Malicious website protection method based on OpenFlow protocol

Abstract

This invention discloses a malicious website protection method based on an OpenFlow protocol. The method comprises the following steps: based on the structure and the characteristic of SDN (Self-Defending Network), domain name resolution messages sent by an end system are transmitted to a controller through the OpenFlow protocol; performing security check to the messages in a controller module and making a processing decision. The method provided by the invention can be mainly applied to the environments such as SDN structured enterprise network and campus network. Domain names in the domain name resolution messages are firstly extracted from the controller end; then the domain names are compared with a blacklist and a whitelist in the controller by applying the domain name fuzzy matching algorithm; and a specific processing operation is performed to a domain name resolution request by using the comparing result. By adopting the method of the invention, the visit of a terminal to the malicious website can be examined and separated effectively, and simultaneously, a phishing website with similar domain name also can be detected; furthermore, the security policy of the controller can be conveniently changed in the SDN-based network structure.

Description

technical field [0001] The invention belongs to malicious website protection technology, in particular to a malicious website protection method based on OpenFlow protocol. Background technique [0002] Phishing attack is a typical attack in network attacks. This attack method allows users to visit malicious websites and disclose their private information by implanting malicious codes or deceptive links in web pages or emails. The attack method is characterized by strong concealment and deception, It is tempting and is a network attack method with a relatively high success rate. Traditional protection methods for such malicious websites are limited by the network architecture, and the protection effect is not satisfactory. [0003] At present, the security protection scheme under the SDN architecture is still in the initial research stage. Most of the research work is devoted to strengthening the security of the controller in the SDN architecture. On the basis, modules suc...

AI Technical Summary

Problems solved by technology

However, the above-mentioned security protection schemes are all active protection security schemes, which do not take into account the situation when users actively visit malicious websites without knowing it, nor do they protect the access process of general network users at the SDN application level. Protection scheme

Images