN to forge legitimate traffic, launching saturation attacks targeted at SDN switches. These attacks can cause the overflow of switch flow tables, thus making the switch cannot forward benign network traffic. How to effectively detect saturation attack is a research hotspot. There are only a few graph-based saturation attack detection methods. Meanwhile, the current graph generation methods may take useless or misleading information to the attack detection, thus decreasing the attack detection accuracy. To solve the above problems, this paper proposes TITAN, a bidirecTional forwardIng graph-based saturaTion Attack detectioN method. TITAN defines flow forwarding rules and topology information, and designs flow statistical features. Based on these definitions, TITAN generates nodes of the bi-forwarding graph based on the flow statistics features and edges of the bi-forwarding graph based on the network traffic routing paths. In this way, each traffic flow in the network is transformed into a bi-directional forwarding graph. Then TITAN feeds the above bidirectional forwarding graph into a Graph Convolutional Network (GCN) to detect whether the flow is a saturation attack flow. The experimental results show that TITAN can effectively detect saturation attacks in SDNs with a detection accuracy of more than 97%.

Critical-time metric for risk analysis against sharp input anomalies: Computation and application case study

This paper investigates the critical-time criteria as a security metric for controlled systems subject to sharp input anomalies (attacks, faults), characterized by high impact in a reduced amount of time (e.g. denial-of-service, upper saturation attack). The critical-time is the maximum time horizon for which a system can be considered to be safe after the occurrence of an anomaly. This metric is expected to be valuable for risk analysis and for the off-line design of a treatment strategy (prevention, detection, mitigation). In this work, the computational problem of the critical-time for linear systems and several classes of sharp input anomalies, depending on the input channel and the set of abnormal signal values, is formulated based on the Quadratic Constraints (QC) framework, where sets are represented by the intersection of QC inequalities and equalities. Then, an iterative LMI-based algorithm is proposed to obtain an underestimation of the critical-time, ensuring the safety of the system until the calculated time is reached. Finally, the potential of critical-time as a metric for defense design is illustrated and discussed on the case study of the quadruple tank through several relevant scenarios.

Dynamic scheduling for multi-level air defense with contingency situations based on Human-Intelligence collaboration

Resource scheduling is an important part of military operation, especially in key-point air defense under saturation attack. Many achievements have been made in the field of radar resource scheduling and multi-aircraft scheduling. However, there is little research on the integrated scheduling of detection, tracking and attack, which will greatly increase the resource utilization to deal with the resource shortage problem caused by saturation attacks on key places. In this paper, we propose to autonomously accomplish real-time resource dispatching through end-to-end deep reinforcement learning (DRL), while allowing the commander’s intervention to accomplish a variety of complex tactics. First, an integrated scheduling model of detection, tracking and interception is proposed and transformed into a sequential decision problem by introducing a disjunctive graph and a graph neural network (GNN) to extract node features. Subsequently, the Proximal Policy Optimization (PPO) algorithm is applied to learn the air defense environment (ADE), which is modeled as an Markov decision process (MDP). Benefitting from the powerful generalization capability of the policy network, our algorithm can adapt to scheduling missions of different sizes. Moreover, we propose a novel Human-Intelligence collaborative dynamic scheduling framework for emergency response. Simulation results indicate that our algorithm generates high-quality scheduling policies for defense resources, exhibiting superior performance than existing methods. In addition, the dynamic scheduling performance of the human and intelligence collaboration approach in response to multiple contingencies is proven.

