DoS/DDoS attack defense module and method based on SDN controller

Abstract

The invention discloses a DoS / DDoS attack defense module and a method based on an SDN controller. The DoS / DDoS attack defense module maintains a counter, the number of packets received by the SDN controller in the past n seconds is recorded, two thresholds, those are, a primary threshold and a secondary threshold, are set, and the secondary threshold is larger than the primary threshold. When the counter is smaller than the primary threshold, the data packets are transmitted to a default processing module for processing. When the counter exceeds the primary threshold, happening of a DoS / DDoS attack is meant, the data packets are firstly filtered through the DoS / DDoS attack defense module, and the controller at the time enters a defense mode. When the number of packets received per second exceeds the secondary threshold, happening of a stronger DoS / DDoS attack is meant. The module can effectively filter malicious attack packets and can ensure normal data packet communication, so that the module can resist DoS / DDoS attacks against SDN controllers to a certain extent.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to an SDN controller-based DoS / DDoS attack defense module and method. Background technique [0002] As a new technology, SDN is also facing many security problems while it is developing rapidly. Because the design of SDN architecture, system and protocol is not mature enough, security issues are becoming more and more prominent. As a traditional attack method, DoS / DDoS attack has become a new threat to SDN network. [0003] As a kind of SDN southbound protocol, OpenFlow has certain security problems, and it is easy to cause DoS / DDoS attacks between the data plane and the control plane. The attacker can generate a large number of irregular data packets and send them to the switch, but there is no flow table that can match these data packets in the switch. At this time, the switch will send a large number of packet_in messages to the controller. This DoS / DDoS attac...

AI Technical Summary

Problems solved by technology

This DoS / DDoS attack not only consumes the cache space of the controller and the switch, but also occupies the network bandwidth between the data plane and the control plane.

If multiple distributed hosts are used for sending, a more harmful distributed denial of service attack will occur

Images