Towards Saturation Attack Detection in SDN: A Device Hyperedge Graph and Flow-Device Hypergraph Neural Network-Based Method
摘要
Software-Defined Networking (SDN) separates the control and data planes, providing network programmability to enhance network flexibility. However, this separation architecture also makes SDN vulnerable to the saturation attack. Existing GNN-based saturation attack detection methods exhibit limitations in modeling the relationship among network traffic flows. A Hypergraph provides a novel way to model the complex relationships between network traffic flows. However, Hypergraph Neural Networks (HGNN) may lose cross-hyperedge information by simply gathering flow node features as hyperedge features. To overcome the above limitations, this work proposes HINT, a HGNN-based saturation attacks detection method. HINT designs a new hypergraph, the device hyperedge-based hypergraph (DH-Graph), where nodes denote network traffic flows and hyperedges represent network devices. Furthermore, HINT proposes a novel flow-device hypergraph neural network, FlwDev-HGNN, that combines the flow-level node learning and device-level hyperedge learning to detect the saturation attacks in SDN. FlwDev-HGNN consists of three modules: (1) a flow-level node learning module to capture both high-order relationships among flows and relationships among flows and devices, (2) a device-level hyperedge learning module to capture the relationships between devices and learn the representations of devices, (3) a flow-device joint training and detection module. The evaluation results demonstrate the detection effectiveness of HINT, achieving a detection accuracy exceeding 97%.