ProvGuard: Detecting SDN Control Policy Manipulation via Contextual Semantics of Provenance Graphs

Software-Defined Networking (SDN) improves network flexibility by decoupling control functions (control plane) from forwarding devices (data plane).However, the logically centralized control plane is vulnerable to Control Policy Manipulation (CPM), which introduces incorrect policies by manipulating the controller's network view.Current methods for anomaly detection and configuration verification have limitations in detecting CPM attacks because they focus solely on the data plane.Certain covert CPM attacks are indistinguishable from normal behavior without analyzing the causality of the controller's decisions.In this paper, we propose PROVGUARD, a provenance graph-based detection framework that identifies CPM attacks by monitoring controller activities.PROVGUARD leverages static analysis to identify data-plane-related controller operations and guide controller instrumentation, constructing a provenance graph from captured control plane activities.PROVGUARD reduces redundancies and extracts paths in the provenance graph as contexts to capture concise and long-term features.Suspicious behaviors are flagged by identifying paths that cause prediction errors beyond the normal range, based on a sequence-to-sequence prediction model.We implemented a prototype of PROVGUARD on the Floodlight controller.Our approach successfully identified all four typical CPM attacks that previous methods could not fully address and provided valuable insights for investigating attack behaviors.