Heimdallr: Fingerprinting SD-WAN Control-Plane Architecture via Encrypted Control Traffic

TL;DR

This work addresses the risk that encrypted SD-WAN control-plane traffic leaks confidential topology and protocol dependencies. It introduces Heimdallr, a three-phase deep-learning fingerprinting system that leverages time-series and multi-directional features to (i) classify SD-WAN control traffic, (ii) identify cluster-management protocols, and (iii) infer node roles to reconstruct the control-plane topology. In a realistic four-site testbed, Heimdallr achieves $\geq 93\%$ control-traffic classification, $\geq 80\%$ macro F1 for protocol classes, and $\geq 70\%$ topology similarity, with demonstrated robustness to defense mechanisms and efficient role inference. The results underscore practical privacy risks in SD-WAN deployments and motivate mitigations such as multi-path routing and traffic obfuscation, as well as the need for automated evaluation environments.

Abstract

Software-defined wide area network (SD-WAN) has emerged as a new paradigm for steering a large-scale network flexibly by adopting distributed software-defined network (SDN) controllers. The key to building a logically centralized but physically distributed control-plane is running diverse cluster management protocols to achieve consistency through an exchange of control traffic. Meanwhile, we observe that the control traffic exposes unique time-series patterns and directional relationships due to the operational structure even though the traffic is encrypted, and this pattern can disclose confidential information such as control-plane topology and protocol dependencies, which can be exploited for severe attacks. With this insight, we propose a new SD-WAN fingerprinting system, called Heimdallr. It analyzes periodical and operational patterns of SD-WAN cluster management protocols and the context of flow directions from the collected control traffic utilizing a deep learning-based approach, so that it can classify the cluster management protocols automatically from miscellaneous control traffic datasets. Our evaluation, which is performed in a realistic SD-WAN environment consisting of geographically distant three campus networks and one enterprise network shows that Heimdallr can classify SD-WAN control traffic with $\geq$ 93%, identify individual protocols with $\geq$ 80% macro F-1 scores, and finally can infer control-plane topology with $\geq$ 70% similarity.

Figures (14)

• Figure 1: Distributed SDN controllers for SD-WAN.
• Figure 2: An example of control-plane topology in SD-WAN.
• Figure 3: Heimdallr system overview and its workflow that consists of three phases: SD-WAN Control Traffic Classification, Protocol Classification, and Role Inference.
• Figure 4: Examples to illustrate the insight to determine multi-directional relationships among storages-storages and controllers-switches.
• Figure 5: Examples of flow patterns for different roles.