A kind of sdn anomaly detection and blocking method and system

Abstract

The invention provides an SDN (self-defending network) anomaly detection and interception method and system. The method is applied to an SDN network and comprises steps as follows: data streams are subjected to random sampling, and a sampling data package is obtained; sample data in the sampling data package are fetched, multiple characteristic fields of the sample data are obtained, and a countable hash table corresponding to each characteristic field is updated; an entropy value of the countable hash table corresponding to each characteristic field is calculated in a time window at the interval of the preset time window; if the entropy value is larger than or equal to the preset anomaly judgment threshold value, an anomaly counter is cleared, and otherwise, count of the anomaly counter is added with one; if the value of the anomaly counter is a preset counting threshold value, anomaly attacking is judged, and otherwise, processing is not performed; abnormal attack is intercepted according to a preset interception mechanism. The method and the system have the advantages of high detection efficiency and low data processing load.

Description

technical field [0001] The present invention relates to the technical field of network security, and more specifically, to an SDN anomaly detection and blocking method and system. Background technique [0002] The Internet has become an indispensable part of our lives, but network attacks are seriously affecting our online experience and the security of online information. Distributed network attacks such as DDoS, worms, and scanning are rampant. Traditional network attacks affect the modern Internet and the future Internet security. Distributed coordinated attacks have the characteristics of wide range, concealment and synchronization. The traffic observed by the previous single-point IDS (Intrusion Detection System) is limited, and it is difficult to detect scattered and concealed attack traffic. [0003] The method of distributed data collection is used to obtain more data, and to detect hidden attacks from global vision, which can improve the detection rate. However, ...

AI Technical Summary

Problems solved by technology

However, the amount of data obtained by distributed data collection is generally very large, and a server with strong computing power is required to process it.

In a large-scale, high-speed network, distributed collection of data will consume a lot of bandwidth, and a large amount of data will easily paralyze the central server

Images