Multi-probability sampling-based detection of malicious switching nodes in SDN

Abstract

Addressing the potential risk of malicious exploitation of switching devices in software-defined networks (SDN), this paper proposes a multi-probability sampling-based detection of malicious switching nodes in SDN, called MPSDMN. MPSDMN selects switching nodes in the link as sampling nodes and assigns sampling probabilities to them. The sampling nodes sample and count data packets based on rewritten headers, and the controller detects and locates the malicious switching nodes based on the bisection method, effectively reducing the computational cost of switching devices. The experimental results show that the MPSDMN can effectively detect and locate the attacks of various malicious nodes such as tampering attacks, path anomaly attacks, and drop attacks, introducing less than 9% forwarding delay and less than 9% throughput loss, with lightweight performance overhead.