DDoS attack detecting method and DDoS attack detecting system of multi-tenant cloud computing system

Abstract

The invention discloses a DDoS attack detecting method and a DDoS attack detecting system of a multi-tenant cloud computing system. The method comprises the following steps: arranging a detecting server at a control node of a multi-tenant cloud computing system, and establishing a detecting proxy for each computing node; counting, by the detecting proxy, a number of data packets transmitted by each virtual machine to different destination IP addresses at an i period of time according to flow data collected at the i period of time; calculating, by the detecting proxy, a flow entropy variation value of each virtual machine according to the statistics data, if the flow entropy variation value transmitted by the virtual machine I to the destination IP is greater than the set flow entropy variation threshold value, judging the data flow as a suspicious DDoS attack flow, and transmitting the data flow to the detecting server; identifying, by the detecting server, a potential attack flow according to a data destination IP address, a tenant identifier aggregation destination address and a ratio of an aggregation result in total flow; and if a relative entropy of two potential attack flows is less than a set threshold value, judging as the DDoS attack flow.

Description

technical field [0001] The invention belongs to the field of cloud computing network security. Specifically, it relates to a DDoS attack detection method and system in a multi-tenant cloud computing system environment. Background technique [0002] In the cloud computing system, resource isolation is realized by dividing tenants, and the virtual machines in the multi-tenant cloud computing system are assigned to different tenants during the instantiation phase. In this way, the underlying infrastructure is shared among tenants, and the data of one tenant is protected from being accessed by other tenants to the greatest extent. Large-scale cloud computing systems deploy many virtual machines, and these virtual machines become the targets of DDoS attackers. After the attacker invades a virtual machine in the cloud through a certain method, he injects attack programs into other virtual machines through network attacks and other methods, and these virtual machines form the att...

AI Technical Summary

Problems solved by technology

However, the difficulty of DDoS attack detection on traditional networks is focused on the source of the attack. Attacking hosts are scattered throughout the network, and defenders cannot know the network status of the source of the attack. Source address spoofing technology increases the difficulty of source tracing.

Images