System and method for identifying and preventing DDoS attacks on basis of SDN framework

Abstract

The invention relates to a system and method for identifying and preventing DDoS attacks on the basis of an SDN framework. The system comprises a cheating message detection module, a destroying message detection module, an abnormal message detection module and a threat processing module, wherein the cheating message detection module is used for detecting cheating behaviors of addresses of a link layer and an internet layer, the destroying message detection module is used for detecting abnormal behaviors of zone bit settings of the internet layer and a transmission layer, and the abnormal message detection module is used for detecting flooding type attack behaviors of an application layer and the transmission layer; the cheating message detection module, the destroying message detection module and the abnormal message detection module are used for sequentially detecting messages; if any detection module detects that the messages have cheating, abnormity and attack behaviors, the messages are shifted to the threat processing module; the threat processing module is suitable for discarding the messages and shielding programs and / or hosts transmitting the messages. Extensible modular design is adopted for the processing framework, and efficient detection and flexible processing of DDoS threats are achieved; processing procedures are segmented finely, and the high cohesion property of the modules is improved.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and system for identifying and protecting against DDoS attacks based on an SDN architecture. Background technique [0002] In recent years, while the high-speed and widely connected network has brought convenience to everyone, it has also created extremely favorable conditions for DDoS attacks. Distributed denial-of-service attacks have become hackers often use and difficult to prevent attacks, become one of the biggest threats to network security, it uses the Internet necessary effective protocol, unbiased transmission of data packets from any source to any destination, occupying the There are too many service resources, so that legitimate users cannot get service responses, causing serious economic losses to various Internet users and service providers. The current defense against DDoS attacks usually adopts packet filtering or rate limiting measures, which are not onl...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a kind of DDoS threat identification and protection system based on SDN framework, this protection system effectively solves the network security problem caused by a large number of DDos attacks in the existing network,

Images