Detection-Aware Controller Placement in Software-Defined Networks

Overview & Synopsis

Software-Defined Networking (SDN) decouples control and data planes, making controller orchestration a central challenge known as the Controller Placement Problem (CPP). While security-aware CPP has been studied mainly through active mechanisms (e.g., consensus), their assumptions do not hold for passive mechanisms such as anomaly detection. Yet, security tasks increase controller load, and prior analytical and experimental works show that control-plane contention degrades network performance. This paper investigates the impact of passive security-specifically anomaly detection-on controller load and integrates the choice of detection model into the CPP to jointly optimize security and performance. Experiments on the Ryu controller over the GEANT topology show that passive mechanisms can reduce effective controller capacity by up to a half. Compared to classical strategies, our approach improves security by 11% with only 3% performance overhead, whereas the most secure baseline incurs over 67% performance degradation for a 16% security gain.