The stability of Internet services is persistently challenged by the escalating scale of volumetric TCP SYN floods, as conventional defenses like SYN Cookies fail by exacerbating bandwidth depletion under modern attacks. This paper introduces SDN-SYN PoW, a novel defense architecture that synergizes non-interactive Proof-of-Work with a Software-Defined Networking (SDN) control plane, an approach particularly effective for securing the network edge in modern SD-WAN deployments. The core innovation is its ability to perform global network sensing; the SDN controller monitors real-time traffic to dynamically adjust PoW difficulty, transforming the defense from a static mechanism into an intelligent, adaptive system that surgically applies computational costs only to anomalous sources. Through rigorous experiments on a custom-built testbed, we demonstrate that SDN-SYN PoW provides substantially superior protection and, critically, that the PoW overhead remains negligible for legitimate clients, ensuring compatibility even with low-power devices.

翻译：互联网服务的稳定性持续受到日益扩大的体积型TCP SYN泛洪攻击的挑战，因为传统防御措施（如同步Cookie）在应对现代攻击时会因加剧带宽消耗而失效。本文提出了一种新颖的防御架构SDN-SYN PoW，该架构将非交互式工作量证明与软件定义网络（SDN）控制平面协同结合，这种方法特别适用于在现代SD-WAN部署中保护网络边缘。其核心创新在于具备全局网络感知能力：SDN控制器实时监控流量以动态调整PoW难度，从而将防御从静态机制转变为智能自适应系统，仅对异常来源精准施加计算成本。通过在自建测试平台上进行的严格实验，我们证明SDN-SYN PoW能够提供显著优越的保护效果，并且关键在于对合法客户端而言，PoW开销可忽略不计，即便对于低功耗设备也能确保兼容性。