A defense method for link flooding attacks based on incremental deployment of SDN networks

Abstract

The invention relates to an increment deployment SDN network-based method for defending a link flooding attack. A node upgrade algorithm is utilized to pick out routers that need to be upgraded into software-defined network function nodes and the routers are upgraded; when congestion occurs in a network, a congestion link is positioned through the software-defined network function nodes deployed in the network; congestion link information of the whole network is collected, and on this basis, whether current network congestion forms a link flooding attack is judged; and if the link flooding attach is formed, global flow engineering is started to balance flow of the whole network, otherwise, the congestion link is relieved through backup of a path. According to the increment deployment SDN network-based method for defending a link flooding attack, in a traditional network, a small quantity of nodes are upgraded into software-defined network function nodes, the link flooding attack is detected, a link group that is attacked is positioned, and link flow of the whole network is balanced through centralized control flow engineering, so that the root of a link flooding attack is eliminated, thereby effectively defending the link flooding attack.

Description

technical field [0001] The invention relates to network security technology in the field of computer networks, in particular to a defense method for link flooding attacks based on incrementally deployed SDN (Software-Defined Network, software-defined network) network. Background technique [0002] Distributed Denial of Service (DDoS) is one of the major security threats to the Internet today. The attacker is mainly based on the asymmetry of the resources of the zombie host and the victim, and then uses the loopholes of some network protocols to launch an attack, consumes the resources of the victim (bandwidth, CPU, etc.), so that the victim availability is greatly reduced. For traditional DDoS attacks, there are already a series of relatively effective defense measures, including Pushback, ingress filter (Ingress filter), controller proxy model and other methods. The existing algorithm is based on the statistics and identification of network traffic, so as to distinguish D...

AI Technical Summary

Problems solved by technology

[0007] (1) Difficult to detect

The target area is not directly attacked, so it is difficult for the servers in the target area to directly detect abnormal traffic

[0008] (2) Indistinguishability

However, due to the huge scale of the current network, the diversity and complexity of network facilities and types, the transition from traditional networks to software-defined networks cannot be completed overnight.

Images