SDN-SYN PoW: Intent-Aware Adaptive SDN Defense with PoW Against multi-domain SYN Floods

This paper presents SDN-SYN PoW, an adaptive defense architecture that leverages a Software-Defined Networking controller to dynamically adjust non-interactive Proof-of-Work difficulty based on real-time traffic analysis, effectively mitigating multi-domain SYN floods while maintaining negligible overhead for legitimate clients.

The Gist

Imagine the internet is a massive, bustling city, and your favorite online store is a popular bakery. Everyone wants a fresh loaf of bread (a connection to the server).

The Problem: The "Fake Customer" Mob

Usually, the bakery has a simple rule: "If you want bread, raise your hand (send a SYN packet), and I'll give you a ticket (SYN-ACK) so you can wait in line."

But hackers have found a way to break this. They send thousands of people to the bakery, but these people are liars. They raise their hands, but when the baker tries to give them a ticket, the liars vanish or pretend to be someone else.

• The Old Fix (SYN Cookies): The baker tries to be smart by writing the ticket on a sticky note and handing it back immediately. But the problem is, the baker still has to walk to the door and hand out that note for every single fake hand. This exhausts the baker's energy and blocks the door, so real customers can't get in. The bakery gets clogged with traffic, not just fake people, but the baker's own attempts to help.

The New Solution: SDN-SYN PoW

This paper introduces a new system called SDN-SYN PoW. Think of it as a combination of a Super-Intelligent City Traffic Cop and a Magic Riddle.

Here is how it works, step-by-step:

1. The "Magic Riddle" (Proof-of-Work)

Instead of just raising a hand, anyone who wants to enter the bakery must first solve a tiny, quick math puzzle (a "Proof-of-Work").

• For a real customer: Solving the puzzle takes a split second. It's like checking a QR code. No big deal.
• For a hacker: They are trying to send 10,000 fake requests a second. To solve the puzzle 10,000 times, they would need a supercomputer. It becomes too expensive and slow for them to keep up. They get tired and give up.

2. The "Super-Intelligent Traffic Cop" (The SDN Controller)

In the old days, the bakery had to check every single person at the door. In this new system, the city has a central control room (the SDN Controller) that watches the entire city's traffic flow in real-time.

• Global Vision: The Cop sees that a specific neighborhood (a specific IP address) is suddenly sending a mob of fake customers.
• Adaptive Action: Instead of making everyone solve a hard puzzle, the Cop instantly changes the rules only for that specific neighborhood.
  • Normal Neighborhoods: "Hey, just solve the easy puzzle (d=0)."
  • The Attacking Neighborhood: "Whoa, you guys are spamming! Now you must solve a very hard puzzle (d=24) before you can even get close to the door."

3. The "Edge Guard" (The Switch)

The Cop sends a message to the guard at the entrance of that specific neighborhood.

• If a person from that neighborhood tries to enter without solving the hard puzzle, the guard instantly kicks them out before they even reach the bakery.
• The bakery never even sees the fake customers. The baker's energy is saved, and the door stays open for real customers.

Why is this better?

• No "Echo" Effect: The old method (SYN Cookies) made the baker run back and forth, making the traffic worse. This new method stops the fake traffic before it reaches the baker.
• Fairness: Real customers in other neighborhoods aren't slowed down. Only the troublemakers get the "hard mode" treatment.
• Low Power: Even if a real customer in the trouble neighborhood has to solve a harder puzzle, their phone or laptop can do it easily. It's like doing a quick math problem on a calculator. It takes a tiny fraction of a second.

The Result

The paper tested this in a real-world simulation.

• Without the system: The bakery was overwhelmed, and no one could get bread.
• With the old system (SYN Cookies): The bakery was still overwhelmed because the baker was too busy handing out tickets to fake people.
• With SDN-SYN PoW: The fake mob was stopped at the neighborhood gate. The real customers got their bread, and the bakery stayed calm and happy.

In short: This paper proposes a smart, automated security system that identifies troublemakers at the city level, forces only them to do extra work, and stops them before they can clog up the main road. It's like having a bouncer who knows exactly who the troublemakers are and only checks their ID, while letting everyone else walk right in.

Technical Summary

Here is a detailed technical summary of the paper "SDN-SYN PoW: Intent-Aware Adaptive SDN Defense with PoW Against multi-domain SYN Floods" by Wenyang Jia.

1. Problem Statement

The paper addresses the escalating threat of volumetric TCP SYN flood attacks, which have evolved from exhausting server state to saturating network bandwidth (reaching Tbps scales).

