Cluster-Based Detection of Compromised SDN Controller Using Behavioral Divergence

초록

Software-Defined Networking (SDN) enhances programmability by decoupling the control and data planes, yet this centralization introduces a critical vulnerability: a compromised controller can manipulate traffic while remaining protocol-compliant. Existing global monitoring techniques struggle with scalability in large data centers. This paper proposes a scalable anomaly detection framework that leverages traffic locality in hierarchical SDN topologies. By clustering switches into localized monitoring domains, the framework computes behavioral indices per cluster and measures inter-cluster divergence using Max Pairwise Distance (MPD). A supervised learning model classifies these patterns to detect anomalies without requiring full-network visibility. Using DCT2Gen for realistic traffic generation, our method demonstrates high detection accuracy with low overhead, making it suitable for large-scale SDN deployments.

키워드