SDN abnormal flow detection method based on re-marking range method

Abstract

The invention discloses an SDN abnormal flow detection method based on a re-marking range method, and belongs to the technical field of computer network security. The method comprises the following steps: collecting the number of normal network flow packets of each node (including a controller and each user terminal) of the SDN, and respectively calculating the Hurst index of the normal network flow packets; storing and taking as a network normal index, and setting a threshold value of a normal state; collecting the number of network flow packets with certain known exception of each node, andcalculating the Hurst index of each node as the index of the exception; intercepting a forward sequence by using a window function and calculating a Hurst index of the forward sequence, and if a normal index is finally changed into a certain abnormal index, determining that the abnormality of the mode occurs and determining an abnormality occurrence time point. And if only the index change deviates from the normal value, but the similar abnormal index cannot be found, an exception except the known mode occurs, and an exception time point can be determined. According to the method, the flow state can be detected in real time, whether the flow is abnormal is judged, the abnormality occurrence time can be detected, and the security of the SDN network system is enhanced.

Description

technical field [0001] The invention belongs to the technical field of computer network security, and in particular relates to an SDN abnormal traffic detection method based on a remarking range method. Background technique [0002] Software Defined Network (SDN) is a new trend in the development of network forms. Its most important feature that is most different from traditional networks is the separation of data plane and control plane. This feature makes SDN more flexible and easy to maintain, and solves the main problem of decentralization and complexity of traditional network static architecture. The data plane and the control plane can be independently updated and iterated, and the two layers use a unified protocol communication interface to exchange instructions and data with each other. Especially in the case of large and complex network topologies, administrators are exempted from the task of manually reconfiguring network configuration and connections, improving e...

AI Technical Summary

Problems solved by technology

However, according to the experimental research, it is found that the sampling interval of 100ms is used to collect sample points for the controller, and the value of the sample point is the number of data packets when the controller is working normally, and an error occurs when programming and calculating the Hurst index

The reason is that the controller flow sequence has many long-term continuous 0 values. When calculating the R / S sequence, since the range and standard deviation of the constant value sequence are both 0, meaningless values ​​are generated after division, which affects the convergence of the final linear fitting.

This problem will affect other user terminals even in traditional networks during periods of low traffic

Images