Behavior Anomaly Detection in SDN Control Plane: A Case Study of Topology Discovery Attacks

Figure 3

(a) Topology discovery via injection attack. The attacker fabricates the LLDP packet and injects a fake link. (b) Topology discovery via man-in-the-middle attack. Attacker 1 eavesdrops the LLDP packet and transmits it to Attacker 2 to add a fake link between them.

(a)

(b)