[Paper Review] Performance and Security Evaluation of SDN Networks in OMNeT++/INET

Marco Tiloca, Alexandra Stagkopoulou+1 more|arXiv (Cornell University)|Sep 15, 2016

Software-Defined Networks and 5G5 references3 citations

TL;DR

This paper presents an extended simulation framework for OMNeT++/INET that enables performance and security evaluation of SDN networks at design time. It enhances the INET framework with support for complex OpenFlow message handling, SDN-based anomaly detection, and runtime injection of cyber-physical attacks via a high-level specification language, allowing quantitative analysis of attack impact and mitigation effectiveness in controlled scenarios.

ABSTRACT

Software Defined Networking (SDN) has been recently introduced as a new communication paradigm in computer networks. By separating the control plane from the data plane and entrusting packet forwarding to straightforward switches, SDN makes it possible to deploy and run networks which are more flexible to manage and easier to configure. This paper describes a set of extensions for the INET framework, which allow researchers and network designers to simulate SDN architectures and evaluate their performance and security at design time. Together with performance evaluation and design optimization of SDN networks, our extensions enable the simulation of SDN-based anomaly detection and mitigation techniques, as well as the quantitative evaluation of cyber-physical attacks and their impact on the network and application. This work is an ongoing research activity, and we plan to propose it for an official contribution to the INET framework.

Motivation & Objective

• To enable early-stage, quantitative evaluation of SDN network performance and security before real deployment.
• To address the lack of comprehensive simulation support for SDN in existing tools like Mininet and NS-3, which do not model the SDN controller as an external entity or support complex attack scenarios.
• To extend the INET framework with support for arbitrary flow-matching rules, flow statistics collection, and SDN-based monitoring systems.
• To integrate a flexible attack simulation framework (SEA++) for modeling and injecting diverse cyber-physical attacks into SDN scenarios at runtime.
• To support the evaluation of attack impact, detection latency, and mitigation effectiveness in SDN networks under controlled simulation conditions.

Proposed method

• Extended the INET framework to support full OpenFlow message processing, including complex flow-matching rules beyond basic MAC-based matching.
• Implemented SDN controller functionality that periodically collects flow statistics from switches and runs anomaly detection using entropy-based techniques and bounded packet rate monitoring.
• Enabled dynamic mitigation via OFPT_FLOW_MOD messages to install selective drop policies when anomalies are detected.
• Integrated the SEA++ attack simulation framework into INET to model and inject three types of attacks: physical, conditional, and unconditional, using a high-level attack specification language.
• Runtime attack injection is managed by the Attack Simulation Engine (ASE), which triggers node primitives based on attack timers and conditions, with interception of packets via the LPE for conditional attacks.
• Used a modular architecture where the GEP triggers unconditional attacks, and the ASE coordinates attack execution across nodes, including coordination with LEP and GEP modules.

Experimental results

Research questions

• RQ1 How does the SDN controller's flow statistics collection interval affect the detection latency of a Denial-of-Service attack?
• RQ2 To what extent does the complexity of flow-matching rules impact the performance and scalability of SDN simulations?
• RQ3 How effectively can SDN-based anomaly detection systems detect and mitigate a targeted Denial-of-Service attack in a controlled simulation environment?
• RQ4 What is the quantitative impact of different attack injection rates on network performance and server packet reception?
• RQ5 How does the integration of a flexible attack specification language enable reproducible and extensible security evaluation in SDN simulations?

Key findings

• A higher packet injection rate (R = 40 pkts/s) from a compromised client led to a significant increase in packet reception at the target server, with up to 40 packets per second received during the attack phase.
• Detection and mitigation of the DoS attack occurred at t = 120 seconds, after which the switch dropped all packets from the malicious client, restoring normal traffic levels.
• Shorter flow statistics collection intervals (I = 30 s) led to faster detection of anomalies, reducing the time window during which malicious traffic was processed.
• The simulation framework successfully modeled and evaluated the full lifecycle of a DoS attack, from injection to detection and mitigation, demonstrating the feasibility of runtime attack injection in SDN simulations.
• The extended INET framework enabled accurate modeling of SDN controller behavior, including flow statistics collection, anomaly detection logic, and policy dissemination via OpenFlow messages.
• The attack simulation framework allowed precise, repeatable injection of attacks without modifying core INET components, supporting modular and extensible security evaluation.