Cooperative target allocation for air-sea heterogeneous unmanned vehicles against saturation attacks

This paper proposes a cooperative target allocation method for efficiently utilizing air-sea heterogeneous unmanned vehicles to counter saturation attacks by low-cost UAVs. Specifically, a bilevel model that combines the advantages of heuristic algorithms and the coalition formation game (CFG) is constructed by integrating unmanned vehicles' motion and attack attributes. The upper layer model aims to utilize the advantages of the heuristic algorithm to generate a feasible target allocation scheme in a shorter time. A genetic algorithm constrained by inheritance conditions (GAC) is proposed to solve the problem of the low efficiency of traditional genetic algorithms in solving the upper model. The lower layer model is established based on a coalition formation game, which aims to continuously and stably optimize the target allocation scheme. A search method based on mobile players is designed to form a stable coalition structure faster when the number of unmanned vehicles is enormous. Simulation results show the feasibility and superiority of the algorithm proposed in this paper in dealing with allocation tasks of different complexity.

Distributed Cooperative Strategy of UAV Swarm Without Speed Measurement Under Saturation Attack Mission

Distributed Cooperative Strategy of UAV Swarm Without Speed Measurement Under Saturation Attack Mission

Flow Table Overflow Attacks in Software Defined Networks: A Survey

<p>While Software-Defined Networks (SDNs) have separated control and data planes and completely decouple the flow control from the data forwarding to enable network flexibility, programmability, and innovation, they also raise serious security concerns in each plane and the interfaces between the two planes. This paper, instead of studying the security issues in the SDN control plane as many literatures have done in current research, focuses on the security issues in the SDN data plane, aiming at the state of the art mechanims to identify, detect, and mitigate them. Specifically, this paper reviews the typical models, detections, and mitigations of SDN flow table overflow attacks. After reviewing the various vulnerabilities in SDNs, this paper categorizes the flow table overflow attacks into saturation, low-rate table exhaustion, and slow saturation attacks, and summarizes the attack models, detections, and mitigations of each category. It reviews the typical attacks that can overflow the flow tables and provides the main challenges and open issues for the future research.</p> <p> </p>

SAM: Query-efficient Adversarial Attacks against Graph Neural Networks

Recent studies indicate that Graph Neural Networks (GNNs) are vulnerable to adversarial attacks. Particularly, adversarially perturbing the graph structure, e.g., flipping edges, can lead to salient degeneration of GNNs’ accuracy. In general, efficiency and stealthiness are two significant metrics to evaluate an attack method in practical use. However, most prevailing graph structure-based attack methods are query intensive, which impacts their practical use. Furthermore, while the stealthiness of perturbations has been discussed in previous studies, the majority of them focus on the attack scenario targeting a single node. To fill the research gap, we present a global attack method against GNNs, Saturation adversarial Attack with Meta-gradient, in this article. We first propose an enhanced meta-learning-based optimization method to obtain useful gradient information concerning graph structural perturbations. Then, leveraging the notion of saturation attack, we devise an effective algorithm to determine the perturbations based on the derived meta-gradients. Meanwhile, to ensure stealthiness, we introduce a similarity constraint to suppress the number of perturbed edges. Thorough experiments demonstrate that our method can effectively depreciate the accuracy of GNNs with a small number of queries. While achieving a higher misclassification rate, we also show that the perturbations developed by our method are not noticeable.

USAGE : Uncertain flow graph and spatio-temporal graph convolutional network-based saturation attack detection method

With the development of Software-Defined Networking (SDN), its security problems have attached interests from academia. The saturation attack targeted at the SDN switch is one of the most destructive problems in SDN. The saturation attack can destroy SDN networks by depleting the computation and storage resources of SDN switches. Currently, graph neural networks have already been used for detecting saturation attacks in SDN. When constructing the graph based on K-Nearest Neighbors (KNN) algorithm, the number of edges in the graph is fixed. That may fail on accurately representing the relationship among different nodes. In addition, when using the Graph Convolutional Network (GCN) to detect saturation attack against SDN, only a partial graph structure and node features will be learned, causing the flow graph nodes information cannot be fully utilized. To overcome these issues, in this work, we propose USAGE, an uncertain flow graph and spatio-temporal graph neural network-based saturation attack detection method. More specifically, USAGE designs the CRAM algorithm and EGG model. The CRAM algorithm is proposed to generate an uncertain flow graph for each network traffic flow, which can represent the uncertain relationship among different nodes. EGG is a spatio-temporal graph convolutional network model, which is proposed to detect saturation attacks. The evaluation results demonstrate that USAGE can generate a better graph than KNN and achieve high detection performance. Meanwhile, USAGE outperforms other methods in terms of TPR, TNR, accuracy, precision, recall, F-score, confusion matrix, ROC curves, and PR curves.

