Abnormal SDN switches detection based on chaotic analysis of network traffic
Phuc Trinh Dinh, Taehee Lee, Thang Nguyen Canh, Sa Pham Dang, Sichul Kevin Noh, Minho Park · 2019
Network flow is susceptible to disruption through a software-defined network caused by malicious switches. The malicious behaviors such as dropping traffic, adding or delaying traffic are diverse. Once a switch is compromised by an attacker, the switch could be malfunctioning or configured incorrectly. In this paper, we propose a real-time method of detecting compromised SDN switches based on chaotic analysis of network traffic. An ARIMA model is used to predict the number of flows in every following three seconds. Then, by calculating the maximum Lyapunov exponent, the chaotic behavior of prediction error time-series is analyzed. Simulation findings indicate that 99.63% of traffic states can be accurately classified by the proposed algorithm.