DDoS attack detection method based on SDN

Abstract

The invention relates to a DDoS attack detection method based on an SDN, and belongs to the field of software defined networks. According to the method, the queue theory and the conditional entropy are used as a coarse-grained detection module of the arrival flow in the SDN environment, and machine learning is used as a fine-grained detection module, so malicious flow is accurately detected from legal packets, and the possibility that a server in a network is attacked is reduced while a controller is protected from being attacked. Coarse granularity detection is composed of two parallel detection modules, namely a multi-dimensional conditional entropy detection module and a controller entry queue length detection module, fine granularity detection is triggered when a detection result of any one module exceeds a threshold value, the fine granularity detection module collects flow table items and counter information from a switch based on an OpenFlow protocol for statistical processing, and the traffic is finally judged by using a random forest (RF) classification model which is trained and is placed in the controller, so as to effectively detect the attack traffic and prevent the controller from being damaged.

Description

technical field [0001] The invention relates to an SDN-based DDoS attack detection method, which belongs to the field of software-defined networks. Background technique [0002] Software-Defined Networking (SDN) is a new network architecture with logical centralized control. SDN decouples the control plane and data plane of the network, abstracts the data plane network resources, and supports the unified interface to The network is directly programmed and controlled, and SDN manages the flow of the entire network through the control and distribution of the flow table. In the SDN environment, everything is managed by the controller. According to the OpenFlow protocol, when a new message comes to the switch, the forwarding table in the switch does not have a matching routing rule, and the switch will use the Packet_In data frame to encapsulate it and send it to Controller, requesting new routing rules. After receiving the message, the controller provides the corresponding re...

AI Technical Summary

Problems solved by technology

When a DDoS attack occurs, the controller will receive a large number of Packet_In messages, and the controller will spend a lot of resources to process these messages. The bandwidth between the switch and the controller may be fully occupied by the surge of traffic, which will greatly reduce network performance. Legitimate requests will not be responded to

At present, most of the detection methods for DDoS attacks are based on the traditional network architecture, which cannot be well applied to SDN. The research on detecting DDoS attacks in the SDN environment is still in its infancy. Therefore, the research on DDoS attack detection models under SDN has broad Prospects

[0004] In recent years, many solutions for the detection of DDoS attacks in SDN are aimed at the protection of servers, and few involve the protection of controllers. Most of the detection solutions are based on statistical analysis or machine learning, and the detection accuracy is often unsatisfactory. , the detection mechanism does not give full play to the characteristics of the SDN network architecture

Images