Scalable Flow based Management Scheme in Software Define Network (SDN) using sFlow

The threats to information privacy while connected to cyber space are capacious and complex which require resilient network and antifragile security mechanisms. Software Define Network (SDN) infrastructure itself is predisposed to severe threats that may damage the provision of its usability as a security provider. The essential qualities of (SDN) are to provide support for high bandwidth and timely content delivery. SDN granular approach to security by centralizing the security control into one entity using the controller to ensure service control and information protection. SDN provides a new paradigm for applications to interact with the network. This interaction with declarative abstraction will instruct the Application Programming Interface (APIs) to direct the configuration and operation of the network. The API is queried to ask the network for information in order to plan and optimize the network operations. In this study, the vulnerability exploited by attackers to perform distributed denial of service (DDoS) attacks is examined. The trust between the control planes and forwarding planes is crucial in SDN. The separation of the control and data planes contributes to open security challenges such as denial of service (DoS) attacks, man-in-the-middle attacks, and network saturation attacks. The platform runs on Mininet 2.2.2, Ubuntu 18.04, Ryu Controller 4.34, and Sflow-RT. The Classification learning is based on Support Vector Machine (SVM). The contribution is to provide monitoring application of Flow RT Status and SFlow RT Packet Monitoring during Normal Traffic Generation. The implication for the monitoring application of SFlow RT Status is to supervise the failure in the status of sFlowAgent, sFlow Byte, and sFlow packet against cyber-attack.

Flow Table Saturation Attack against Dynamic Timeout Mechanisms in SDN

Software-defined networking (SDN) enables dynamic management and flexible network control by employing reactive rule installation. Due to high power consumption and cost, current OpenFlow switches only support a limited number of flow rules, which is a major limitation for deploying massive fine-grained policies. This bottleneck can be exploited by attackers to launch saturation attacks to overflow the flow table. Moreover, flow table overflow can occur in the absence of malicious attackers. To cope with this, researchers have developed many proposals to relieve the load under benign conditions. Among them, the dynamic timeout mechanism is one of the most effective solutions. We notice that when the SDN controller adopts dynamic timeouts, existing flow table saturation attacks can fail, or even expose the attackers, due to inaccurate inferring results. In this paper, we extract the common features of dynamic timeout strategies and propose an advanced flow table saturation attack. We explore the definition of flow rule lifetime and use a timing-based side-channel to infer the timeout of flow rules. Moreover, we leverage the dynamic timeout mechanisms to proactively interfere with the decision of timeout values and perform an attack. We conduct extensive experiments in various settings to demonstrate its effectiveness. We also notice that some replacement strategies work differently when the controller assigns dynamic timeouts. The experiment results show that the attack can incur significant network performance degradation and carry out the attack in a stealthy manner.

Research on Individual Performance Index of Air Cluster Combat Aircraft Based on Differential Game Theory

UAV cluster has the characteristics of low cost, large-scale and high autonomy, and has gradually become a new research direction in the field of military intelligence, and is widely used in combat tasks such as penetration reconnaissance, lure interference, large-scale saturation attack and regional sealing and control. Therefore, air cluster confrontation will become one of the main melodies of air combat in the process of confrontation, cluster aircraft individual performance index determines the overall cluster level, poor individual performance will make the cluster cannot effectively complete the task, excellent individual performance completes the task, but will bring the increase in the cost of cluster, so in the air cluster confrontation scenario, according to the target performance reasonable our individual performance has become important. Based on the innovative differential game theory, this paper studies the effective interception of the aircraft in the cluster high dynamic pursuit scenario, studies the relationship between the individual performance of the interceptor aircraft and the target aircraft, and effectively provides reference for the overall index design of the aircraft in the military field.

