{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T16:21:58Z","timestamp":1772727718803,"version":"3.50.1"},"reference-count":31,"publisher":"Wiley","license":[{"start":{"date-parts":[[2020,11,21]],"date-time":"2020-11-21T00:00:00Z","timestamp":1605916800000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100004874","name":"Chung-Shan Institute of Science and Technology","doi-asserted-by":"publisher","award":["NCSIST-ADV-V101 (108)"],"award-info":[{"award-number":["NCSIST-ADV-V101 (108)"]}],"id":[{"id":"10.13039\/501100004874","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004874","name":"Chung-Shan Institute of Science and Technology","doi-asserted-by":"publisher","award":["108-2221-E-008-033-MY3"],"award-info":[{"award-number":["108-2221-E-008-033-MY3"]}],"id":[{"id":"10.13039\/501100004874","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002855","name":"Ministry of Science and Technology of the People's Republic of China","doi-asserted-by":"publisher","award":["NCSIST-ADV-V101 (108)"],"award-info":[{"award-number":["NCSIST-ADV-V101 (108)"]}],"id":[{"id":"10.13039\/501100002855","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002855","name":"Ministry of Science and Technology of the People's Republic of China","doi-asserted-by":"publisher","award":["108-2221-E-008-033-MY3"],"award-info":[{"award-number":["108-2221-E-008-033-MY3"]}],"id":[{"id":"10.13039\/501100002855","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Wireless Communications and Mobile Computing"],"published-print":{"date-parts":[[2020,11,21]]},"abstract":"<jats:p>Software-defined networking controllers use the OpenFlow discovery protocol (OFDP) to collect network topology status. The OFDP detects the link between switches by generating link layer discovery protocol (LLDP) packets. However, OFDP is not a security protocol. Attackers can use it to perform topology discovery via injection, man-in-the-middle, and flooding attacks to confuse the network topology. This study proposes a correlation-based topology anomaly detection mechanism. Spearman\u2019s rank correlation is used to analyze the network traffic between links and measure the round-trip time of each LLDP frame to determine whether a topology discovery via man-in-the-middle attack exists. This study also adds a dynamic authentication key and counting mechanism in the LLDP frame to prevent attackers from using topology discovery via injection attack to generate fake links and topology discovery via flooding attack to cause network routing or switching abnormalities.<\/jats:p>","DOI":"10.1155\/2020\/8898949","type":"journal-article","created":{"date-parts":[[2020,11,21]],"date-time":"2020-11-21T22:35:05Z","timestamp":1605998105000},"page":"1-16","source":"Crossref","is-referenced-by-count":10,"title":["Behavior Anomaly Detection in SDN Control Plane: A Case Study of Topology Discovery Attacks"],"prefix":"10.1155","volume":"2020","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2044-3119","authenticated-orcid":true,"given":"Li-Der","family":"Chou","sequence":"first","affiliation":[{"name":"Department of Computer Science and Information Engineering, National Central University, Taoyuan 32001, Taiwan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2131-1855","authenticated-orcid":true,"given":"Chien-Chang","family":"Liu","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Information Engineering, National Central University, Taoyuan 32001, Taiwan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4508-0767","authenticated-orcid":true,"given":"Meng-Sheng","family":"Lai","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Information Engineering, National Central University, Taoyuan 32001, Taiwan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4074-1199","authenticated-orcid":true,"given":"Kai-Cheng","family":"Chiu","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Information Engineering, National Central University, Taoyuan 32001, Taiwan"}]},{"given":"Hsuan-Hao","family":"Tu","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Information Engineering, National Central University, Taoyuan 32001, Taiwan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4266-7527","authenticated-orcid":true,"given":"Sen","family":"Su","sequence":"additional","affiliation":[{"name":"Information & Communication Research Division, National Chung-Shan Institute of Science and Technology, Taoyuan 32546, Taiwan"}]},{"given":"Chun-Lin","family":"Lai","sequence":"additional","affiliation":[{"name":"Information & Communication Research Division, National