TopoSleuth, a decoy-based multi-layered defense framework for securing SDN topology discovery

Software Defined Networking (SDN) is a diversified networking paradigm that is centralized, dynamic, and enables traffic control and administration through flexible network programmability. The controller and its applications have a holistic view of the underlying physical topology, including switches, ports, hosts, and links. With the increasing significance and popularity of SDN, novel attacks have arisen that can distort the controller’s view of topology. A corrupt topology view can have a catastrophic effect on the controller and topologically dependent services, resulting in falsified routing and forwarding decisions. In this paper, we propose a multi-layered, context-aware defense framework called TopoSleuth that complements the current controller services, Link Discovery Service (LDS) and Host Tracking Service (HTS), with four lightweight modules: (i) Topology Monitor (TM) for correlation and escalation logic; (ii) Decoy Engine (DE) for deception-based tripwires using controller-only decoy links; (iii) Behavioral Profiler (BP) for detecting abnormal LLDP and link-state behavior; and (iv) Multi-hop Validator (MHV) for selective probing. The framework integrates seamlessly with existing controllers and does not require changes to switch firmware or any cryptographic extensions. Owing to its defense-in-depth design, TopoSleuth is effective against a broad range of topology poisoning attacks, including combination attacks and topology freezing, for which there is currently no practical countermeasure. We implement TopoSleuth as a lightweight, proof-of-concept application on the Mininet–Ryu testbed for a 20-switch, 40-host topology. The results show an average detection latency of 52.6 ms, a false-positive rate of 1.8%, and moderate controller overhead (6.4% CPU usage and 23.5 MB of memory), demonstrating the framework’s practical viability for wider SDN implementations. To the best of our knowledge, TopoSleuth is the first defense mechanism to use decoy links specifically for securing the SDN topology discovery and is a practical, lightweight and highly effective solution for contemporary SDN deployments.