A LDoS attack detection method in SDN environment

Abstract

The invention relates to an LDoS attack detection method under an SDN environment, comprising the following steps: positioning an exchange suspected to be attacked according to a difference Del between an incoming data packet and an outgoing data packet in a unit time of each exchange in an SDN network; Aiming at the switch suspected to be attacked, locating the incoming port of the attack trafficthrough the traffic statistics of each port, For each stream flowing into the port, counting the traffic information separately, and locating the source Mac and destination Mac information of the attack stream, so as to find the attack stream.

Description

technical field [0001] The invention relates to an LDoS attack detection method in an SDN environment. Background technique [0002] Low-rate denial of service (Low-rate Denial Of Service) attack is a new type of network attack that has emerged in recent years. It exploits the loopholes in the adaptive mechanism in the network, such as the congestion control mechanism in the TCP protocol, the queue management mechanism of the router, and the like. It adopts periodic high-rate short-time pulses, which make the network constantly change between stable state and unsteady state, seriously reducing the performance of the network. Since the LDoS attack traffic is a periodic short-term high-speed pulse, and the attack end remains silent most of the time, the average traffic of an LDoS attack is very low, which is slightly different from the normal traffic, which greatly increases the difficulty of detection. Low-rate denial-of-service (LDoS) attack is a new type of network attack...

AI Technical Summary

Problems solved by technology

[0007] At present, the research on the detection of LDoS attacks is still mainly concentrated in the traditional network architecture, and there are few researches on the detection of LDoS attacks under emerging network architectures such as SDN.

Images