POXIEM: An ELK Integrated SDN Controller Proposal for Improved Control Plane Forensic Visibility and Incident Response

Software-Defined Networking (SDN) has revolutionized network management by decoupling the control plane from the data plane, enabling dynamic and flexible network configurations. This architectural shift introduces new challenges in maintaining control plane visibility and effectively detecting and mitigating potential threats. However, the security of the control plane and the server hosting the SDN controller has received limited attention compared to data plane security. In this study, we address this gap by presenting a comprehensive approach that combines custom log parsers, additional granular logging functions, and the integration of the POX SDN controller with the Elastic Stack (ELK) to monitor both the security of the server hosting controller and control plane operations against potential threats and provide forensically sound evidence for incident response. Our results confirm the efficacy of our proposed solution, with easy-to-parse structured logs and strong filtering and visualization capabilities providing comprehensive analytics. These capabilities contribute to improved control plane visibility and enhanced security for both the control plane and the hosting system in SDN environments.