Robustness of the detection of anomalies in a network control in case of parsimonious observation

Overview & Synopsis

Software Defined Networking (SDN) is a networking architecture within the control is centralized through a software-based controller. Hence, the controller represents a single point of attack which makes the controller a preferred target in case of attack. In previous work, an observer has been introduced in order to detect any anomalies in the network control (in particular, in the data planes which are set up). The detection method is based on the assumption that the observer captures all the packets sent and received by the controller. This paper introduces an extension of the detection approach to improve the robustness in case of partial or parsimonious observation, more specifically when the complete data plane cannot be observed. The evaluation of the consistency of the data plane is adapted by definition of necessary condition which permits to conclude that the data plane is inconsistent. In the absence of evidence, a function which permits to compute the level of confidence in the consistency of the data plane is introduced. The efficiency and the limitations of such method is discussed on a case study.