Adaptive Countermeasure by Credibility to Defend SDN Controllers Against BlackNurse-SC Attacks

Software-defined networking (SDN) facilitates network management by using a controller to monitor the network status and regulate switches. Owing to its central control nature, the controller often becomes the target of attacks. BlackNurse-SC, an emerging type of DDoS attack, drains the controller of its computing resources via ICMP error messages and causes a disruption in the SDN network. To defend the controller against BlackNurse-SC attacks, we propose an adaptive countermeasure by credibility (ACC) that checks if hosts have suspected attacking behavior and assesses their credibility. Low-credibility hosts will have their ICMP packets blocked as a penalty, and the penalty duration is adjusted depending on the degree of credibility. In addition, the credibility of a host can be restored when it doesn’t send ICMP error messages for a while. Simulation results reveal that the ACC scheme can protect a controller from BlackNurse-SC attacks effectively.