Minimizing Interruptions in Flow Redirection to Mitigate Link Flooding Attacks in SDN-Based Datacenters

Link congestion resulting from routine traffic patterns or malicious link flooding attacks (LFAs) poses a significant challenge in datacenter environments. The growing adoption of software-defined networking (SDN) offers a flexible framework for dynamic network reconfiguration, making it a promising approach for mitigating LFAs. Traffic redirection in SDN can follow either the shortest alternative path or a path that minimizes the number of rule modifications. The shortest alternative path sometimes yields a high number of changes in rules. As SDN switches are constrained by limited rule storage, a high number of rules may result in slow processing of the packet forwarding. Excessive rule updates can also degrade performance and introduce interruptions while the rules are being updated. This study focuses on minimizing rule changes when rerouting traffic away from congested links. We formulate two optimization problems aimed at reducing rule modifications during redirection. The first addresses a congested link and a specific flow, for which we propose solutions based on Dijkstra’s algorithm. The second extends to scenarios involving multiple congested links, introducing flow grouping and enhanced rule-merging strategies. To validate our approach, we conduct comprehensive simulations and real-world experiments within a datacenter setting.