Software-defined networking (SDN) is a new networking architecture with a centralized control mechanism. SDN has proven to be successful in improving not only the network performance, but also security. However, centralized control in the SDN architecture is associated with new security vulnerabilities. In particular, user-datagram-protocol (UDP) flooding attacks can be easily launched and cause serious packet-transmission delays, controller-performance loss, and even network shutdown. In response to applications in the Internet of Things (IoT) field, this study considers UDP flooding attacks in SDN and proposes two lightweight countermeasures. The first method sometimes sacrifices address-resolution-protocol (ARP) requests to achieve a high level of security. In the second method, although packets must sometimes be sacrificed when undergoing an attack before starting to defend, the detection of the network state can prevent normal packets from being sacrificed. When blocking a network attack, attacks from the affected port are directly blocked without affecting normal ports. The performance and security of the proposed methods were confirmed by means of extensive experiments. Compared with the situation where no defense is implemented, or similar defense methods are implemented, after simulating a UDP flooding attack, our proposed method performed better in terms of the available bandwidth, central-processing-unit (CPU) consumption, and network delay time.

中文翻译：

---

抵制SDN中的UDP泛洪攻击

软件定义网络（SDN）是具有集中控制机制的新网络体系结构。事实证明，SDN在改善网络性能和安全性方面均取得了成功。但是，SDN体系结构中的集中控制与新的安全漏洞相关联。特别是，用户数据报协议（UDP）泛洪攻击很容易发动，并导致严重的数据包传输延迟，控制器性能损失，甚至网络关闭。针对物联网（IoT）领域的应用，本研究考虑了SDN中的UDP泛洪攻击，并提出了两种轻量级对策。第一种方法有时会牺牲地址解析协议（ARP）请求以实现高级别的安全性。在第二种方法中 尽管在遭受攻击之前有时必须牺牲数据包才能开始防御，但是检测网络状态可以防止牺牲正常数据包。阻止网络攻击时，将直接阻止来自受影响端口的攻击，而不会影响正常端口。通过大量实验证实了所提出方法的性能和安全性。与没有实施防御或实施类似防御方法的情况相比，在模拟UDP泛洪攻击之后，我们提出的方法在可用带宽，中央处理器（CPU）消耗和网络延迟时间方面表现更好。 。来自受影响端口的攻击将被直接阻止，而不会影响普通端口。通过大量实验证实了所提出方法的性能和安全性。与未实施防御或实施类似防御方法的情况相比，在模拟UDP泛洪攻击之后，我们提出的方法在可用带宽，中央处理器（CPU）消耗和网络延迟时间方面表现更好。 。来自受影响端口的攻击将被直接阻止，而不会影响普通端口。通过大量实验证实了所提出方法的性能和安全性。与没有实施防御或实施类似防御方法的情况相比，在模拟UDP泛洪攻击之后，我们提出的方法在可用带宽，中央处理器（CPU）消耗和网络延迟时间方面表现更好。 。