Task Assignment for UAV Swarm Saturation Attack: A Deep Reinforcement Learning Approach

Task assignment is a challenging problem in multiple unmanned aerial vehicle (UAV) missions. In this paper, we focus on the task assignment problem for a UAV swarm saturation attack, in which a deep reinforcement learning (DRL) framework is developed. Specifically, we first construct a mathematical model to formulate the task assignment problem for a UAV swarm saturation attack and consider it as a Markov Decision Process (MDP). We then design a policy neural network using the attention mechanism. We also propose a training algorithm based on the policy gradient method so that our agent can learn an effective task assignment policy. The experimental results have shown that our DRL method can generate high-quality solutions for different problem scales, which meets the requirements of real-time and flexibility in the actual situation.

Machine Learning-Based DdoS Saturation Attack Detection and analysis in SDN Environment

Machine Learning-Based DdoS Saturation Attack Detection and analysis in SDN Environment

KIND: A Novel Image-Mutual-Information-Based Decision Fusion Method for Saturation Attack Detection in SD-IoT

Software-defined networking for IoT (SD-IoT), as an emerging architecture, is suffering from numerous security issues. Saturation attacks against the SDN switches and controllers are major security concerns in SD-IoT. When using the Dempster–Shafer evidence theory (DSE) to detect various saturation attacks, the simple mutual information calculation may cause information loss problem, leading to the decrease of detection accuracy. Therefore, how to avoid information loss problem to improve the detection performance is a key issue. Aiming to solve the above-mentioned issues, we propose KIND, a novel image mutual information-based decision fusion method for saturation attack detection in SD-IoT. The main idea of KIND is that it converts the probability matrix of binary classifiers to images and detects the saturation attacks by fusing these images. More specifically, when executing the evidence fusion, each evidence is converted to an image by a nonlinear transformation method. Each image is converted from the related probability-supported matrix. Then, the evidence can be fixed by comparing structural similarities among different images. After that, all evidence can be utilized to obtain the final detection results using the conducted combination rule. The evaluation results demonstrate that KIND can achieve high detection performance, which outperforms other state-of-the-art methods, in terms of TPR, TNR, FPR, FNR, accuracy, precision, recall, F-score, confusion matrix, ROC curves, PR curves, Chi-square test, correlation coefficient, and the quantitative strategy test. In conclusion, KIND can detect saturation attacks with high precision while causing acceptable storage overload.

Saturation attack on discretely modulated continuous-variable quantum key distribution over an atmospheric turbulence channel

Continuous-variable quantum key distribution (CVQKD) over an atmosphere channel provides the possibility of global coverage, which is threatened by the imperfection of actual devices. Exploiting imperfections of practical devices, an eavesdropper steals the information between legal participants by performing the potential saturation-induced attacks on the homodyne detector. In this paper, we demonstrate the feasibility of the potential saturation attack in discretely modulated (DM) CVQKD over atmospheric turbulence. Subsequently, a countermeasure is suggested by using an adjustable optical filter (AOF) to attenuate the estimated parameter with the measured value in the finite linearity domain, where the attenuated data can be compensated. Numerical simulations illustrate the effects of the saturation attack on the performance of the AOF-based CVQKD system. We find that legal participants evaluate the information that has been eavesdropped because the secret key rate is made negative.