Chung-Shan Institute of Science and Technology, Taoyuan 32546, Taiwan"}]},{"given":"Chia-Kuan","family":"Yen","sequence":"additional","affiliation":[{"name":"Information & Communication Research Division, National Chung-Shan Institute of Science and Technology, Taoyuan 32546, Taiwan"}]},{"given":"Wei-Hsiang","family":"Tsai","sequence":"additional","affiliation":[{"name":"Information & Communication Research Division, National Chung-Shan Institute of Science and Technology, Taoyuan 32546, Taiwan"}]}],"member":"311","reference":[{"key":"1","article-title":"Software-defined networking \u2013 Wikipedia"},{"key":"2","article-title":"Link layer discovery protocol - Wikipedia"},{"key":"3","article-title":"OpenFlowDiscoveryProtocol - GENI: geni"},{"key":"4","author":"Ryu SDN framework"},{"key":"5","article-title":"Project Floodlight - GitHub"},{"key":"6","article-title":"Home - OpenDaylight"},{"key":"7","article-title":"GitHub - brandonheller\/riplpox: RipL-POX (Ripcord-Lite for POX): a simple network controller for OpenFlow-based data centers"},{"key":"8","volume-title":"Introduction to Measurement Theory","author":"M. J. Allen","year":"2001"},{"key":"9","article-title":"P4, [Online]"},{"key":"10","article-title":"Stratum \u2013 open networking foundation"},{"key":"11","article-title":"Open network operating system (ONOS) SDN controller for SDN_NFV solutions"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.1145\/1355734.1355746"},{"key":"13","first-page":"24","article-title":"Advanced study of SDN\/OpenFlow controllers","author":"A. Shalimov"},{"key":"14","first-page":"4","article-title":"Fingerprinting OpenFlow Controllerscontrollers: The the First first Step step to Attack attack an SDN Control control Planeplane","author":"A. Azzouni"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1155\/2018\/2459154"},{"key":"16","doi-asserted-by":"publisher","DOI":"10.1109\/TCOM.1980.1094702"},{"key":"17","doi-asserted-by":"publisher","DOI":"10.5120\/207-348"},{"key":"18","doi-asserted-by":"publisher","DOI":"10.1145\/2491185.2491222"},{"key":"19","doi-asserted-by":"publisher","DOI":"10.1109\/ICOIN.2017.7899515"},{"key":"20","volume-title":"Poisoning network visibility in software-defined networks: new attacks and countermeasures","author":"S. Hong","year":"2015"},{"key":"21","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2015.7366363"},{"key":"22","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN.2017.8038435"},{"key":"23","article-title":"sOFTDP: secure and efficient topology discovery protocol for SDN","author":"A. Azzouni","year":"2017"},{"key":"24","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2018.12.014"},{"key":"25","doi-asserted-by":"publisher","DOI":"10.1177\/875647939000600106"},{"key":"26","doi-asserted-by":"crossref","DOI":"10.1002\/0471667196.ess5050.pub2","article-title":"Spearman correlation coefficients, differences between","volume":"12","author":"L. Myers","year":"2006","journal-title":"Encyclopedia of Statistical Sciences Sonography"},{"key":"27","article-title":"Informal identification of outliers in medical data","author":"J. Laurikkala"},{"key":"28","first-page":"951","article-title":"Getting traffic statistics from network devices in an SDN environment using OpenFlow","author":"D. J. Hamad"},{"key":"29","doi-asserted-by":"publisher","DOI":"10.1109\/RoEduNet.2015.7311819"},{"key":"30","article-title":"GitHub - the-tcpdump-group\/tcpdump: the TCPdump network dissector"},{"key":"31","article-title":"GitHub - appneta\/tcpreplay:Pcap editing and replay tools for \u2217NIX and Windows - Users please download source from"}],"container-title":["Wireless Communications and Mobile Computing"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/wcmc\/2020\/8898949.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/wcmc\/2020\/8898949.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/wcmc\/2020\/8898949.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,2,23]],"date-time":"2021-02-23T11:57:23Z","timestamp":1614081443000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.hindawi.com\/journals\/wcmc\/2020\/8898949\/"}},"subtitle":[],"editor":[{"given":"Juraj","family":"Gazda","sequence":"additional","affiliation":[]}],"short-title":[],"issued":{"date-parts":[[2020,11,21]]},"references-count":31,"alternative-id":["8898949","8898949"],"URL":"https:\/\/doi.org\/10.1155\/2020\/8898949","relation":{},"ISSN":["1530-8677","1530-8669"],"issn-type":[{"value":"1530-8677","type":"electronic"},{"value":"1530-8669","type":"print"}],"subject":[],"published":{"date-parts":[[2020,11,21]]}}}