Protecting method, device and system of DDOS (Distributed Denial of Service) attack based on SDN (Software Defined Network)

Abstract

This invention provides a protecting method, device and system of DDOS attack based on SDN. The method comprises the following steps: a traffic statistics instruction is sent to a first message transmitting device by a controller; the traffic statistics instruction indicates the first message transmitting device to perform traffic statistics and carry a destination IP (Internet Protocol) address; the controller collects statistics data reported by the first message transmitting device; the statistics data includes traffic statistics information which flows to the destination IP address; the controller acquires a global traffic statistic which flows to the destination IP address according to the statistics data; the controller judges whether the global traffic statistic exceeds a predefined threshold or not, and sends a DDos protection strategy to a second message transmitting device based on a judging result that the global traffic statistic exceeds the predefined threshold; correspondingly, the second message transmitting device receives the DDos protection strategy sent by the controller; and according to the DDos protection strategy, the traffic which flows to the destination IP address is protected. The method reduces the influence range of the DDos attack to the network, and improves the security of the network.

Description

technical field [0001] The present invention relates to communication technology, and in particular to a software-defined network (Software Defined Network, abbreviated: SDN)-based distributed denial of service (Distributed Denial of Service, abbreviated: DDOS) attack protection method, device and system. Background technique [0002] figure 1 A schematic diagram of a DDoS attack. refer to figure 1 , the main implementation principle of DDoS is that the attacker uses one or more levels of master control hosts as a springboard to control a large number of infected controlled hosts to form an attack network to implement large-scale denial of service attacks on victim hosts. This kind of attack can often amplify the attack effect of a single attacker in a series form, thus causing a significant impact on the victim host and causing serious congestion to the network. DDoS uses the attacking network to launch an Internet Control Message Protocol (ICMP) flood attack, a Synchron...

AI Technical Summary

Problems solved by technology

[0004] For the above-mentioned backbone network scenario without obvious aggregation nodes, although the method of deploying cleaning devices targeting specific IP addresses is adopted, when a DDoS attack occurs, regardless of whether the IP address of the victim host is a specific IP address, the DDoS attack against the victim host needs to be The attack traffic is diverted to the cleaning device, and the traffic of the victim host whose IP address is not a specific IP address needs to go through multiple routing and forwarding nodes in the network before being diverted to the cleaning device

As a result, the network resources of these routing and forwarding nodes are occupied, and the influence range of DDoS attacks on the backbone network is expanded, thereby reducing the security of the network.

Images