Developing a systematic understanding of the attack surface of emergent networks, such as software defined networks (SDNs), is necessary and arguably the starting point toward making it more secure. Prior studies have largely relied on ad-hoc empirical methods to evaluate the security of various SDN elements from different perspectives. However, they have stopped short of converging on a systematic methodology or developing automated systems to rigorously test for security flaws in SDNs. Thus conducting security assessment of new SDN software remains a non-replicable and unregimented process. This paper makes the case for automating and standardizing the vulnerability identification process in SDNs. As a first step, we develop a penetration testing tool, POSEIDON, that reinstantiates published SDN attacks in diverse test environments. Furthermore, we enhance our tool with a fuzzing module to potentially detect other unknown vulnerabilities. In our evaluation, POSEIDON successfully reproduced 20 known attack scenarios, across diverse SDN controller environments, and also discovered 7 novel SDN application mislead attacks.
컨트롤플레인과 데이터플레인을 분리하여 기존 네트워크 환경과는 다르게 좀더 유연한 네트워크관리를 위한 소프트웨어 저의 네트워크 패러다임에서 발생할 수 있는 보안이슈 점검에 대한 필요성이 대두되고 있따. 본 학위논문에서는 소프트웨어 정의 네트워크 환경에서 발생할 수 있는 공격 및 취약점들을 컨트롤 메시지에 따라 체계적으로 분류하고 자동화하여 테스트해주는 프레임워크를 제안한다. 또한 알려진 공적 및 취약점 뿐 아니라 퍼징기술을 이용한 알려지지 않은 취약점 까지도 찾는 기회를 제공하고자 한다.
