A SDN Data Plane Abnormal State Detection Method Based on Flow Rules Analyzing

As a new network architecture, Software Defined Networking (SDN) controls the network by software programming, which improves the flexibility of network configuration. However, the attack surface of SDN is larger than the traditional network. The three planes and the two channels all have vulnerability points, among which the attacks against the data plane are particularly critical. The attacks will interfere with the normal data forwarding behavior, resulting in the failure of the whole network data transmission. In this paper, a data plane abnormal behavior detection method based on flow rule analyzing is proposed. First, the characteristics of flow rules in terms of quantity, conflict and abnormal behaviors are extracted and analyzed, then a data plane abnormal state model is constructed, and finally, detection algorithm is used to detect abnormal behaviors, to assess whether the data plane state is safe. The experimental results show that the proposed method can accurately detect the data plane state anomalies. Compared with NetPlumber, our method can not only detect flow rule conflicts, but also detect the abnormal change trend in quantity of flow rules and malicious forwarding and packet loss caused by attacks.