Flow-based Reconnaissance Attacks Detection in SDN-based Environment

Software-Defined Networking (SDN) is an optimistic network architecture that seeks to provide increased flexibility via splitting forwarding functions (data plane) and network logic (control plane). This break feeds the logical centralization of controls, an overview of the global network, scalability, ease of programmability, and scope for pristine SDN-compliant services. In recent years, SDN in industry networks has continually grown. In the meantime, new challenges have appeared in different categories, such as security, management, and scalability. This paper will elaborate on the complex security issues existing in current SDN architecture, especially reconnaissance attacks, where attackers generate traffic to explore existing services, assets, and overall network topology. The proposed flow-based detection solution utilizes, in a slow-rate manner, OpenFlow counters to detect reconnaissance traffic techniques in the SDN environment. The results show that the proposed solution can detect reconnaissance attacks.