Abnormal SDN switches detection based on chaotic analysis of network traffic

Abstract

Network flow is susceptible to disruption through a software-defined network caused by malicious switches. The malicious behaviors such as dropping traffic, adding or delaying traffic are diverse. Once a switch is compromised by an attacker, the switch could be malfunctioning or configured incorrectly. In this paper, we propose a real-time method of detecting compromised SDN switches based on chaotic analysis of network traffic. An ARIMA model is used to predict the number of flows in every following three seconds. Then, by calculating the maximum Lyapunov exponent, the chaotic behavior of prediction error time-series is analyzed. Simulation findings indicate that 99.63% of traffic states can be accurately classified by the proposed algorithm. © 2019 IEEE.