A ddos ​​attack detection system based on software defined network

Abstract

The invention discloses a DDoS attack detection method based on a software-defined network, and belongs to the technical field of software-defined network security defense. The detection system includes an attacking host, a victim host, an OpenFlow switch layer, and an SDN control layer. This method divides the detection process into two parts. First, the flow information passing through the border switch is counted on the switch at the edge of the network. According to the information entropy theory, the destination IP address and the degree of dispersion of single flow distribution are calculated. Alert, limit the flow rate of the relevant port, and start the SVM detection of the controller. By extracting the deep characteristics of the flow, it can detect the abnormal flow more accurately and guide the switch to discard it. The system combines the detection of the data plane and the control plane, improves the response time of the detection, reduces the burden of the controller, and has practical application value.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to the technical field of software-defined network security defense. Background technique [0002] With the development of cloud computing, big data and other emerging technologies, the network traffic is constantly increasing, and the traditional network architecture with IP as the core is difficult to meet the requirements of network scalability, management and flexibility. Software Defined Network (Software Defined Network, SDN) is a new type of network architecture, which was born in the research project of Stanford University in the United States. Its core idea is the separation of numerical control, concentrating the control functions of the network on the controller, and endowing the network with programmability. Guide the data forwarding of the bottom switch, thereby improving the flexibility and scalability of the network, and making it more convenient for the mana...

AI Technical Summary

Problems solved by technology

[0004] At present, the SDN-based DDoS attack detection scheme mainly obtains the flow table information of the switches in the entire network periodically through the controller, and runs anomaly detection algorithms based on statistics and machine learning to detect abnormal attacks. The expansion of the network scale will bring a greater burden to the controller, resulting in delays in attack detection

Images