Flow Entry Timeout Hopping for SDN Flow Table LDoS Attack Defense

This paper proposes flow entry timeout hopping strategies to defend against flow table Low-rate Denial of Service (LDoS) attacks in Software-Defined Networks (SDNs). By introducing uncertainty in the flow entry timeout, SDNs can avoid their flow entry timeout from being synchronized by attackers in the LDoS attack cycle, thereby effectively preventing their flow table from overflowing. Three different strategies are introduced, including a random hopping strategy, a strategy that hops the flow entry timeout based on the packet_in rate, and a strategy that hops the flow entry timeout based on the feedback of the packet_in rate. The evaluations are conducted on SDNs emulated by Mininet. The results show that all three hopping strategies significantly reduce flow table occupancy during attacks while consuming reasonable controller CPU resources, they effectively prevent flow table overflows and improve system stability.