SDN abnormal flow detection method based on re-marking range method

A technology of abnormal flow rate and extremely poor re-scaling, applied in the direction of electrical components, transmission systems, etc., can solve problems such as influence, programming calculation Hurst exponent error, and influence on the final linear fitting convergence, so as to simplify the calculation method, simplify the implementation, and improve the The effect of computing speed

Active Publication Date: 2019-11-19
HARBIN ENG UNIV
View PDF5 Cites 3 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

However, according to the experimental research, it is found that the sampling interval of 100ms is used to collect sample points for the controller, and the value of the sample point is the number of data packets when the controller is working normally, and an error occurs when programming and calculating the Hurst index
The reason is that the controller flow sequence has many long-term continuous 0 values. When calculating the R / S sequence, since the range and standard deviation of the constant value sequence are both 0, meaningless values ​​are generated after division, which affects the convergence of the final linear fitting.
This problem will affect other user terminals even in traditional networks during periods of low traffic

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • SDN abnormal flow detection method based on re-marking range method
  • SDN abnormal flow detection method based on re-marking range method
  • SDN abnormal flow detection method based on re-marking range method

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0041] The technical solution of the present invention will be described in further detail below in conjunction with the accompanying drawings.

[0042] The invention relates to an abnormal flow detection algorithm of a software-defined network. In view of the defectives in the prior art, the technical problem to be solved by the present invention is:

[0043] For SDN traffic analysis, the R / S analysis method is used to simplify the calculation method and improve the calculation speed.

[0044] Solve the calculation error caused by the series continuing to be 0 when the flow is small.

[0045] Detect when anomalies occur.

[0046] The method should be less dependent on the specific hardware environment, and have specific parameter optimization for the specific network topology.

[0047]For the above purpose, the present invention provides a network traffic analysis method, which can better distinguish the traffic characteristics in the normal network state and the traffic c...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention discloses an SDN abnormal flow detection method based on a re-marking range method, and belongs to the technical field of computer network security. The method comprises the following steps: collecting the number of normal network flow packets of each node (including a controller and each user terminal) of the SDN, and respectively calculating the Hurst index of the normal network flow packets; storing and taking as a network normal index, and setting a threshold value of a normal state; collecting the number of network flow packets with certain known exception of each node, andcalculating the Hurst index of each node as the index of the exception; intercepting a forward sequence by using a window function and calculating a Hurst index of the forward sequence, and if a normal index is finally changed into a certain abnormal index, determining that the abnormality of the mode occurs and determining an abnormality occurrence time point. And if only the index change deviates from the normal value, but the similar abnormal index cannot be found, an exception except the known mode occurs, and an exception time point can be determined. According to the method, the flow state can be detected in real time, whether the flow is abnormal is judged, the abnormality occurrence time can be detected, and the security of the SDN network system is enhanced.

Description

technical field [0001] The invention belongs to the technical field of computer network security, and in particular relates to an SDN abnormal traffic detection method based on a remarking range method. Background technique [0002] Software Defined Network (SDN) is a new trend in the development of network forms. Its most important feature that is most different from traditional networks is the separation of data plane and control plane. This feature makes SDN more flexible and easy to maintain, and solves the main problem of decentralization and complexity of traditional network static architecture. The data plane and the control plane can be independently updated and iterated, and the two layers use a unified protocol communication interface to exchange instructions and data with each other. Especially in the case of large and complex network topologies, administrators are exempted from the task of manually reconfiguring network configuration and connections, improving e...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
IPC IPC(8): H04L29/06
CPCH04L63/1425H04L63/1416H04L63/1433H04L63/1408
Inventor 兰海燕孙建国潘昱辰赵国冬李思照关键高迪
Owner HARBIN ENG UNIV
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products