Resilience of SDN Controllers to DDoS Attacks: A Comparative Study of RYU, ODL, and OVS

While Software-Defined Networking (SDN) has transformed network management, it also introduces significant security risks in applications like IoT devices, data centers and autonomous vehicles, particularly making centralized controllers vulnerable to Distributed Denial of Service (DDoS) attacks. This paper examines the network performance and resilience of two leading open-source SDN controllers—RYU and OpenDayLight (ODL)—under eight different cyber-attack scenarios and the simple OVS controller that comes with Open vSwitch. Utilizing a host-based IDS implemented with an Open virtual switch in a Mininet emulation environment, we orchestrated diverse cyber attacks to assess their impact on network performance. Network behavior during these attacks was tested using iPerf to measure jitter and packet loss, providing essential QoS baseline data for eight distinct DDoS attacks. Our research aims to equip cybersecurity professionals and network administrators with critical insights into how different attacks affect the RYU, ODL, and OVS-based data planes, enabling them to formulate effective defensive strategies. The results show that the OVS and ODL controllers incur higher packet loss compared to the RYU controller during most DDoS attacks, particularly during Synchronize (SYN) Flood and DNS Flood attacks. On the other hand, jitter analysis demonstrated that ODL had poorer performance relative to others across most DDoS attack scenarios, while OVS had the best. This comprehensive analysis highlights the vulnerabilities of SDN controllers and the dynamics of network behavior under cyber threats, guiding robust security development and informing future applications and advancements in SDN and NFV technologies.