Towards Load Balancing in SDN Networks During DDoS attacks

Towards Load Balancing in SDN

Networks During DDoS attacks

Mikhail Belyaev St.Petersburg Polytechnic University Svetlana Gaivoronski Moscow State University

•  DDoS attack – distributed attack causing denial-of-service of victim system.

•  For a lot of scary number, visit arbornetworks.com

DDoS mitigation

• Mitigation techniques:

–  “active mitigation”: detection and filtering of attacking machines;

Existing Solutions

• Static load balancing uses a-priori

information about system state:

–  Random selection –  Hash selection

–  (Weighted) round-robin

• Dynamic load balancing distributes load

between servers during runtime:

–  Round-robin

SDN load balancing problems

SDN load balancing problems

SDN load balancing problems

Proposed Approach: Idea

• 2 independent levels of load balancing:

–  L7 load balancing (DNS/NAT) –  L4 load balancing

Algorithm

1.  Acquire the load and topology

information for network;

2.  Override the routing for the network with

static routing information;

3.  Iteratively keep splitting (and reapplying)

traffic paths for routers that are:

1.  Overloaded

Pre-phases

• Phase 1:

–  Needs to be executed before the need of load balancing arises

–  Updates the network load mask , where the element corresponds to number of bytes coming from i to j

• Phase 2:

–  Applied only once to override the default packet routing mechanisms

–  Performed by running Bellman-Ford algorithm on the whole network topology graph

!ij

Iterative phase (1/3)

1.  Update and with current info.

Iterative phase (1/3)

1.  Update and with current info.

2.  Find the first overloaded link in

M_{load Mf ree}

M

: !

+ ✏ > ↵

Iterative phase (1/3)

1.  Update and with current info.

2.  Find the first overloaded link in

3.  Find the first path in such that contains link M_{load Mf ree}

M

: !

+ ✏ > ↵

r

T

r

4.  For part of , find a new shortest path to

server , assuming than link is not presented. Let us call new path

ip

r

Iterative phase (2/3)

4.  For part of , find a new shortest path to

server , assuming than link is not presented. Let us call new path

ip

r

Iterative phase (2/3)

4.  For part of , find a new shortest path to

server , assuming than link is not presented. Let us call new path

5.  Calculate maximum

additional load for ,

looking up every link path in :

ip

r

al = min(mij : (i, j) 2 pathq)

Iterative phase (3/3)

6.  Calculate the new sets of masks and

such that they divide into pairs with coef.

Remove corr. Entry from and insert new ones.

ips_{old ipsnew}

ips_src

al/!ij

Iterative phase (3/3)

6.  Calculate the new sets of masks and

such that they divide into pairs with coef.

Remove corr. Entry from and insert new ones.

ips_{old ipsnew}

ips_src

al/!ij

T_path

Iterative phase (3/3)

6.  Calculate the new sets of masks and

such that they divide into pairs with coef.

Remove corr. Entry from and insert new ones. 7.  Commit the changes in

to all switches across and .

ips_{old ipsnew}

ips_src al/!ij T_path T_path path path_q

Iterative phase (3/3)

6.  Calculate the new sets of masks and

such that they divide into pairs with coef.

Remove corr. Entry from and insert new ones. 7.  Commit the changes in

to all switches across and .

8.  Wait for timeframe and go to step 1.

ips_{old ipsnew}

ips_src al/!ij T_path T_path path path_q

Implementation

CALLOPHRYS DDoS attack

detection and mitigation system:

• 

Distributed

• 

Asynchronous

• 

Based on actor model

…

SDN

Agent Manager

Implementation

Asynchronous context implies:

• 

All parts of the balancer are separate

asynchronous agents

• 

The loop is created using timed messages

sent to the balancer

• 

The rest of the algorithm doesn’t change

much

Evaluation

CALLOPHRYS has been tested using a

virtual network setup

q 

Mininet

o  Simulated low-spec and slowed down

network

q 

Floodlight

q 

Iperf for attack simulation

Evaluation: results

• 

Load balancing was

evaluated separately

from the detectors

• 

Reaching full link &

switch employment in

10-60 seconds

• 

Up to 3000 rules

generated for

critical-path switches

Limitations & Future Work

§ 

Stale rules in switches may degrade

network performance over time

§ 

We do not employ any asynchronous

features of the actor-based solution

§ 

Algorithm parameters are deduced by

handmade experiments

We need a real benchmark and evaluation on

physical networks!

YOUR QUESTIONS?

Mikhail Belyaev: [email protected] Svetlana Gaivoronski: [email protected]

Notations

•  - channel between switches i and j; •  - bandwidth of channel

•  - current channel load •  The channel is overloaded if

•  - destination servers

•  - load matrix N x N containing current load values

•  - Matrix of available resources -

(i, j) (i, j)

!

a

!

+ ✏ > ↵

!

a

!

M