On the Road to Proactive Vulnerability Analysis and Mitigation Leveraged by Software Defined Networks: A Systematic Review

Abstract

The discovery of security vulnerabilities and their mitigation in networked systems managed by Software-Defined Networking (SDN) are fundamental for ensuring their normal operation. The main goal of this survey was to investigate the literature on preventing system security vulnerabilities instead of detecting ongoing cyber-attacks as quickly as possible. Thus, in our opinion, organizations should fortify their systems’ security by identifying and eliminating any new security vulnerabilities before they can be successfully exploited. We comprehensively discuss different vulnerability detection approaches based on important comparison parameters such as vulnerability assessment, the SDN controller used, automation capability, system risk indicators, passive scanning and active probing of system vulnerabilities. The paper also analyzes relevant literature considering the mitigation mechanisms for discovered vulnerabilities such as the proposed SDN controller, automation capability, solution adaptation to system operational changes, risk indicators, and the solution’s impact on network quality metrics like latency and throughput. Despite the strengths of the surveyed work, we have also identified promising open issues that need further consideration by scholars, industry participants, and policymakers. We concluded that the majority of analyzed literature contributions are largely reactive in their implementation against running network threats. This suggests a new research domain for applying SDN in the automatic detection of security vulnerabilities and their proactive mitigation before external cyber-attackers can exploit them.

Keywords

• System vulnerability
• assessment
• detection
• mitigation
• software defined networks
• risk evaluation