DDoS attack defense method and defense system of SDN controller

Abstract

The invention provides a DDoS attack defense method and defense system of an SDN controller. Firstly, the attack is detected in two stages to judge whether a DDoS attack exists, a suspicious switch set is filtered by an attack positioning method when the attack occurs, after the attack occurs, a malicious Packet-in message is discarded by alleviating the attack, and a switch flow table space is protected by setting an appropriate flow table entry Timeout value. By adoption of the DDoS attack defense method and defense system provided by the invention, the problem of accurately detecting the suspicious Packet-in message under an OpenFlow policy is solved, attack defense is performed on the SDN controller as soon as possible, so that a normal data packet can obtain better quality of service,therefore, the normal state of the network is restored, and correct data packet processing is ensured. The DDoS attack defense method and defense system provided by the invention have the advantagesof high detection speed, high detection precision, simple structure and high popularization and application values.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a DDoS attack defense method and defense system of an SDN controller. Background technique [0002] As an emerging technology, SDN can effectively solve some problems in traditional networks, such as solving traffic engineering and security problems in traditional networks, but the new features introduced in the SDN architecture also bring new challenges. Before the large-scale commercial application of SDN, there are still a lot of problems to be solved urgently, the most important of which is the security of SDN, and the control plane is the core of SDN. The network is paralyzed. [0003] In the SDN network, the OpenFlow protocol is responsible for establishing a secure channel between the SDN controller and the switch and communicating. The OpenFlow switch uses the flow table as the basis for data forwarding. When the switch receives the message, it searches the flow...

AI Technical Summary

Problems solved by technology

[0006] Aiming at the above-mentioned deficiencies in the prior art, a DDoS attack defense method and defense system of an SDN controller provided by the present invention solves how to accurately detect suspicious Packet-in messages under the policy of OpenFlow, and respond to them in real time. The problem of SDN controller attack defense

Images