Preacher: Network Policy Checker for Adversarial Environments

Private networks are typically assumed to be trusted as security mechanisms are usually deployed on hosts and the data plane is managed in-house. The increasing number of attacks on network devices, and recent reports on backdoors, forces us to revisit existing security assumptions and demands new approaches to detect malicious activity. This paper presents Preacher, a runtime network policy checker, which leverages a secure, redundant and adaptive sample distribution scheme that allows us to provably detect and localize adversarial switches or routers trying to reroute, mirror, drop, inject, or modify packets (i.e., header and/or payload) even under collusion. The analysis performed by Preacher is highly parallelizable. We show that emerging programmable networks provide an ideal vehicle to detect suspicious network activity. Furthermore, we analytically and empirically evaluate the effectiveness of our approach in different adversarial settings, report on a proof-of-concept implementation using ONOS, and provide insights into the resource and performance overheads of Preacher.

I. Introduction

While networks are becoming programmable, faster and more efficient, they are not necessarily becoming more secure. Attackers have repeatedly demonstrated their ability to compromise switches and routers [1], networking vendors have left backdoors open [2], and national security agencies can bug network equipment and introduce hardware backdoors [3]. The attack surface on network infrastructure is further exacerbated by vulnerable implementations [1].