DDOS attack defense security system and method based on SDN architecture

Abstract

The invention discloses a DDOS attack defense security system based on a SDN architecture. The system comprises the a SDN switch for receiving a resource request from a client, the first-layer DDOS detection processing is performed on the received request data packet so as to deliver the data packet which cannot be confirmed as legal to a cleaning server to process; the cleaning server performs fine grain processing on the data packet forwarded from the SDN switch, analyzes the data packet through an algorithm, and forwards the processed data to the SDN switch once again; the SDN switch performs the second processing on the data packet according to a detection result of the cleaning server; a Web server is a target server of the request resource of the client, when the data packet forwarded by the switch is processed by the cleaning server, the cleaned data packet can be forwarded to the Web server accessed by the user request resource through the SDN switch, the Web server receives the data packet and performs the corresponding processing.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security system and method for DDOS attack defense based on SDN architecture. Background technique [0002] DOS (Denial of Service, denial of service) attack means that the attacker uses a large amount of data to "flood" the target host, exhaust the available resources of the target host until the host system crashes, and finally cause the target host to be unable to provide services for normal users (such as WEB pages Serve). Early denial-of-service attacks were mainly aimed at stand-alone machines with relatively weak processing capabilities, such as personal PCs, or websites with narrow bandwidth connections. It has little impact on servers with high-bandwidth connections and high-performance equipment. This is mainly because early DOS attackers often fought alone, and it was difficult to create a "large amount" of attack data alone in a short period of tim...

AI Technical Summary

Problems solved by technology

In the end, the victim host or server consumes a large amount of processing resources to process these sudden requests and cannot respond to legitimate user requests normally, resulting in the paralysis of the server and even the entire network.

[0007] Up to now, experts in the industry at home and abroad and major Internet companies have conducted a lot of in-depth research on DDOS attack detection in the network, and have also proposed solutions to deal with DDOS, but these solutions are still not very effective in defending against DDOS. The number, size, and type of DDOS attacks have continued to surge over the past few years

Images