DDoS attack tracing system and method based on software-defined network

Abstract

The invention discloses a DDoS attack tracing system and method based on a software-defined network, and belongs to the technical field of software-defined network security defense. The tracing systemcomprises an out-of-domain attack source, an attacked host, an OpenFlow switch and an SDN controller. According to the method, an initial detection module is arranged on an edge switch, and when abnormality is found, information of a data packet flowing through is recorded, and a controller is warned. The controller receives an alert, and collects global network traffic information, a random forest algorithm is applied, attack occurrence is determined more accurately by extracting depth features of flow, then attack packet feature information is issued to an edge switch, the edge switch findsout an attack port through information matching and reports the attack port to a controller, and the controller issues a flow table, discards an attack packet at an attack source and blocks an attack. According to the system, the main work of attack tracing is issued to the edge switch, the burden of the controller is effectively reduced, and the system has practical application value.

Description

technical field [0001] The invention relates to a software-defined network security defense technology, and belongs to the technical field of network security. Background technique [0002] With the development of emerging technologies such as cloud computing and big data, network traffic continues to increase, and the traditional IP-centric network architecture cannot meet the needs of network scalability, management, and flexibility. Software Defined Network (SDN) is a new type of network architecture, which was born in a research project of Stanford University in the United States. It guides the data forwarding of the underlying switches, thereby improving the flexibility and scalability of the network, and making the management of network traffic more convenient. [0003] Distributed Denial-of-Service (DDoS) attack has become one of the biggest threats to network security. It has strong destructive power, simple implementation and lack of simple and feasible countermeas...

AI Technical Summary

Problems solved by technology

However, these solutions only rely on the controller to trace the source of the attack on the entire network, which requires the controller to continuously obtain and analyze the traffic information in the network. When the network scale is large, the controller has a huge burden and cannot work normally.

Images