Heimdallr: Fingerprinting SD-WAN Control-Plane Architecture via Encrypted Control Traffic

• URL: http://arxiv.org/abs/2510.16461v1
• Date: Sat, 18 Oct 2025 12:01:51 GMT
• Title: Heimdallr: Fingerprinting SD-WAN Control-Plane Architecture via Encrypted Control Traffic
• Abstract summary: Software-defined wide area network (SD-WAN) has emerged as a new paradigm for steering a large-scale network flexibly.<n>We propose a new SD-WAN fingerprinting system, called Heimdallr.<n>It analyzes periodical and operational patterns of SD-WAN cluster management protocols.
• Score: 16.693147759883534
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Software-defined wide area network (SD-WAN) has emerged as a new paradigm for steering a large-scale network flexibly by adopting distributed software-defined network (SDN) controllers. The key to building a logically centralized but physically distributed control-plane is running diverse cluster management protocols to achieve consistency through an exchange of control traffic. Meanwhile, we observe that the control traffic exposes unique time-series patterns and directional relationships due to the operational structure even though the traffic is encrypted, and this pattern can disclose confidential information such as control-plane topology and protocol dependencies, which can be exploited for severe attacks. With this insight, we propose a new SD-WAN fingerprinting system, called Heimdallr. It analyzes periodical and operational patterns of SD-WAN cluster management protocols and the context of flow directions from the collected control traffic utilizing a deep learning-based approach, so that it can classify the cluster management protocols automatically from miscellaneous control traffic datasets. Our evaluation, which is performed in a realistic SD-WAN environment consisting of geographically distant three campus networks and one enterprise network shows that Heimdallr can classify SD-WAN control traffic with $\geq$ 93%, identify individual protocols with $\geq$ 80% macro F-1 scores, and finally can infer control-plane topology with $\geq$ 70% similarity.

