DDoS attack and shanyong event detection method based on stream

Abstract

The present invention relates to a DDoS attack and shanyong event detection method based on stream. The applied stream detection method combines [phi]-entropy improved based on shannon entropy and general entropy and the stream multi-dimensional features. The method comprises the steps of: analyzing multiple types of DDoS attack and shanyong event features, and making multiple types of DDoS attackand shanyong event flow, wherein the made flow can generate particular flow table data of an SDN in the SDN; introducing the [phi]-entropy improved based on shannon entropy and general entropy to increase the information distance between different data to facilitate discovering of attack behaviors as soon as possible; obtaining the multi-dimensional data of the flow table in a switch, such as a protocol type, the flow survival time, the shannon entropy and the general entropy of source / target IPs and the [phi]-entropy, performing feature extraction; classifying different types of DDoS attackflows, the shanyong event flow and the normal flow, namely multi-classification, comparing the detection accuracy of the classification methods such as the SVM and the KNN; and regulating the value ofan adjustable parameter [Alpha] of the [phi]-entropy, and combining an optimum classifier to obtain an optimal multi-classification accuracy. The DDoS attack and shanyong event detection method basedon stream employs the particular flow table function of the SDN and combines the [phi]-entropy to timely detect attacks when the attacks generate and reduce the false alarm rate of the shanyong event.

Description

technical field [0001] The invention discloses a flow-based DDoS (Distributed Denial of Service) attack and flash crowd event detection method in SDN (Software Defined Network), and belongs to the technical field of computer security. Background technique [0002] With the development of SDN, its security is getting more and more attention. Due to the centralized management and programmable features of SDN, attackers can easily exploit its security vulnerabilities to carry out DDoS attacks. Since the SDN is managed globally by the centralized controller, the switch will forward the unmatched data packets in the flow table to the controller by default, and then the controller sends the flow rule to the switch of the IP. If an attacker sends a large number of packets from multiple IPs, these packets will be forwarded to the controller. This traffic would then consume all available resources of the controller and make access unavailable for legitimate users. In addition, an ...

AI Technical Summary

Problems solved by technology

This situation makes it more difficult to distinguish between DDoS and flash flooding events

Images