Software defined network-oriented DDoS attack defense system and method

Abstract

The invention belongs to the technical field of network security, and particularly relates to the technical field of software defined network (SDN) security defense. According to the technical scheme, an SDN-oriented DDoS attack defense system comprises a data acquisition module, a training module, an identification module, and a flow table issuing module. A defense method comprises the following steps: collecting OpenFlow flow table data on switches in an SDN, training and classifying different types of flow, identifying and marking DDoS attack flow, and intercepting the flow by means of OpenFlow blocking flow table issuing. The system and the method can be well deployed in an SDN environment, and can be used to effectively intercept DDoS attack flow and attacks like source IP address forging.

Description

technical field

[0001] The invention belongs to the technical field of network security, in particular to the technical field of software-defined network security defense. Background technique

[0002] In recent years, Software Defined Network (SDN, Software Defined Network), as a new generation of network architecture, has become an emerging research hotspot. The emergence of the SDN network architecture makes up for many defects in the traditional network architecture. The SDN network is different from the distributed control of the traditional network, and the forwarding behavior of the SDN network switch is controlled by a unified controller. Administrators can manage the network more flexibly. It cannot be ignored that in practical applications, although the SDN network provides great convenience in network management, security issues in the SDN network environment cannot be ignored either. Traditional network real-time defense solutions against DDoS attacks mostly re...

Examples

example 1

[0078] In order to make the technical problems and technical solutions to be solved by the present invention clearer, the following will describe in detail the embodiments of defending against DDoS attacks of portal websites with reference to the accompanying drawings.

[0079] A software-defined network-oriented DDoS attack defense system realizes the identification and interception of DDoS attack traffic in the SDN network architecture environment. The invention is divided into three parts: an SDN network data collection part, a DDoS attack identification part and a DDoS attack interception part. The former part provides the decision-making basis for the latter part. The data collection part uses the OpenFlow flow table data of the switches in the SDN network, and the controller extracts and analyzes the data in real time to identify abnormal DDoS attack traffic; the attack interception part is based on Based on the judgment result in the previous part, a blocking flow table...

technical field

[0001] The invention belongs to the technical field of network security, in particular to the technical field of software-defined network security defense. Background technique

[0002] In recent years, Software Defined Network (SDN, Software Defined Network), as a new generation of network architecture, has become an emerging research hotspot. The emergence of the SDN network architecture makes up for many defects in the traditional network architecture. The SDN network is different from the distributed control of the traditional network, and the forwarding behavior of the SDN network switch is controlled by a unified controller. Administrators can manage the network more flexibly. It cannot be ignored that in practical applications, although the SDN network provides great convenience in network management, security issues in the SDN network environment cannot be ignored either. Traditional network real-time defense solutions against DDoS attacks mostly re...

Examples

example 1

[0078] In order to make the technical problems and technical solutions to be solved by the present invention clearer, the following will describe in detail the embodiments of defending against DDoS attacks of portal websites with reference to the accompanying drawings.

[0079] A software-defined network-oriented DDoS attack defense system realizes the identification and interception of DDoS attack traffic in the SDN network architecture environment. The invention is divided into three parts: an SDN network data collection part, a DDoS attack identification part and a DDoS attack interception part. The former part provides the decision-making basis for the latter part. The data collection part uses the OpenFlow flow table data of the switches in the SDN network, and the controller extracts and analyzes the data in real time to identify abnormal DDoS attack traffic; the attack interception part is based on Based on the judgment result in the previous part, a blocking flow table...

Images