SDN network DDoS attack detection method based on optimized BP neural network

Abstract

The invention proposes an SDN network DDoS attack detection method based on an optimized BP neural network. The method achieves the more complete extraction of six feature values, correlated with DDoS, in a lower flow table of an SDN network environment: source IP address acceleration GSIP, flow survival time change ADF, opposite flow ratio PPF, port acceleration GSP, a flow table item speed RFE,and a flow matching success rat RFM. Through the setting of a triggering threshold value, the method reduces the load of the SDN network, and employs a particle swarm optimization algorithm for optimizing the BP neural network, selects the mean square error of the BP neural network as a fitness function of the particle swarm optimization algorithm, selects the value with the best fitness as the threshold and weight of the BP neural network, avoids the conditions that the slow solving speed of the optimal solution of the BP neural network causes a locally optimal solution, and improves the detection precision.

Description

technical field [0001] The invention relates to a DDoS attack detection technology, in particular to an SDN network DDoS attack detection method based on an optimized BP neural network. Background technique [0002] Distributed Denial of Service (Distributed Denial of Service, DDoS) attack is one of the main threats facing the current Internet. DDoS attack initiators first exploit the vulnerabilities of Internet users to collect a large number of puppet machines, and then coordinate these puppet machines to forge data and send illegal requests to paralyze the target host. This resulted in the leakage of a large number of users' personal information and brought economic losses to many companies. The existing DDoS attack detection is mainly aimed at the architecture of the traditional network, while the software-defined network is a new network architecture that is currently emerging, which realizes the separation of the network control plane and the data plane, and has advan...

AI Technical Summary

Problems solved by technology

However, because the control plane and the data plane are decoupled, when the connection between the switch and the controller fails, the network will lose control. Therefore, the security of the controller is one of the security guarantees of the entire SDN network, and DDoS attacks are the security of the controller. One of the threats, how to detect accurate DDoS attacks is critical to SDN security

[0003] In the existing methods, although a large number of effective DDoS attack detection methods are proposed, they only use the interactive characteristics of the network flow, and the comprehensiveness of the judgment is not enough, or the convergence speed of the detection model is slow, the training time is long, and the algorithm used has not been optimized. Excellent solution, low accuracy of detection results

Images