PreMSat: Preventing Magnetic Saturation Attack on Hall Sensors

Spoofing a passive Hall sensor with fake magnetic fields can inject false data into the downstream of connected systems. Several works have tried to provide a defense against the intentional spoofing to different sensors over the last six years. However, they either only work on active sensors or against externally injected unwanted weak signals (e.g., EMIs, acoustics, ultrasound, etc.), which can only spoof sensor output in its linear region. However, they do not work against a strong magnetic spoofing attack that can drive the passive Hall sensor output in its saturation region. We name this as the saturation attack. In the saturation region, the output gets flattened, and no information can be retrieved, resulting in a denial-of-service attack on the sensor.Our work begins to fill this gap by providing a defense named PreMSat against the saturation attack on passive Hall sensors. The core idea behind PreMSat is that it cangenerate an internal magnetic field having the same strength but in opposite polarity to external magnetic fields injected by an attacker. Therefore, the generated internal magnetic field by PreMSat can nullify the injected external field while preventing: (i) intentional spoofing in the sensor’s linear region, and (ii) saturation attack in the saturation region. PreMSat integrates a low-resistance magnetic path to collect the injected external magnetic fields and utilizes a finely tuned PID controller to nullify the external fields in real-time. PreMSat can prevent the magnetic saturation attack having a strength up to ∼4200 A-t within a frequency range of 0 Hz–30 kHz with low cost (∼$14), whereas the existing works cannot prevent saturation attacks with any strength. Moreover, it works against saturation attacks originating from any type, such as constant, sinusoidal, and pulsating magnetic fields. We did over 300 experiments on ten different industry-used Hall sensors from four different manufacturers to prove the efficacy of PreMSat and found that the correlation coefficient between the signals before the attack and after the attack is greater than 0.94 in every test case. Moreover, we create a prototype of PreMSat and evaluate its performance in a practical system — a grid-tied solar inverter. We find that PreMSat can satisfactorily prevent the saturation attack on passive Hall sensors in real-time.

Defending saturation attacks on SDN controller: A confusable instance analysis-based algorithm

Software-Defined Networking (SDN) is an emerging network architecture that offers flexible network management. Although the decoupling of the control plane and data plane provides network programmability for SDN, it also makes SDN become vulnerable to several attacks. The saturation attack is one of these attacks. It is a concealed attack that has a highly negative impact by overwhelming the SDN controller. Once the SDN controller is crashed, the network cannot work. Currently, the cusp catastrophe theory has already been used for detecting saturation attack against SDN controller. When using the cusp catastrophe theory to detect saturation attack in SDN, most instances will be identified as unstable instances. The additional detection of unstable instances is achieved using the distance between current state and previous state, leading to the low detection accuracy. To overcome that issues, in this work, we propose LICENSE, a saturation attack detection mechanism designed based on confusable instance analysis. More specifically, a Condition Transferring Mechanism (CTM) method is designed to first classify the input instances into two kinds, the unconfusable instance that clearly belongs to attack or benign instance and the confusable instance which is not easy to distinguish. Then a Network State Base Cusp model is proposed to further distinguish the confusable instance to stable instance and unstable instance. At last, a method recorded as Unstable Instance Detection (UID) is proposed for identifying unstable instances. The evaluation results demonstrate that LICENSE can reduce the number of unstable instances and improve the detection accuracy of unstable instances, thus achieving a higher overall detection performance. In conclusion, LICENSE can effectively detect saturation attack in SDN.

Practical security of continuous-variable quantum key distribution involving saturation attack with finite-size analysis

Saturation attack of imperfect detectors compromises the practical security of continuous-variable quantum key distribution (CVQKD) in implementations. In this paper, we demonstrate the practical security of the CVQKD system with finite-size analysis when considering effects of saturation attack on imperfect detectors at the receiver. We suggest an approach to resisting this attack by embedding an adjustable optical filter in the detector, motivated by characteristics of saturation attack. Numerical simulations illustrate the practical security of the system with finite-size analysis in terms of the achieved secret key rate and maximal transmission distance. It indicates that this approach can be elegantly used for defeating the potential saturation attack in practical quantum networks.