SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane

Kuan Yin Chen, Sen Liu, Yang Xu, Ishant Kumar Siddhrau, Siyu Zhou, Zehua Guo, H. Jonathan Chao

Research output: Contribution to journalArticlepeer-review


Software-defined networking (SDN) is increasingly popular in today's information technology industry, but existing SDN control plane is insufficiently scalable to support on-demand, high-frequency flow requests. Weaknesses along SDN control paths can be exploited by malicious third parties to launch distributed denial-of-service (DDoS) attacks against the SDN control plane. Recently proposed solutions only partially solve the problem, by protecting either the SDN network edges or the centralized controller. We propose SDNShield, a solution based on emerging network function virtualization (NFV) technologies, which enforces more comprehensive defense against potential DDoS attacks on SDN control plane. SDNShield incorporates a three-stage overload control scheme. The first stage statistically identifies legitimate flows with low complexity and performance overhead. The second stage further performs in-depth TCP handshake verification to ensure good flows are eventually served. The third stage intellectually salvages the misclassified legitimate flows that are falsely dropped from the first two stages. Prototype tests and real data-driven simulation results show that SDNShield can achieve high resilience against brute-force attacks, and maintain good flow-level service quality at the same time.

Original languageEnglish (US)
Pages (from-to)1-17
Number of pages17
JournalIEEE/ACM Transactions on Networking
Issue number1
StatePublished - Feb 1 2022


  • Distributed denial-of-service
  • network function virtualization
  • network security
  • software-defined networking

ASJC Scopus subject areas

  • Software
  • Computer Science Applications
  • Computer Networks and Communications
  • Electrical and Electronic Engineering


Dive into the research topics of 'SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane'. Together they form a unique fingerprint.

Cite this