FTOA-RP: A ‘group’-based flow entry replacement policy probing and flow table overflow attack method

As a new network architecture, Software-Defined Networking (SDN) introduces potential risks, such as configuration probing of switches and flow table overflow attacks. The existing flow entry replacement probing methods may not accurately probe the replacement policies due to network jitter and packet loss. Meanwhile, existing flow table overflow attacks ignore the fact that the flow entry replacement policy will evict the malicious flow entries during the attack. As evicted flow entries are not reinstalled promptly, the attack’s effect is reduced. To address the above issues, FTOA-RP, a new two-phase flow entry replacement policy probing method, and a new flow table overflow attack method considering the flow entry replacement policy are proposed. To overcome the decrease in replacement policy probing accuracy caused by network jitter and packet loss, FTOA-RP probes the replacement policy using a group of probing packets. In particular, FTOA-RP designs TPRPP, a probing algorithm that consists of a forward/backward eviction detection phase and a forward eviction fine-grained detection phase to probe the flow entry replacement policies. TPRPP designs a specially structured packet group, which consists of multiple subgroups, each containing several probing packets. By sending probing packets in groups, TPRPP effectively mitigates the negative effects of network jitter and packet loss. To address the issue that the effectiveness of existing flow table overflow attacks is reduced by the flow entry replacement policy, FTOA-RP designs a flow table overflow attack method that considers the impact of flow entry replacement. More specifically, FTOA-RP designs two attack packet-sending algorithms. The first one is SAP-FLR, which is used to launch a flow table overflow attack under FIFO and LRU. The second one is SAP-LF, used to launch a flow table overflow attack under LFU. During the attack phase, SAP-FLR and SAP-LF adjust the sending order of attack packets based on the replacement policies to ensure the timely reinstallation of evicted flow entries. The evaluation results show that FTOA-RP outperforms the existing attack methods in terms of the probing accuracy, probing cost, and the ability to maintain malicious flow entries during the attack.