Attack detection method and SDN switch

Abstract

The invention discloses an attack detection method and an SDN switch. The method comprises the following steps: collecting a data stream of a port, wherein the data stream comprises at least one tupleinformation; calculating an information entropy of each tuple information according to tuple information of the data stream of the port; comparing whether the information entropy of each tuple information is less than or equal to a set threshold corresponding to each tuple information; if the information entropy of any tuple information is greater than the corresponding set threshold, determiningthe occurrence of an abnormal attack; and if the information entropy of any tuple information is smaller than the corresponding set threshold, determining that no abnormal attack occurs. In the attack detection method disclosed by the invention, the data stream is uploaded to the SDN controller to detect the abnormal attack, thereby avoiding the influence on the computing power of the southboundchannel and the SDN controller, and thus avoiding large area paralysis of the network.

Description

technical field [0001] The invention relates to the technical field of communications, in particular to an attack detection method and an SDN switch. Background technique [0002] The SDN switch is composed of a flow table containing multiple entries, each entry in the flow table can match a specific data type in the network, and contains the execution action entry for the data flow of this data type , these actions are performed in a pipelined manner. When a data packet enters the SDN switch, it needs to analyze the message first, according to the multiple matching tuples from layer 2 to layer 7 under the existing TCP / IP architecture, and then match according to the parsed tuple information If the flow table matches the characteristics of one of the entries, the forwarding strategy will be executed according to the corresponding action. If the entry cannot be matched, the data packet will be encapsulated into a Packet-in message and sent to the SDN controller through a sec...

AI Technical Summary

Problems solved by technology

The attacker uses the DDOS attack method in the data plane network to forge a large number of random unmatched data streams. The SDN switch will upload all these data streams to the SDN controller according to the existing logic. The impact will seriously affect the performance of the entire network, which will cause large-scale paralysis of the network

Images