{"id":"https://openalex.org/W7163190468","doi":"https://doi.org/10.1109/tnse.2026.3699574","title":"Lightweight Yet Accurate: Detecting SDN Topology Poisoning via Traffic Pattern Correlation and Sequential Hypothesis Probing","display_name":"Lightweight Yet Accurate: Detecting SDN Topology Poisoning via Traffic Pattern Correlation and Sequential Hypothesis Probing","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7163190468","doi":"https://doi.org/10.1109/tnse.2026.3699574"},"language":null,"primary_location":{"id":"doi:10.1109/tnse.2026.3699574","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2026.3699574","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5074455169","display_name":"XJ Huang","orcid":null},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xuanbo Huang","raw_affiliation_strings":["School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0009-0006-3817-5756","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052597908","display_name":"R K Li","orcid":null},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ruiqing Li","raw_affiliation_strings":["School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137668419","display_name":"Kaiping Xue","orcid":null},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kaiping Xue","raw_affiliation_strings":["School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0003-2095-7523","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5004027189","display_name":"Lutong Chen","orcid":"https://orcid.org/0000-0001-6044-9457"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lutong Chen","raw_affiliation_strings":["Network and Information Center, University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0001-6044-9457","affiliations":[{"raw_affiliation_string":"Network and Information Center, University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137639347","display_name":"Hang Yin","orcid":null},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hang Yin","raw_affiliation_strings":["School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125134527","display_name":"Z Huang","orcid":null},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zixu Huang","raw_affiliation_strings":["School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137672596","display_name":"Zhou Su","orcid":null},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhou Su","raw_affiliation_strings":["School of Cyber Science and Engineering, Xi'an Jiaotong University, Xi'an, China"],"raw_orcid":"https://orcid.org/0000-0002-6518-3130","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Xi'an Jiaotong University, Xi'an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5007557286","display_name":"Hyundong Shin","orcid":"https://orcid.org/0000-0003-3364-8084"},"institutions":[{"id":"https://openalex.org/I35928602","display_name":"Kyung Hee University","ror":"https://ror.org/01zqcg218","country_code":"KR","type":"education","lineage":["https://openalex.org/I35928602"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Hyundong Shin","raw_affiliation_strings":["Department of Electronics and Information Convergence Engineering, Kyung Hee University, Yongin-si, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0003-3364-8084","affiliations":[{"raw_affiliation_string":"Department of Electronics and Information Convergence Engineering, Kyung Hee University, Yongin-si, Republic of Korea","institution_ids":["https://openalex.org/I35928602"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.69129663,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":null,"first_page":"9881","last_page":"9896"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9296000003814697,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9296000003814697,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.026200000196695328,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.013100000098347664,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/topology","display_name":"Topology (electrical circuits)","score":0.5580999851226807},{"id":"https://openalex.org/keywords/network-topology","display_name":"Network topology","score":0.541700005531311},{"id":"https://openalex.org/keywords/correlation","display_name":"Correlation","score":0.4652000069618225},{"id":"https://openalex.org/keywords/airfield-traffic-pattern","display_name":"Airfield traffic pattern","score":0.28600001335144043},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.27900001406669617}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6611999869346619},{"id":"https://openalex.org/C184720557","wikidata":"https://www.wikidata.org/wiki/Q7825049","display_name":"Topology (electrical