Evaluation of insider denial-of-service attacks in software-defined networks

Abstract

Technology has moved towards virtualization and SDN networks are widely recognized for the management advantages they offer over traditional legacy networks. When analyzing a DoS attack vulnerability in a SDN network, a simulated network was implemented in the GNS3  using several devices: Opendaylight controller, open vswitch, DHCP client and server, DNS, HTTP, VoIP and FTP. For the vulnerability analysis, it was decided to use the OCTAVE method, identification of the organization's assets and threats,  vulnerability scanning. The second phase of development used the Openvas tool, which helps detect network failures, their characteristics and affected devices, and then categorize them to identify devices that affect availability, such as server versions and types. Once this step is completed, denial of service attacks: HTTP, DHCP and DNS are performed to exhaust the resources used by the system and demonstrate the behavior of the network in terms of metrics such as bandwidth and latency. The conclusion is that, in the case of bandwidth, the efficiency of the pre-attack effect did not exceed 34%, but later showed values as high as 71% and 84%, while the pre-attack delay was lower at 15 ms. and then increased to 4779 ms.