Towards saturation attack detection in SDN: a multi-edge representation learning-based method

Le résumé fourni par la source

Saturation attack detection in Software-Defined Networking (SDN) focuses on identifying and mitigating flow table overflow attacks on switches and overload attacks on the SDN controller. These attacks can hinder the installation of legitimate flow entries in switches and may even exhaust the controller’s resources, potentially leading to packet transmission failure. Although such threats are increasingly significant, network attack detection methods based on edge representation learning are still insufficiently studied. This study introduces a novel saturation attack detection method that leverages edge representation learning to enhance detection performance. The proposed method includes a novel graph construction strategy that generates Multi-edge Communication Flow Graphs (MCF-Graphs), and an edge representation learning model, Node-Edge Relationship GraphSAGE (NER-SAGE), for detecting saturation attack flows. MCF-Graphs effectively capture both the internal relationships among network flows and the associations between flows and network devices. NER-SAGE incorporates an attention mechanism to highlight the impact of flow edges on device node states in MCF-Graphs, and generates edge embeddings by aggregating information from both nodes and edges. Experiments conducted on two different network topologies demonstrate that the proposed method achieves high detection accuracy and strong graph representation capability, highlighting its effectiveness in identifying saturation attack flows.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.