A DDoS attack detection and defense method and system in a software-defined network

Abstract

The invention discloses a DDoS attack detection and defense method and system in a software-defined network. The method comprises:the quintuple features of source IP, source port, destination IP, destination port and protocol type are extracted and the quintuple feature entropy is calculated; whether the IP entropy value of the window source exceeds the threshold value is judged, if yes, it is determined that the window source IP entropy value is suspicious traffic, otherwise, the window traffic is filtered; machine learning is used to judge whether the suspicious traffic exists attack, if yes, it is judged as attack traffic, otherwise, the suspicious traffic is filtered; the switch port with the largest IP entropy value in the attack traffic is marked as a suspicious port, which is repeatedly detected as a suspicious port and is judged as an attack port; defense rules are issued to the switch where the attack port is located and attack traffic is filtered from the forwarding layer. The invention combines quintuple characteristic entropy value and machine learning algorithm to detect DDoS attack, locates and takes defensive measures in time, filters a large amount of malicious traffic from the forwarding layer, and protects the controller and the switch.

Description

technical field [0001] The invention belongs to the field of network security, and more specifically relates to a DDoS attack detection and defense method and system in a software-defined network. Background technique [0002] Software Defined Network (Software Defined Network, SDN) is a new type of network architecture, which has the characteristics of separation of control and forwarding, centralized control and programmability. Its centralized control feature provides great convenience for software programming, but it also brings a series of security problems. The SDN controller centrally manages network resources. Once the controller fails at a single point, the entire network will face the risk of paralysis. [0003] Among various network security issues, DDoS (Distributed Denial of Service, Distributed Denial of Service) attack is a distributed, large-scale coordinated network attack method, which is easy to launch, difficult to defend, and extremely easy to damage th...

AI Technical Summary

Problems solved by technology

However, this method must consider how to reasonably evaluate the relationship between the three feature quantities to detect DDoS attacks

Images