[Paper Review] SPIDER: Fuzzing for Stateful Performance Issues in the ONOS Software-Defined Network Controller

Ao Li, Rohan Padhye+1 more|arXiv (Cornell University)|Sep 8, 2022

Software System Performance and Reliability4 citations

TL;DR

SPIDER is a novel fuzzing framework that combines semantic, performance-oriented, and dependency-aware analysis to automatically detect stateful performance issues (SPIs) in SDN controllers like ONOS and OpenDaylight. By using event-driven semantic fuzzing with handcrafted and type-based generators, lightweight instrumentation for performance monitoring, and modular dependency analysis, SPIDER uncovered 9 unique SPIs—some leading to exponential performance degradation—demonstrating its effectiveness in identifying subtle, state-dependent resource exhaustion vulnerabilities.

ABSTRACT

Performance issues in software-defined network (SDN) controllers can have serious impacts on the performance and availability of networks. In this paper, we consider a special class of SDN vulnerabilities called stateful performance issues (SPIs), where a sequence of initial input messages drives the controller into a state such that its performance degrades pathologically when processing subsequent messages. Uncovering SPIs in large complex software such as the widely used ONOS SDN controller is challenging because of the large state space of input sequences and the complex software architecture of inter-dependent network services. We present SPIDER, a practical fuzzing framework for identifying SPIs in this setting. The key contribution in our work is to leverage the event-driven modular software architecture of the SDN controller to (a) separately target each network service for SPIs and (b) use static analysis to identify all services whose event handlers can affect the state of the target service directly or indirectly. SPIDER implements this novel dependency-aware modular performance fuzzing approach for 157 network services in ONOS and successfully identifies 10 new performance issues. We present an evaluation of SPIDER against prior work, a sensitivity analysis of design decisions, and case studies of two uncovered SPIs.

Motivation & Objective

• To address the challenge of detecting stateful performance issues (SPIs) in SDN controllers, where performance degrades pathologically after a sequence of initial inputs.
• To overcome limitations of existing program analysis and fuzzing techniques in large, complex SDN controller codebases with dynamic module loading and semantic state dependencies.
• To design a practical, extensible workflow that integrates static analysis, semantic fuzzing, and performance instrumentation to systematically uncover SPIs.

Proposed method

• Employs practical grey-box performance fuzzing with lightweight instrumentation to maximize execution path length and CPU consumption.
• Uses event-driven semantic fuzzing with domain-specific, handcrafted event generators for critical paths and type-based synthesis for remaining events.
• Applies modular, dependency-aware static analysis to decompose services and analyze them individually, reducing complexity.
• Implements a target-specific adapter layer to support different controllers (e.g., ONOS, OpenDaylight) via custom harnesses and state operation interfaces.
• Integrates semantic constraints into event generation to improve coverage and reduce false positives.
• Iteratively generates sequences of events to trigger and detect performance regressions tied to internal state changes.

Experimental results

Research questions

• RQ1 Can a hybrid fuzzing framework effectively detect stateful performance issues in large-scale SDN controllers with complex internal state and dynamic module dependencies?
• RQ2 How does incorporating domain-specific semantic knowledge into event generation improve the detection of subtle, state-dependent performance bugs compared to fully automated or black-box approaches?
• RQ3 To what extent can modular, dependency-aware analysis reduce the complexity of searching for SPIs in monolithic SDN controller codebases?
• RQ4 What is the impact of constraint-aware event generation on uncovering performance issues that are not triggered by random or syntactically valid inputs alone?
• RQ5 How does SPIDER’s approach compare in effectiveness and efficiency to black-box fuzzing, fully automated event generation, and static analysis tools?

Key findings

• SPIDER successfully identified 9 unique stateful performance issues in the ONOS controller, all confirmed through manual reproduction and analysis.
• One critical vulnerability allows an attacker to degrade controller throughput to as low as 1 Mb/s by sending only 4,000 spoofed ARP packets at 10 packets per second.
• A topology service flaw was found to cause worst-case exponential performance degradation, triggered by a compromised network switch.
• The use of handcrafted, constraint-aware event templates was essential—removing them (using only generic type-based generation) resulted in zero new issue discovery.
• SPIDER outperformed black-box OpenFlow message fuzzing, fully automated event generation, and static analysis tools like FindBugs, which failed to detect any of the SPIs found by SPIDER.
• One false positive was reported, indicating the framework’s high precision in distinguishing real performance issues from benign patterns.