DDoS attack detection method based on SDN

Abstract

The invention relates to a DDoS attack detection method based on an SDN, belonging to the field of software defined networks. Normal and attack flow tables are collected in the SDN, and then the flow tables are processed; logistic regression, a support vector machine, K nearest neighbor, a decision tree, a random forest, integrated learning bagging, stochastic gradient, integrated learning Gradient and a limit gradient boosting tree are used for training the collected flow tables, and all optimal hyper-parameter models are put together; a function is called to calculate each index value, each value is put into a data model, an optimal parameter model is selected as a base model, and prediction results of the optimal model are integrated as a model; the collected flow tables are trained and predicted; the final integrated learning prediction result is obviously higher than the previous individual prediction result of each model; and finally, the trained integrated model is put into a controller, so that DDoS attack can be effectively detected, and effective defense can be carried out when an attack arrives.

Description

technical field [0001] The invention relates to an SDN-based DDoS attack detection method, which belongs to the field of software-defined networks. Background technique [0002] Software Defined Networking (SDN) is a new type of network architecture proposed by Stanford University in the United States. Compared with traditional networks, SDN realizes the separation of the data layer and the control layer. Distributed denial of service attacks (distributed denial of service attacks, DDoS) has been one of the main threats to Internet security. After multiple puppet hosts are controlled by the attacker, they send a large number of attack data packets to the victim host, consuming the resources of the target host and making the target host unable to provide services for legitimate users normally. DDoS attacks are simple to launch and highly harmful, making it difficult to be accurately and quickly detected and defended against. [0003] Due to the characteristics of the SDN ne...

AI Technical Summary

Problems solved by technology

DDoS attack detection based on machine learning: high accuracy, but most of the machine learning-based ones are simply one of the machine learning for training

DDoS attack detection based on statistical analysis: Obtain network traffic data for statistical distribution processing, only distribute IP addresses, but DDoS has many IP addresses for camouflage, and the number is huge, it is difficult to be accurate

Images