NUST Institutions Library Catalogue

Software-Defined Networking (SDN) has revolutionized modern network architectures
by decoupling the control plane from the data plane, enabling centralized network management,
programmability and dynamic policy enforcement. However, this architectural
shift introduces significant security challenges, particularly concerning the integrity of
network topology information. Topology discovery, a fundamental controller service
that constructs the network’s connectivity graph, is vulnerable to poisoning attacks
where adversaries manipulate discovery messages to corrupt the controller’s view of the
network. Such attacks can lead to severe consequences including traffic interception,
denial of service, policy evasion and persistent network manipulation.
This thesis addresses the critical problem of securing SDN topology discovery against
sophisticated poisoning attacks. Current defense mechanisms primarily rely on single
layer approaches such as cryptographic authentication, anomaly detection, or active
probing-each with limitations in scalability, deployability, or resilience against adaptive
adversaries. To overcome these limitations, this research adopts a paradigm shift by
treating secure topology discovery as a consequence of establishing trust in the data
plane, rather than addressing it solely as a protocol-level problem.
The thesis makes two primary contributions. First, it presents VADSec (VLAN and
Active Directory-based Security), a lightweight data-plane identity protection scheme
that establishes a root of trust by enforcing host identity verification before allowing
participation in network operations. VADSec employs quarantine VLANs, broadcastbased
impersonation detection and directory-backed authentication to prevent host-level
topology poisoning attacks.
Second, building upon this trusted foundation, the thesis introduces TopoSleuth, a
comprehensive multi-layer topology discovery defense framework. TopoSleuth integrates
four complementary defense mechanisms: (1) deception-based detection using passive
decoy links, (2) behavioral profiling of topology dynamics, (3) selective multi-hop
validation of suspicious links and (4) confidence-based evidence fusion. By correlating
evidence from multiple independent detection layers, TopoSleuth makes it significantly
more difficult for attackers to manipulate topology discovery without being detected,
while maintaining low operational overhead.