Robustness of automated intrusion responders in software-defined networks to spoofed evidence and responder starvation

Technical Summary: Robustness of Automated Intrusion Responders in Software-Defined Networks to Spoofed Evidence and Responder Starvation

Problem Statement
Automated intrusion response in Software-Defined Networks (SDN) offers the ability to install blocking rules within milliseconds of an alert. However, a critical vulnerability exists: these responders act on identifiers (e.g., source IP addresses) carried by the evidence. An adversary controlling a compromised host can forge these identifiers to direct the automated response against legitimate hosts or protected services. While previous research has addressed evasion (hiding from detection) and control-plane saturation, there is a gap in evaluating how automated responders—particularly those using Large Language Models (LLMs)—perform when an adversary intentionally triggers detection with forged evidence to cause "mitigation-induced denial of service." Furthermore, no prior work has evaluated the risk of "responder starvation," where an adversary exhausts the synthesis capacity of slow responders (like LLMs) to prevent them from mitigating genuine attacks.

Methodology
The study employs a controlled, factorial evaluation across 2,088 trace-driven closed-loop runs.

• System Model: The environment simulates an OpenFlow network with a reactive controller, a detector (XGBoost), and various responders. The adversary controls one compromised internal host and can forge the IPv4 source address (ip_src) while maintaining a real MAC address and ingress port.
• Adversary Objectives: The adversary pursues four specific goals:
  1. Collateral Induction (O1): Forging the source IP of a legitimate victim to block that victim.
  2. Protected-Service Isolation (O2): Forging the source IP of a protected service (e.g., DNS, MQTT) to disconnect it.
  3. Responder Exhaustion (O3): Rotating spoofed identities to flood the responder's queue, delaying the mitigation of a concurrent genuine DDoS attack.
  4. Oscillation (O4): Triggering rules that expire and re-trigger to sustain disruption.
• Responders Evaluated: Seven designs were tested, ranging from classic templates (port blocking, source IP shunning) to a fine-tuned LLM synthesizer (Qwen2.5-1.5B), with and without pre-deployment verification.
• Harm Metrics: The study introduces metrics for amplification (legitimate bytes lost per adversary byte), legitimate host downtime, and protected-service availability. Crucially, it attributes harm specifically to responder rules triggered by the adversary, separating this from detector false positives.
• Defenses: Four defensive mechanisms were evaluated: Provenance-aware scoping (binding rules to the physical ingress port), Evidence thresholding (requiring multiple alerts), Cost-sensitive gating (stricter rules for server addresses), and Hysteresis with rule budgets (limiting installation rates).

Key Contributions

1. Formal Threat Model: The paper defines a threat model for mitigation-induced denial of service, characterizing the adversary's controllable fields and objectives (O1–O4).
2. Harm Attribution: It proposes a method to trace lost legitimate traffic directly to the specific responder rule and incident that caused it, distinguishing adversary-induced harm from false positives.
3. Comprehensive Evaluation: It provides the first evaluation of both classic and LLM-based responders against an adversary targeting the responder itself, across six network topologies and varying budgets.
4. Defense Analysis: It quantifies the robustness and cost of four specific defenses, demonstrating how they mitigate harm and starvation.

Results

• Vulnerability of Classic Responders: Classic "block the source" responders (R2) were easily abused. In 144 of 216 runs, they blocked legitimate hosts. Under O2, protected-service availability dropped to 65.8%, and the responder destroyed up to 173.8 bytes of legitimate traffic for every byte sent by the adversary.
• LLM Responder Risks: The fine-tuned LLM (R3) was rarely fooled (7 of 216 runs) due to training on verified examples, but when it was, the impact was severe (amplification up to 66.8). More critically, the LLM was susceptible to starvation; the slow synthesis time (approx. 10s per incident) allowed the adversary to saturate the queue, resulting in a 100% residual attack rate for concurrent genuine DDoS attacks.
• Effectiveness of Defenses:
  • Pre-deployment Verification: Eliminated service isolation (O2) but did not fully stop collateral induction (O1) or starvation.
  • Provenance-Aware Scoping (D1): Successfully confined all adversary-induced harm to the adversary's own ingress port, preventing collateral damage to other hosts.
  • Rule Budgets and Hysteresis (D4): Essential for preventing starvation. While they did not speed up synthesis, they limited the rate of incident processing, allowing the system to eventually mitigate genuine attacks (reducing Time-to-Mitigate from 60s to ~22s).
  • Combined Defenses: The combination of all defenses (R5) reduced measurable harm to near zero across all objectives. The cost was a marginal increase in Time-to-Mitigate (1.08×) for genuine attacks.

Significance and Claims
The paper argues that automated responders must incorporate an explicit harm model for the evidence they act upon. It demonstrates that without specific countermeasures, automated responses can be weaponized by adversaries to deny service to legitimate users and exhaust system resources. The authors claim that:

1. Provenance-aware scoping is a necessary fail-safe to ensure that blocking rules only affect traffic entering through the specific port where the evidence was observed.
2. Pre-deployment verification is insufficient on its own to prevent starvation or all forms of collateral damage.
3. Resource management (budgets/hysteresis) is critical for slow responders (like LLMs) to prevent denial-of-service via queue exhaustion.
4. These defenses can be implemented with a low cost (approx. 1 second delay) against genuine attacks, making them viable defaults for SDN responders operating without human-in-the-loop oversight.

The study concludes that while LLMs offer promise, they introduce new attack vectors (starvation) that require specific architectural defenses beyond simple verification. The work does not claim to solve all adversarial machine learning problems but specifically addresses the unique risks of forged evidence and responder capacity in automated SDN mitigation.