Malicious scanning defense method and system based on adaptive IP address conversion

Abstract

The invention provides a malicious scanning defense method based on adaptive IP address conversion, applied to an SDN. The method comprises the following steps: 1) in the case of a scanning attack, sampling a request data packet from each subnet of the SDN, and analyzing the request data packet to generate statistical data within different time intervals; 2) calculating the distribution of a source IP address, a destination IP address and a destination port number within each time interval according to the statistical data; 3) calculating the Sibson entropy of the same distribution of the source IP addresses, the destination IP addresses and the destination port numbers within adjacent time intervals, and judging a scanning attack strategy accordingly; and 4) generating an IP address transfer strategy according to the scanning attack strategy, and implementing virtual IP address conversion according to the IP address transfer strategy. Meanwhile, the invention further provides a system for implementing the method. The system comprises constructing a controller, hopping proxy and detection proxy in the SDN architecture for implementing the steps in the method.

Description

technical field [0001] The invention belongs to the field of network security. Specifically, it relates to a malicious scanning defense method and system based on IP address adaptive conversion in a software-defined network environment. Background technique [0002] Software-defined networking (SDN) is a network architecture that decouples the control function of network devices such as routers and switches from the data forwarding function based on the design idea of ​​separating logic control and data forwarding. It manages the entire network by a programmable logical centralized controller; the data forwarding function is realized by the underlying forwarding equipment. The characteristics of SDN centralized control enable the controller to obtain network performance indicators online, and on this basis, allocate resources in a timely manner and implement global decisions. The OpenFlow protocol is a standardized interface for controllers to manage and configure underlyi...

AI Technical Summary

Problems solved by technology

However, due to the lack of adaptability of the hopping mechanism to the malicious scanning strategy, the network hopping strategy is blind

As network scanning strategies become more varied and targeted, "blind random" jumping strategies will greatly reduce the effectiveness of defense

Images