DDoS attack detection system based on software-defined network

Abstract

The invention discloses a DDoS attack detection method based on a software-defined network, and belongs to the technical field of software defined network security defense. The detection system comprises an attack host, a victim host, an OpenFlow switch layer and an SDN control layer. According to the method, the detection process is divided into two parts, firstly, flow information passing through a boundary switch is counted on a switch at the edge of a network; according to an information entropy theory, a destination IP address and the dispersion degree of uniflow distribution are calculated, and when an abnormality is found, a controller is warned, the flow rate of a related port is limited, SVM detection of the controller is started, and by extracting the depth characteristics of theflow, an abnormal flow is detected more accurately, and a switch is guided to discard the abnormal flow. According to the system, data plane detection and control plane detection are combined, the response time of detection is prolonged, the burden of a controller is reduced, and the system has practical application value.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to the technical field of software-defined network security defense. Background technique [0002] With the development of cloud computing, big data and other emerging technologies, the network traffic is constantly increasing, and the traditional network architecture with IP as the core is difficult to meet the requirements of network scalability, management and flexibility. Software Defined Network (Software Defined Network, SDN) is a new type of network architecture, which was born in the research project of Stanford University in the United States. Its core idea is the separation of numerical control, concentrating the control functions of the network on the controller, and endowing the network with programmability. Guide the data forwarding of the bottom switch, thereby improving the flexibility and scalability of the network, and making it more convenient for the mana...

AI Technical Summary

Problems solved by technology

[0004] At present, the SDN-based DDoS attack detection scheme mainly obtains the flow table information of the switches in the entire network periodically through the controller, and runs anomaly detection algorithms based on statistics and machine learning to detect abnormal attacks. The expansion of the network scale will bring a greater burden to the controller, resulting in delays in attack detection

Images