SDN flow table overflow attack detection and mitigation method based on machine learning

Abstract

The invention discloses an SDN flow table overflow attack detection and alleviation method based on machine learning, and belongs to the field of network security. The method comprises the following steps: polling an OpenvSwitch flow table item based on an OpenFlow protocol to form original data; analyzing each field of a flow table item, dividing the fields into two groups of 'feature' and 'identification', and calculating five features of the flow table item and labels belonging to 'elephant flow', 'mouse flow' and 'attack flow' in combination with a network measurement criterion to serve as an original data set; training a flow table item classification model by adopting supervised learning, and deploying the flow table item classification model in OpenvSwitch; monitoring the flow table occupancy rate by a real-time attack mitigation system in the OpenvSwitch, if the flow table occupancy rate exceeds a threshold value, judging that a flow table overflow attack occurs, predicting expelling scores of flow table items by the system through a model and ranks the scores, and deleting a certain number of flow table items in sequence to release the flow table space. The flow table overflow attack detection and mitigation method is high in detection rate, low in system overhead, compatible with the SDN environment and capable of achieving accurate detection and real-time mitigation of the flow table overflow attack.

Description

technical field [0001] The invention belongs to the field of computer network security, and in particular relates to a machine learning-based SDN flow table overflow attack detection and mitigation method. Background technique [0002] As an emerging network architecture, SDN decouples the network layer data and control plane in the traditional TCP / IP network, reduces the complexity of the data plane, enriches the functions of the control plane, and provides good programmability , which greatly facilitates application deployment and innovation in the field of computer networks; however, this new network structure also brings some unique security issues, and the security issues of SDN itself have received extensive attention. [0003] The simplified data plane in SDN is only responsible for the matching and forwarding of data packets, and this step is performed in the SDN switch. In an SDN switch, the flow table is the most critical component, responsible for storing data pa...

AI Technical Summary

Problems solved by technology

[0005] The present invention aims at the potential safety hazards of switch flow table overflow attacks faced in the SDN data plane, based on the goal of protecting SDN security and availability, and proposes a machine learning-based SDN flow table overflow attack detection and mitigation method

Images