Temporizadores Dinâmicos no Plano de Dados P4 para Mitigação de Ataques Furtivos de Exaustão de TCAM
Resumo
Redes Definidas por Software (SDN) separam os planos de controle e de dados, ambos recursos finitos e sujeitos a contenção. Ataques de exaustão de tabela de fluxo de baixa taxa transbordam a tabela do switch enquanto saturam o controlador, evadindo detectores volumétricos. Defesas por timeout dinâmico são maduras em OpenFlow, com decisão no controlador; no plano de dados programável P4, as defesas contra exaustão de baixa taxa ainda são poucas e não exploram a temporização dinâmica. Este artigo sistematiza a literatura relacionada em quatro dimensões (plano, perfil de ataque, mecanismo de defesa e local da decisão) e identifica uma lacuna não abordada: P4, exaustão furtiva e timeout dinâmico no plano de dados. Propomos uma arquitetura em que a gestão da tabela e a aplicação do timeout ocorrem inteiramente no plano de dados e delineamos uma metodologia de avaliação fundamentada.Referências
Alizadeh, M. et al. (2010). Data center TCP (DCTCP). In ACM SIGCOMM.
Avinash Reddy, B., Sagar Sahoo, K., and Bhuyan, M. (2025). Toward mitigation of flow table modification attacks in P4-based SDN data plane. Security and Privacy, 8:e70008.
Bahashwan, A. A. et al. (2024). HLD-DDoSDN: High and low-rates dataset-based DDoS attacks against SDN. PLOS ONE.
Cao, J., Xu, M., Li, Q., Sun, K., Yang, Y., and Zheng, J. (2017). Disrupting SDN via the data plane: A low-rate flow table overflow attack. In SecureComm.
Dai, Y., Wang, A., Guo, Y., and Chen, S. (2023). Elastically augmenting the control-path throughput in SDN to deal with internet DDoS attacks. ACM Trans. Internet Technol., 23(1):9:1–9:25.
Ertekin, E., Yiğit, B., and Alagöz, F. (2025). ATEO: Adaptive timeout & eviction orchestrator. In IEEE BlackSeaCom.
Greenberg, A. et al. (2009). VL2: A scalable and flexible data center network. In ACM SIGCOMM.
Himanshu, Saha, K., Das, P., and De, S. (2024). A network segmentation architecture for flow aggregation and DDoS mitigation in SDN using RAPID flow rules. In ICDCN, pages 232–241.
Huang, C., Zhao, C., and Liao, L. X. (2024). Flow entry timeout hopping for SDN flow table LDoS attack defense. In Intl. Conf. on Internet of Things and Cloud Computing Technology.
Humayun, U., Hamdan, M., and Marsono, M. N. (2021). Early flow table eviction impact on delay and throughput in software-defined networks. In IEEE ICCSCE.
Isyaku, B. et al. (2020). Adaptive and hybrid idle–hard timeout allocation and flow eviction mechanism considering traffic characteristics. Electronics, 9(11):1983.
Jain, L., Venkanna U., and Vollala, S. (2025). FTSheild: An intelligent framework for LOFT attack detection and mitigation with programmable data plane. Expert Syst. Appl., 265:125865.
Open Networking Foundation (2015). OpenFlow switch specification, version 1.5.1. Technical report, ONF.
Pascoal, T. A., Fonseca, I. E., and Nigam, V. (2020). Slow denial-of-service attacks on software defined networks. Computer Networks, 173:107223.
Tang, D. et al. (2024). FTODefender: An efficient flow table overflow attacks defending system in SDN. Expert Syst. Appl., 237:121460.
Wang, J. et al. (2025). FTOA-RP: A ‘group’-based flow entry replacement policy probing and flow table overflow attack method. Comput. Secur., 159:104629.
Yu, M., Xie, T., He, T., McDaniel, P., and Burke, Q. K. (2021). Flow table security in SDN: Adversarial reconnaissance and intelligent attacks. IEEE/ACM Trans. Netw., 29(6):2793–2806.
Zhao, Y. et al. (2023). P4LRU: Towards an LRU cache entirely in programmable data plane. In ACM SIGCOMM.
Avinash Reddy, B., Sagar Sahoo, K., and Bhuyan, M. (2025). Toward mitigation of flow table modification attacks in P4-based SDN data plane. Security and Privacy, 8:e70008.
Bahashwan, A. A. et al. (2024). HLD-DDoSDN: High and low-rates dataset-based DDoS attacks against SDN. PLOS ONE.
Cao, J., Xu, M., Li, Q., Sun, K., Yang, Y., and Zheng, J. (2017). Disrupting SDN via the data plane: A low-rate flow table overflow attack. In SecureComm.
Dai, Y., Wang, A., Guo, Y., and Chen, S. (2023). Elastically augmenting the control-path throughput in SDN to deal with internet DDoS attacks. ACM Trans. Internet Technol., 23(1):9:1–9:25.
Ertekin, E., Yiğit, B., and Alagöz, F. (2025). ATEO: Adaptive timeout & eviction orchestrator. In IEEE BlackSeaCom.
Greenberg, A. et al. (2009). VL2: A scalable and flexible data center network. In ACM SIGCOMM.
Himanshu, Saha, K., Das, P., and De, S. (2024). A network segmentation architecture for flow aggregation and DDoS mitigation in SDN using RAPID flow rules. In ICDCN, pages 232–241.
Huang, C., Zhao, C., and Liao, L. X. (2024). Flow entry timeout hopping for SDN flow table LDoS attack defense. In Intl. Conf. on Internet of Things and Cloud Computing Technology.
Humayun, U., Hamdan, M., and Marsono, M. N. (2021). Early flow table eviction impact on delay and throughput in software-defined networks. In IEEE ICCSCE.
Isyaku, B. et al. (2020). Adaptive and hybrid idle–hard timeout allocation and flow eviction mechanism considering traffic characteristics. Electronics, 9(11):1983.
Jain, L., Venkanna U., and Vollala, S. (2025). FTSheild: An intelligent framework for LOFT attack detection and mitigation with programmable data plane. Expert Syst. Appl., 265:125865.
Open Networking Foundation (2015). OpenFlow switch specification, version 1.5.1. Technical report, ONF.
Pascoal, T. A., Fonseca, I. E., and Nigam, V. (2020). Slow denial-of-service attacks on software defined networks. Computer Networks, 173:107223.
Tang, D. et al. (2024). FTODefender: An efficient flow table overflow attacks defending system in SDN. Expert Syst. Appl., 237:121460.
Wang, J. et al. (2025). FTOA-RP: A ‘group’-based flow entry replacement policy probing and flow table overflow attack method. Comput. Secur., 159:104629.
Yu, M., Xie, T., He, T., McDaniel, P., and Burke, Q. K. (2021). Flow table security in SDN: Adversarial reconnaissance and intelligent attacks. IEEE/ACM Trans. Netw., 29(6):2793–2806.
Zhao, Y. et al. (2023). P4LRU: Towards an LRU cache entirely in programmable data plane. In ACM SIGCOMM.
Publicado
21/10/2026
Como Citar
LEON, Ryan Borges de; DALMAZO, Bruno L..
Temporizadores Dinâmicos no Plano de Dados P4 para Mitigação de Ataques Furtivos de Exaustão de TCAM. In: ESCOLA REGIONAL DE REDES DE COMPUTADORES (ERRC), 23. , 2026, Santa Maria/RS.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 174-179.
DOI: https://doi.org/10.5753/errc.2026.36444.
