Rethinking Software-Defined Networking Link Discovery with Dynamic Randomization

2026-09-13

AI Summary

该研究针对SDN中基于LLDP的拓扑发现易受攻击的问题，提出了一种名为ChameleonDisc的新协议，通过动态随机化技术防止和检测网络拓扑中毒攻击。

Abstract

Software-defined networking (SDN) separates the control and data planes, enabling programmable, centralized network management. A core SDN service is topology discovery --- a periodic process that identifies network links. However, our analysis of five open-source SDN controllers and ten discovery protocols shows that all remain vulnerable to at least one form of link-fabrication attack. The common root cause is their reliance on traditional Link Layer Discovery Protocol (LLDP) packets, whose static identifiers expose their discovery purpose and attract adversaries to exploit them. We propose ChameleonDisc, a dynamic link-discovery protocol that simultaneously prevents and detects topology-poisoning attacks by eliminating this root cause. Our key insight is that an SDN controller can infer topology without embedding meaningful information in discovery packets. ChameleonDisc removes targetable static LLDP signatures and employs a moving-target defense that combines decoy, obfuscation, and camouflage techniques instantiated dynamically at runtime to prevent topology poisoning and detect manipulation. We implement ChameleonDisc on OpenDaylight and demonstrate effectiveness against all identifier-based topology-poisoning attacks. On a 252-link topology, median convergence is 1.37--4.53\,s for legitimate link changes and 4.06\,s for malicious relay detection, with 13.0 percentage points of additional mean CPU and negligible retained-heap difference. Across topologies up to 816 links, ChameleonDisc provides a tunable security--performance trade-off; expanding discovery intervals reduces CPU and mapping state at the cost of increased attack-detection latency.

Problem

• Software-Defined Networking
• Link Discovery
• Topology Poisoning
• LLDP

Innovation

• dynamic link-discovery
• moving-target defense
• topology-poisoning attacks
• decoy and obfuscation
• SDN security