Lightweight yet Accurate: Detecting SDN Topology Poisoning via Traffic Pattern Correlation and Sequential Hypothesis Probing

Topology poisoning in Software-Defined Networking (SDN) enables attackers to inject non-existent links into the controller's topology view, allowing traffic hijacking, blackholing, or surveillance. Existing defenses either rely on verifying controller behavior or utilize attack-specific packet inspections. Consequently, such methods have high overhead and provide limited detection efficacy against diverse topology poisoning attacks (TPAs). In this paper, we introduce a traffic-pattern-based detection scheme against in-band TPAs. The key insight is that in-band TPAs must reuse existing physical links, so fake links inevitably shadow the traffic characteristics of one or more underlying physical paths. To capture these shadowed characteristics, we develop two techniques. First, we identify candidate physical paths for each newly reported link and select observation points with minimal overhead by formulating a hitting-set problem and reducing it to a minimum-cut problem that can be solved efficiently. Second, we apply a sequential probability ratio test (SPRT) to traffic characteristics derived from link-load time series, i.e., Pearson correlation coefficients of suspicious links and potential physical paths that support them. The SPRT provides targeted detection confidence while enabling early termination to reduce detection overhead. Experiments demonstrate that the proposed scheme achieves more than 98.8% accuracy, recall, precision, and F1 score in high-noise environments while maintaining low overhead.