Method for detecting lightweight network traffic abnormality for software defined network

Abstract

The invention discloses a method for detecting lightweight network traffic abnormality for a software defined network. The method detects a network traffic abnormality phenomenon for the software defined network by analyzing packet-in messages received through a controller, and comprises the following steps of firstly parsing the packet-in messages, calculating arrival speeds of the packet-in messages, ratios of the packet-in messages sent by each exchanger, ratios of message protocol types encapsulated in the packet-in messages, and message arrival speeds of different protocols encapsulated in the packet-in messages, and then utilizing a cluster-based outlier technique to detect the above characteristics of the packet-in messages so as to judge whether or not network traffic is normal. The method for detecting lightweight network traffic abnormality for a software defined network can quickly detect the traffic abnormality in the software defined network.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a software-defined network-oriented lightweight network traffic anomaly detection method. Background technique [0002] With the continuous advancement of computer network technology, the issue of network security has also been paid more and more attention by users and network service providers. As an important technology in network security, network traffic anomaly detection technology plays an important role in preventing network attacks. The current network traffic anomaly detection technology usually captures communication packets in the network by mirroring traffic or periodic sampling, and then analyzes the captured communication packets to detect whether the network traffic is abnormal. [0003] Both of the above two methods need to obtain all network packets in the network for detection by the network traffic anomaly detection algorithm. On the one hand, t...

AI Technical Summary

Problems solved by technology

On the one hand, this method needs to obtain a large number of network packets, which may easily lead to problems such as network congestion, increased delay, and increased packet loss rate; on the other hand, this method requires a large amount of computing resources, resulting in a sharp increase in computing resource overhead

Therefore, the above-mentioned network traffic anomaly detection method has inevitable defects.

Images