Heimdallr: Fingerprinting SD-WAN Control-Plane Architecture via Encrypted Control Traffic
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866914102707748864 |
|---|---|
| author | Seo, Minjae Kim, Jaehan Marin, Eduard You, Myoungsung Park, Taejune Lee, Seungsoo Shin, Seungwon Kim, Jinwoo |
| author_facet | Seo, Minjae Kim, Jaehan Marin, Eduard You, Myoungsung Park, Taejune Lee, Seungsoo Shin, Seungwon Kim, Jinwoo |
| contents | Software-defined wide area network (SD-WAN) has emerged as a new paradigm for steering a large-scale network flexibly by adopting distributed software-defined network (SDN) controllers. The key to building a logically centralized but physically distributed control-plane is running diverse cluster management protocols to achieve consistency through an exchange of control traffic. Meanwhile, we observe that the control traffic exposes unique time-series patterns and directional relationships due to the operational structure even though the traffic is encrypted, and this pattern can disclose confidential information such as control-plane topology and protocol dependencies, which can be exploited for severe attacks. With this insight, we propose a new SD-WAN fingerprinting system, called Heimdallr. It analyzes periodical and operational patterns of SD-WAN cluster management protocols and the context of flow directions from the collected control traffic utilizing a deep learning-based approach, so that it can classify the cluster management protocols automatically from miscellaneous control traffic datasets. Our evaluation, which is performed in a realistic SD-WAN environment consisting of geographically distant three campus networks and one enterprise network shows that Heimdallr can classify SD-WAN control traffic with $\geq$ 93%, identify individual protocols with $\geq$ 80% macro F-1 scores, and finally can infer control-plane topology with $\geq$ 70% similarity. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2510_16461 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Heimdallr: Fingerprinting SD-WAN Control-Plane Architecture via Encrypted Control Traffic Seo, Minjae Kim, Jaehan Marin, Eduard You, Myoungsung Park, Taejune Lee, Seungsoo Shin, Seungwon Kim, Jinwoo Cryptography and Security Networking and Internet Architecture Software-defined wide area network (SD-WAN) has emerged as a new paradigm for steering a large-scale network flexibly by adopting distributed software-defined network (SDN) controllers. The key to building a logically centralized but physically distributed control-plane is running diverse cluster management protocols to achieve consistency through an exchange of control traffic. Meanwhile, we observe that the control traffic exposes unique time-series patterns and directional relationships due to the operational structure even though the traffic is encrypted, and this pattern can disclose confidential information such as control-plane topology and protocol dependencies, which can be exploited for severe attacks. With this insight, we propose a new SD-WAN fingerprinting system, called Heimdallr. It analyzes periodical and operational patterns of SD-WAN cluster management protocols and the context of flow directions from the collected control traffic utilizing a deep learning-based approach, so that it can classify the cluster management protocols automatically from miscellaneous control traffic datasets. Our evaluation, which is performed in a realistic SD-WAN environment consisting of geographically distant three campus networks and one enterprise network shows that Heimdallr can classify SD-WAN control traffic with $\geq$ 93%, identify individual protocols with $\geq$ 80% macro F-1 scores, and finally can infer control-plane topology with $\geq$ 70% similarity. |
| title | Heimdallr: Fingerprinting SD-WAN Control-Plane Architecture via Encrypted Control Traffic |
| topic | Cryptography and Security Networking and Internet Architecture |
| url | https://arxiv.org/abs/2510.16461 |