ProDetect: A Proactive Detection Approach of the TCP SYN Flooding Attack in the SDN Controller

Abstract

The TCP SYN flooding attack or assault is one of the most prominent methods for the controller layer and the target server exhaustion in software-defined networking (SDN). The switches in the data layer or plane are forced to transfer an enormous amount of illicit SYN requests that the adversary creates to the controller because there are no forwarding rules. This extensive forwarding strains the computing capacity of both the data layer and the control layer and clogs the transmission route connecting them. We suggest a dynamic threshold-based countermeasure in this research, named ProDetect, to proactively cater to the SYN flooding attack in the SDN environment. We have fully implemented ProDetect as a security extension on the SDN controller for verifying inbound TCP connections. For SYN requests those that pass through ProDetect's validation test, the controller installs data forwarding policies for them and other malicious hosts sending forged requests are blocked. Therefore, these hosts are barred from sending any new TCP requests to the switches present inside the data layer. We have also employed a strategy to cope with forged MAC addresses in this work. When compared with the existing approaches, the evaluation of performance conducted by the simulation data reveals that ProDetect demonstrates low side effects for legitimate TCP requests and increases the total response time through an onset of SYN flooding operation.

KEYWORDS:

• Controller
• DDoS
• Denial of service
• Security
• Software defined networking
• TCP SYN flooding

Disclosure statement

No potential conflict of interest was reported by the authors.

Additional information

Notes on contributors

Tinku Adhikari

Tinku Adhikari is a research scholar in the computer engineering department of Mizoram Central University, Aizawl, India. He completed his Mtech from NITTTR Kolkata and MCA from St. Xaviers College Kolkata Under IGNOU. His current areas of work are network security, SDN security, and quantum cryptography. He has also been associated with Techno International Newtown, Kolkata, India as an assistant professor for the last 12 years. Corresponding author. Email: [email protected]

Ajoy Kumar Khan

Ajoy Kumar Khan is presently serving as a professor and head of department of computer engineering at Mizoram University (A Central University under MHRD). He completed his Btech and Mtech in computer science and engineering from the University of Calcutta and his PhD from Assam University(A Central University), Silchar. He has more than 16 years of teaching experience in the field of computer science and engineering. Prof. Khan published more than 36 papers in the UGC-listed Journal and more than 38 papers in conference proceedings or book chapters. Three PhD scholars completed, 8 pursuing, and 13 MTech scholars completed their Mtech thesis under his supervision. His research interest fields are applied cryptography and information security like smart card security, IOT security, SDN security, cloud data security, IDS, and digital forensic, etc.. Email: [email protected]

Malay Kule

Malay Kule has been on the faculty of the Indian Institute of Engineering Science and Technology (IIEST), Shibpur, India since 2013, where currently, he is an assistant professor (Grade II) of computer science and technology. Previously he served as an assistant professor in the department of computer science and engineering of St. Thomas’ College of Engineering and Technology, Kolkata, India from 2006 to 2013. He received the BSc degree in physics honours, the BTech and MTech degrees in computer science and engineering, all from the University of Calcutta, India. He received a PhD degree in engineering from the Indian Institute of Engineering Science and Technology, Shibpur, India. His research interests include defect tolerance of nanoscale crossbar circuits, cryptology, etc. Email: [email protected]