• Limitations of Existing Defenses: Traditional defenses like SYN Cookies fail under modern high-volume attacks. While SYN Cookies prevent server state exhaustion by encoding connection state in the SYN-ACK, they still require the server to transmit a SYN-ACK for every incoming SYN. In a volumetric attack, this response traffic amplifies congestion, depleting victim bandwidth and often worsening service for legitimate users.
• The Gap: There is a need for a defense mechanism that shifts the computational burden to the attacker, operates proactively deep within the network (before traffic reaches the victim), and adapts dynamically to attack intensity without penalizing legitimate low-power devices.

2. Methodology: SDN-SYN PoW

The authors propose SDN-SYN PoW, a hybrid architecture combining non-interactive Proof-of-Work (PoW) with a Software-Defined Networking (SDN) control plane.

Core Architecture

• Non-Interactive PoW: Unlike interactive challenge-response puzzles, the PoW is embedded directly into the initial TCP SYN packet. The client must find a nonce such that the hash of specific header fields (Source/Dest IP, Ports, Nonce) meets a difficulty target (leading zero bits).
• SDN Controller as the "Nervous System": The centralized SDN controller maintains a global view of network traffic. It monitors real-time SYN rates per source prefix and dynamically adjusts the PoW difficulty ($d$).
• Adaptive Policy Enforcement:
  • Peacetime: A low default difficulty ($d_{default} \approx 0$ or $1$) is applied globally, imposing negligible overhead on legitimate users.
  • Attack Detection: When the controller detects a SYN flood from a specific source prefix ($S$), it pushes a flow rule to the ingress switch. This rule forces traffic from $S$ to solve a high-difficulty puzzle ($d_{attack}$, e.g., $d=24$).
  • Edge Filtering: Switches verify the PoW at the network edge. Invalid SYNs are dropped immediately, preventing them from consuming bandwidth or reaching the core network/server.

Implementation Details

• Nonce Encoding: The nonce is encoded in the TCP Acknowledgment Number field (unused in SYN packets) to maintain TCP standard compliance.
• Hashing: Uses a fast hash function (SuperFastHash in the prototype, recommending SHA-256 for production) to ensure line-rate verification.
• Algorithm: The controller uses a feedback loop (Algorithm 1) to adjust difficulty based on traffic rates, ensuring the attack is throttled (targeting >95% drop rate) while keeping connection latency within a budget for legitimate devices.

3. Key Contributions

1. Adaptive, Prefix-Scoped Control: The system moves beyond static defenses by using the SDN controller to sense global anomalies and apply localized, high-difficulty PoW policies only to malicious source regions.
2. Bandwidth-Preserving Verification: By dropping invalid SYNs at the edge before they reach the server, the system avoids the "SYN-ACK amplification" inherent in SYN Cookies, preserving victim bandwidth.
3. Low-Power Friendliness: The design includes an analytic model for latency and CPU usage. It ensures that even under elevated difficulty, the overhead remains manageable for legitimate clients (including IoT and mobile devices) through policy caps and reuse-based mitigations.

4. Experimental Results

The authors validated the system on a physical SDN testbed with a multi-homed topology, comparing SDN-SYN PoW against SYN Cookies, Static PoW, and No Defense.

• Baseline Performance: Legitimate traffic (no attack) showed negligible overhead for both SYN Cookies and SDN-SYN PoW (<2% degradation).
• Unmitigated Threat: High-volume C-based floods caused complete Denial of Service (DoS) for co-located clients and severe throughput collapse for remote clients.
• SYN Cookies Failure: Under high-volume spoofed floods, SYN Cookies resulted in negative efficacy for remote clients. The server's transmission of SYN-ACKs amplified congestion, further degrading service.
• SDN-SYN PoW Success:
  • Targeted Mitigation: When an attack originated from LAN C, the SDN controller raised the difficulty for LAN C.
  • Restoration of Service: Legitimate clients in LAN C saw their throughput restored from zero to functional levels because invalid attack packets were dropped at the edge.
  • Global Protection: Clients in LAN A and B (remote from the attack) also recovered to near-baseline performance because the core network and server were shielded from the flood.
• Overhead Analysis: Even at high difficulty ($d=24$), the extra handshake time for a mid-range phone was ~0.34s, and for a laptop ~0.08s. While IoT devices faced higher relative costs, the trade-off was deemed acceptable given the alternative of total service unavailability.

5. Significance

• Paradigm Shift: The paper demonstrates that moving from server-side state management (SYN Cookies) to network-edge, intent-aware filtering is critical for modern volumetric attacks.
• Scalability: By leveraging SDN's global view, the defense can surgically apply computational costs only where needed, avoiding the "one-size-fits-all" penalty of static PoW.
• Resilience: The system effectively neutralizes the bandwidth exhaustion vector of SYN floods, a vulnerability that traditional defenses exacerbate.
• Future Outlook: While challenges in large-scale deployment (e.g., hash function standardization, IoT compatibility) remain, SDN-SYN PoW establishes a robust framework for the next generation of resilient network defenses, particularly in SD-WAN environments.