Self-adaptively started ddos defense method and system based on trust value in SDN

Abstract

The invention discloses a self-adaptively started ddos defense method based on a trust value in an SDN. The self-adaptively started ddos defense method comprises the following steps: a switch receives an unmatched packet, and sends a packet_in data packet to a controller; a counter is deployed in an SDN controller; the counter pre-sets a packet_in number value; when an arrival packet_in number is equal to a set value every time, the packet_in arrival rate in the time period is calculated; then, whether the packet_in arrival rate is abnormal or not is judged; the flow on the switch corresponding to packet_in is precisely detected by utilization of a reverse neural network classifier; a neural network, an intermediate layer of which is 50*50, is established; six characteristic values are calculated; training is carried out by taking the six characteristic values as input of the classifier; and, if the output value of the neural network is between 0.5 and 1, the fact that the flow is a ddos attack is determined. By means of the self-adaptively started ddos defense method and system based on the trust value in the SDN disclosed by the invention, the characteristics of the SDN, such as flow table information of a data layer and control of the controller in a control layer to the whole network, are sufficiently utilized; and thus, the ddos attack in the SDN can be effectively defensed.

Description

technical field [0001] The invention belongs to the technical field of next-generation network security, and relates to a DDoS defense method and system based on self-adaptive startup of trust value in SDN. Background technique [0002] As an important factor affecting detection efficiency and system performance, there is little research on the start-up mechanism of the defense system. At present, most ddos ​​defense systems use a mechanism based on periodically checking flow entries to start ddos ​​detection. In most methods, the controller periodically collects the collection of flow entries. The disadvantage of periodicity is obvious. If the period is too long, it will cause untimely detection of ddos, and if the period is too short, it will increase the load on the controller. Different from the above methods, the present invention proposes an adaptive startup mechanism based on the arrival rate of packet_in. [0003] At present, most researches focus on the detection...

AI Technical Summary

Problems solved by technology

Because packet-based detection will still collect packet information to determine whether the packet is a ddos ​​attack packet even when no ddos ​​attack occurs, this will cause the controller to spend a lot of time and resources to process a large amount of normal information

Images