Related papers

• AI-Native Network Controller: A Modular Framework for Safe Agentic Control of Multi-Domain Network Infrastructure [0.4061135251278187]
  We present the AI-Native Network Controller (AI-NNC), an open-source and modular framework that enables agentic AI control across diverse network domains.<n>The framework is designed around a protocol-agnostic architecture in which each physical device is integrated through a lightweight Python adapter.
  arXiv  Detail & Related papers  (2026-04-20T21:09:30Z)
• Telecom World Models: Unifying Digital Twins, Foundation Models, and Predictive Planning for 6G [60.29349053952935]
  We introduce the Telecom World Model(TWM) concept, an architecture for learned, action-conditioned, uncertainty-aware modeling of telecom system dynamics.<n>We propose a three-layer architecture, comprising a field world model for spatial environment prediction, a control/dynamics world model for action-conditioned Key Performance Indicator (KPI) trajectory prediction, and a telecom foundation model layer for intent translation and orchestration.
  arXiv  Detail & Related papers  (2026-04-08T09:41:58Z)
• Wireless Traffic Prediction with Large Language Model [54.07581399989292]
  TIDES is a novel framework that captures spatial-temporal correlations for wireless traffic prediction.<n> TIDES achieves efficient adaptation to domain-specific patterns without incurring excessive training overhead.<n>Our results indicate that integrating spatial awareness into LLM-based predictors is the key to unlocking scalable and intelligent network management in future 6G systems.
  arXiv  Detail & Related papers  (2025-12-19T04:47:40Z)
• Proactive DDoS Detection and Mitigation in Decentralized Software-Defined Networking via Port-Level Monitoring and Zero-Training Large Language Models [3.6260109722491465]
  Software-Defined Networking (cSDN) offers flexible and programmable control of networks but suffers from scalability and reliability issues.<n>Decentralized SDN (dSDN) Distributed alleviates these concerns by distributing control across multiple local controllers.<n>This architecture remains highly vulnerable to Denial-of-Service (DDoS) attacks.<n>We propose a novel detection and mitigation framework tailored for dSDN environments.
  arXiv  Detail & Related papers  (2025-11-01T08:57:29Z)
• Power Grid Control with Graph-Based Distributed Reinforcement Learning [60.49805771047161]
  This work advances a graph-based distributed reinforcement learning framework for real-time, scalable grid management.<n>A Graph Neural Network (GNN) is employed to encode the network's topological information within the single low-level agent's observation.<n>Experiments on the Grid2Op simulation environment show the effectiveness of the approach.
  arXiv  Detail & Related papers  (2025-09-02T22:17:25Z)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification [59.96233305733875]
  Classifying traffic is essential for detecting security threats and optimizing network management.<n>We propose a Multi-Instance Encrypted Traffic Transformer (MIETT) to capture both token-level and packet-level relationships.<n>MIETT achieves results across five datasets, demonstrating its effectiveness in classifying encrypted traffic and understanding complex network behaviors.
  arXiv  Detail & Related papers  (2024-12-19T12:52:53Z)
• ZT-SDN: An ML-powered Zero-Trust Architecture for Software-Defined Networks [11.854542093255779]
  We propose ZT-SDN, an automated framework for learning and enforcing network access control in Software-Defined Networks. ZT-SDN collects data from the underlying network and models the network "transactions" performed by communicating entities as graphs. It uses novel unsupervised learning approaches to extract transaction patterns directly from the network data, such as the allowed protocol stacks and port numbers. We show the framework's efficacy in detecting abnormal network accesses and abuses of permitted flows in changing network conditions with real network datasets.
  arXiv  Detail & Related papers  (2024-11-22T15:49:27Z)
• Communication-Control Codesign for Large-Scale Wireless Networked Control Systems [80.30532872347668]
  Wireless Networked Control Systems (WNCSs) are essential to Industry 4.0, enabling flexible control in applications, such as drone swarms and autonomous robots. We propose a practical WNCS model that captures correlated dynamics among multiple control loops with spatially distributed sensors and actuators sharing limited wireless resources over multi-state Markov block-fading channels. We develop a Deep Reinforcement Learning (DRL) algorithm that efficiently handles the hybrid action space, captures communication-control correlations, and ensures robust training despite sparse cross-domain variables and floating control inputs.
  arXiv  Detail & Related papers  (2024-10-15T06:28:21Z)
• Perimeter Control with Heterogeneous Metering Rates for Cordon Signals: A Physics-Regularized Multi-Agent Reinforcement Learning Approach [12.86346901414289]
  Perimeter Control (PC) strategies have been proposed to address urban road network control in oversaturated situations. This paper leverages a Multi-Agent Reinforcement Learning (MARL)-based traffic signal control framework to decompose this PC problem. A physics regularization approach for the MARL framework is proposed to ensure the distributed cordon signal controllers are aware of the global network state.
  arXiv  Detail & Related papers  (2023-08-24T13:51:16Z)
• Multi-view Multi-label Anomaly Network Traffic Classification based on MLP-Mixer Neural Network [55.21501819988941]
  Existing network traffic classification based on convolutional neural networks (CNNs) often emphasizes local patterns of traffic data while ignoring global information associations. We propose an end-to-end network traffic classification method.
  arXiv  Detail & Related papers  (2022-10-30T01:52:05Z)
• Lyapunov Function Consistent Adaptive Network Signal Control with Back Pressure and Reinforcement Learning [9.797994846439527]
  This study introduces a unified framework using Lyapunov control theory, defining specific Lyapunov functions respectively. Building on insights from Lyapunov theory, this study designs a reward function for the Reinforcement Learning (RL)-based network signal control. The proposed algorithm is compared with several traditional and RL-based methods under pure passenger car flow and heterogenous traffic flow including freight.
  arXiv  Detail & Related papers  (2022-10-06T00:22:02Z)
• Deep Reinforcement Learning for Wireless Scheduling in Distributed Networked Control [37.10638636086814]
  We consider a joint uplink and downlink scheduling problem of a fully distributed wireless control system (WNCS) with a limited number of frequency channels.<n>We develop a deep reinforcement learning (DRL) based framework for solving it.<n>To tackle the challenges of a large action space in DRL, we propose novel action space reduction and action embedding methods.
  arXiv  Detail & Related papers  (2021-09-26T11:27:12Z)
• Communication Topology Co-Design in Graph Recurrent Neural Network Based Distributed Control [4.492630871726495]
  We introduce a compact but expressive graph recurrent neural network (GRNN) parameterization of distributed controllers. Our proposed parameterization enjoys a local and distributed architecture, similar to previous Graph Neural Network (GNN)-based parameterizations. We show that our method allows for performance/communication density tradeoff curves to be efficiently approximated.
  arXiv  Detail & Related papers  (2021-04-28T16:30:02Z)
• Decentralized Control with Graph Neural Networks [147.84766857793247]
  We propose a novel framework using graph neural networks (GNNs) to learn decentralized controllers. GNNs are well-suited for the task since they are naturally distributed architectures and exhibit good scalability and transferability properties. The problems of flocking and multi-agent path planning are explored to illustrate the potential of GNNs in learning decentralized controllers.
  arXiv  Detail & Related papers  (2020-12-29T18:59:14Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.