Know Your Enemy：秘密侦查--SDN中的信息收集
Know Your Enemy: Stealth Configuration-Information Gathering in SDN
摘要：
软件定义网络（Software Defined Networking，SDN）是一种旨在通过将网络逻辑与转发功能分离来提供高灵活性的网络架构。该行业已经广泛采用SDN，研究人员彻底分析了其漏洞，提出了提高其安全性的解决方案。然而，我们认为SDN的重要安全方面仍然没有得到研究。在本文中，我们提出了攻击者获取SDN网络知识的可能性。特别是，我们介绍了一种新的攻击，名为知道你的敌人（KYE），通过它的攻击者可以收集有关网络配置的重要信息。这些信息的范围从安全工具的配置（如网络扫描的攻击检测阈值）到一般网络策略（如QoS和网络虚拟化）。此外，我们还证明了攻击者可以以隐身的方式进行KYE攻击，即，而不会被发现我们强调，KYE攻击所利用的漏洞是SDN特有的，在传统网络中不存在。针对KYE攻击，我们还提出了一种基于网络流混淆的主动防御对策，这大大增加了成功攻击的复杂性。我们的解决方案提供可证明的安全保证，可根据所考虑的特定网络的需求进行定制
英文摘要：
Software Defined Networking (SDN) is a network architecture that aims at providing high flexibility through the separation of the network logic from the forwarding functions. The industry has already widely adopted SDN and researchers thoroughly analyzed its vulnerabilities, proposing solutions to improve its security. However, we believe important security aspects of SDN are still left uninvestigated. In this paper, we raise the concern of the possibility for an attacker to obtain knowledge about an SDN network. In particular, we introduce a novel attack, named Know Your Enemy (KYE), by means of which an attacker can gather vital information about the configuration of the network. This information ranges from the configuration of security tools, such as attack detection thresholds for network scanning, to general network policies like QoS and network virtualization. Additionally, we show that an attacker can perform a KYE attack in a stealthy fashion, i.e., without the risk of being detected. We underline that the vulnerability exploited by the KYE attack is proper of SDN and is not present in legacy networks. To address the KYE attack, we also propose an active defense countermeasure based on network flows obfuscation, which considerably increases the complexity for a successful attack. Our solution offers provable security guarantees that can be tailored to the needs of the specific network under consideration
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