circuits)","level":2,"score":0.5580999851226807},{"id":"https://openalex.org/C199845137","wikidata":"https://www.wikidata.org/wiki/Q145490","display_name":"Network topology","level":2,"score":0.541700005531311},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.47679999470710754},{"id":"https://openalex.org/C117220453","wikidata":"https://www.wikidata.org/wiki/Q5172842","display_name":"Correlation","level":2,"score":0.4652000069618225},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3711000084877014},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3621000051498413},{"id":"https://openalex.org/C204673680","wikidata":"https://www.wikidata.org/wiki/Q1628107","display_name":"Airfield traffic pattern","level":2,"score":0.28600001335144043},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.27900001406669617},{"id":"https://openalex.org/C8272713","wikidata":"https://www.wikidata.org/wiki/Q176737","display_name":"Stochastic process","level":2,"score":0.27149999141693115},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.2508000135421753}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnse.2026.3699574","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2026.3699574","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.42286956310272217,"display_name":"Zero hunger","id":"https://metadata.un.org/sdg/2"}],"awards":[{"id":"https://openalex.org/G1325088930","display_name":null,"funder_award_id":"62201540","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G211408582","display_name":null,"funder_award_id":"62302472","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2398330959","display_name":null,"funder_award_id":"62372425","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3978876333","display_name":null,"funder_award_id":"Y202093","funder_id":"https://openalex.org/F4320322847","funder_display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320322847","display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences","ror":"https://ror.org/031141b54"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Topology":[0],"poisoning":[1,50],"in":[2,195],"Software-Defined":[3],"Networking":[4],"(SDN)":[5],"enables":[6],"attackers":[7],"to":[8,127,145,175],"inject":[9],"non-existent":[10],"links":[11,79,157],"into":[12],"the":[13,82,182],"controller's":[14],"topology":[15,49],"view,":[16],"allowing":[17],"traffic":[18,83,146],"hijacking,":[19],"blackholing,":[20],"or":[21,31,87],"surveillance.":[22],"Existing":[23],"defenses":[24],"either":[25],"rely":[26],"on":[27],"verifying":[28],"controller":[29],"behavior":[30],"utilize":[32],"attack-specific":[33],"packet":[34],"inspections.":[35],"Consequently,":[36],"such":[37],"methods":[38],"have":[39],"high":[40],"overhead":[41,118],"and":[42,112,124,158,192],"provide":[43],"limited":[44],"detection":[45,60,169,177],"efficacy":[46],"against":[47,62],"diverse":[48],"attacks":[51],"(TPAs).":[52],"In":[53],"this":[54],"paper,":[55],"we":[56,97,102,137],"introduce":[57],"a":[58,121,128,139],"traffic-pattern-based":[59],"scheme":[61,184],"in-band":[63,70],"TPAs.":[64],"The":[65,165],"key":[66],"insight":[67],"is":[68],"that":[69,131,162,181],"TPAs":[71],"must":[72],"reuse":[73],"existing":[74],"physical":[75,90,105,160],"links,":[76],"so":[77],"fake":[78],"inevitably":[80],"shadow":[81],"characteristics":[84,147],"of":[85,155],"one":[86],"more":[88,186],"underlying":[89],"paths.":[91],"To":[92],"capture":[93],"these":[94],"shadowed":[95],"characteristics,":[96],"develop":[98],"two":[99],"techniques.":[100],"First,":[101],"identify":[103],"candidate":[104],"paths":[106,161],"for":[107],"each":[108],"newly":[109],"reported":[110],"link":[111],"select":[113],"observation":[114],"points":[115],"with":[116],"minimal":[117],"by":[119],"formulating":[120],"hitting-set":[122],"problem":[123,130],"reducing":[125],"it":[126],"minimum-cut":[129],"can":[132],"be":[133],"solved":[134],"efficiently.":[135],"Second,":[136],"apply":[138],"sequential":[140],"probability":[141],"ratio":[142],"test":[143],"(SPRT)":[144],"derived":[148],"from":[149],"link-load":[150],"time":[151],"series,i.e.,Pearson":[152],"correlation":[153],"coefficients":[154],"suspicious":[156],"potential":[159],"support":[163],"them.":[164],"SPRT":[166],"provides":[167],"targeted":[168],"confidence":[170],"while":[171,198],"enabling":[172],"early":[173],"termination":[174],"reduce":[176],"overhead.":[178,201],"Experiments":[179],"demonstrate":[180],"proposed":[183],"achieves":[185],"than":[187],"98.8%":[188],"accuracy,":[189],"recall,":[190],"precision,":[191],"F1":[193],"score":[194],"high-noise":[196],"environments":[197],"maintaining":[199],"low":[200]},"counts_by_year":[],"updated_date":"2026-06-18T08:10:14.011955","created_date":"2026-06-03T00:00:00"}