The application discloses a kind of based on
ranking learning's SDN data plane low-rate DDoS
attack mitigation method, belong to
network security field.The method includes: based on OpenvSwitch switch,
polling SDN switch flow table and extracting flow table entry, form
original data;Feature sextet and identification of extracting flow table entry are combined with source
IP address etc.Information, mark correlation
label and query ID for flow table entry;Adopt integrated learning XGBoost method, based on Pairwise, establish flow table entry
ranking learning model, and deploy on SDN switch;
Attack mitigation
system on switch real-time monitoring whether flow table overflow caused by DDoS
attack has occurred;If
attack occurs,
ranking learning model predicts the ranking
score of each flow table entry, and rearranges flow table according to ranking
score descending order, sets attack
detection threshold, finally traverses flow table entry from top to bottom, decides which flow table entry should be deleted.The application has high
detection rate for data plane low-rate DDoS attack, low
false alarm rate and
miss rate, strong adaptability, rapid and effective mitigation.