Advanced Flow Monitoring Technique for Intrusion Tolerance in SDN

It is important for a system to build security features to prevent attacks and protect the infrastructure. Since it is very hard to achieve full protection, the notion of intrusion tolerance came into existence. In intrusion tolerant architectures, every single intrusion is not prevented. The intrusions are allowed but tolerated. The system has mechanisms which will prevent the intrusion to turn to a system failure. There are a lot of papers in classical IP-based networks regarding intrusion tolerant systems, but a very few introduce the concept of intrusion tolerance in software define networks (SDN). Software-defined networks (SDN) is an evolving architecture in which control plane is detached from the data plane. The controller, which constitutes the SDN control plane, can control the entire network. This centralized view of the network with the ability to program the network through applications can be used for developing intrusion tolerant architecture. The implementation discussed here is based on the flow monitoring method [1] for intrusion tolerance in SDN. Intrusion Detection Module (IDM) is developed on top of MD-SAL [2] in the Opendaylight SDN controller. IDM uses Openflowplugin module to request flow statistics from the switch and monitors packet counts at different intervals. It programs higher priority flow with the same match criteria and action as sent to controller if the rate exceeds the threshold value. This higher priority flow is programmed with hard timeout of 5 seconds which prevents overburdening of sending a lot of packets to controller. IDM also performs deep packet inspection when the packet reached controller. The packets for the stream are successfully dropped if the intrusion is from a known sender. This is done by matching on the source and destination ports. For the packets from an unknown source, a new flow is added with IP address as match and an action of drop. This prevents further intrusion for all the packets sent from the unknown sender and thereby protecting the system from failure.