Active defense method based on path and IP address hopping in SDN network

Abstract

The invention discloses an active defense method based on path and address hopping in an SDN network, and belongs to the field of mobile target defense. The method comprises the following steps: S1, asource host sending a data packet to a first switch; S2, judging whether the data packet is successfully matched with the flow table item or not, if yes, forwarding the data packet to a next hop switch, and entering a step S5; otherwise, the switch sending the Packet-In message to the controller, and executing the step S3; S3, the controller selecting a data packet transmission path and a virtualIP at the same time; S4, the controller generating a flow table rule according to the selected transmission path and the virtual IP, and issuing a flow table and a reverse flow table to each switch;and S5, judging whether the switch is a final switch or not, if yes, sending the data packet to a target host, and otherwise, entering the step S2. By utilizing the separation characteristic of the SDN network data layer and the control layer and the idea of active operation change in the MTD, the IP and the transmission path of the data packet are changed on the premise of not influencing the normal communication of the network, and the difficulty of an attacker in acquiring information is increased, so that the active defense capability of the system is improved.

Description

technical field [0001] The invention belongs to the field of mobile target defense, and more specifically relates to an active defense method based on path and address hopping in an SDN (Software Defined Network, software-defined network) network. Background technique [0002] Moving target defense (Moving Target Defense, MTD) is to use the dynamic and unpredictable network environment to increase the attack difficulty of the attacker and avoid the risk of being attacked as much as possible. In traditional network defense technologies, network configurations are generally static. Attackers can scout the network at any time to plan attacks, while defenders must remain on alert to defend against attacks, creating an unequal attack and defense situation. Constructing an active and dynamic network environment can narrow the gap between attack and defense asymmetry, but it will lead to reduced system availability, thus limiting the capability of MTD. [0003] The emergence of SD...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the defects of the prior art, the purpose of the present invention is to solve the technical problem that the prior art SDN network mobile target defense method has poor defense capabilities due to data packet IP exposure and data packet transmission information being tracked

Images