Cross-layer cooperative detection method of DDoS attack based on software defined network

Abstract

The invention discloses a cross-layer cooperative detection method of a DDoS attack based on an SDN for improving the detection efficiency of the DDoS attack. The technical scheme is as follows: constructing cross-layer collaborative detection architecture based on the SDN composed of a data layer and a control layer, wherein a data path, a switch proxy, a DDoS attack sensing module and a featureextraction module are arranged on an SDN switch of the data layer; and a controller proxy, an event manager, a DDoS attack classification module and a botnet tracing module are arranged on an SND controller of the control layer. The data layer performs coarse granularity detection on the data traffic to obtain DDoS attack abnormal traffic data, and the control layer performs fine-grained detectionon the abnormal traffic data of the DDoS attack. According to the cross-layer cooperative detection method disclosed by the invention, by means of the cooperation of the data layer and the control layer, the problems of large southbound interface pressure of the SDN and overlarge pressure of the SND controller are solved, the type of DDoS attack can be detected, and a switch set close to a botnetcan also be detected, so that the speed and accuracy of detecting the DDoS attack are improved.

Description

technical field [0001] The present invention relates to the field of computer network security, in particular to a cross-layer collaborative detection method for DDoS (Distributed Denial of Service) attacks based on SDN (Software Defined Network, software defined network). Background technique [0002] With the rapid development of computer network technology, network attacks and destructive behaviors are becoming more and more frequent, and the situation of computer network security is becoming increasingly severe. Among them, DDoS attack is one of the most concerned security problems in computer network at present. DDoS attacks usually use botnets to send a large number of service requests to victims, resulting in a large amount of resources consumed by victims, so that they cannot respond to legitimate user requests in a timely manner, or even completely paralyzed. With the development of network technology, the traffic of DDoS attacks is also increasing, making it more ...

AI Technical Summary

Problems solved by technology

[0014] The present invention proposes an SDN-based cross-layer collaborative detection method for DDoS attacks, fully utilizes the respective advantages of the control layer and the data layer for collaborative cooperation, and solves the problems of high pressure on the SDN southbound interface and excessive burden on the SDN controller caused by the DDoS detection process. Effectively improve the detection efficiency of DDoS attacks

Images