LNAD: Towards Lightweight Network Anomaly Detection in Software-Defined Networking

As an emerging architecture, Software-Defined Networking (SDN) is suffering from a lot of security issues. Network anomaly detection technology plays a crucial role in addressing SDN security issues. In SDN, the network status can be denoted by the packets or flow entries. Hence, the existing network anomaly detection methods are commonly designed based on inspecting packets or flow entries. Subsequently, these anomaly detection methods have to collect packets or flow entries from the underlying switches. More seriously, some anomaly detection methods even need to add extra modules to the switches. Unlike these existing network anomaly detection methods, this work proposes a lightweight network anomaly detection method. The main design principle of the proposed method is mining the inherent OpenFlow messages in SDN to represent the network status and further detect the network anomaly. The proposed method does not need to collect any additional messages from the underlying switches or add any additional modules to the underlying switches. The evaluation results demonstrate that the proposed network anomaly detection method can afford high detection accuracy and reduce the overhead of SDN controller.