SDN network DDoS attack detecting method based on network layer flow abnormity

Abstract

The invention relates to a SDN network DDoS attack detecting method based on network layer flow abnormity in order to detect and process a DDoS attack in a SDN network according to the network layer flow abnormity. The method comprises steps of: getting access to an OpenFlow switch flow table information items by using a SDN network controller in order to acquire a communication flow characteristic reaching the OpenFlow switch; and analyzing and processing the acquired detection characteristic by using introduced information entropy and single-side connection density in order to obtain a training and detection characteristic element group. It is found that in a implementing process, the SDN network DDoS attack detecting and processing method based on network layer flow abnormity may effectively improve detection accuracy of the DDoS attack generated in the SDN network, makes corresponding treatment on a communication flow according to a detected result, may well deal with the DDoS attack, from which a network may possibly suffer, in the form of saturated flow, and has very obvious beneficial effects.

Description

technical field [0001] The invention relates to an SDN network DDoS attack detection method based on abnormal network layer traffic for detecting and processing DDoS attacks under an SDN network. technical background [0002] SDN replaces the closed network configuration and management layer in the traditional switching network with the control layer of open software mode, separates the control function from the network communication equipment, and realizes the purpose of separating the control and forwarding functions in the network architecture. OpenFlow is the current SDN general implementation. SDN simplifies network management, but also introduces security risks related to its own characteristics, such as DDoS attacks. DDoS attacks can quickly exhaust key resources (such as bandwidth, buffers, processor resources, etc.) Denial of service attacks bring threats that cannot be ignored to network devices and network services in SDN networks, and have a greater impact on t...

AI Technical Summary

Problems solved by technology

DDoS attacks can quickly exhaust key resources (such as bandwidth, buffers, processor resources, etc.) Denial of service attacks bring threats that cannot be ignored to network devices and network services in the SDN network, and have a greater impact on the security of the SDN network

Images