Two-stage DDoS attack detection and defense method in software defined network

Abstract

The invention discloses a two-stage DDoS (Distributed Denial of Service) attack detection and defense method in a software defined network, which is characterized in that switch flow table data is acquired based on a northbound interface of a controller, direct features and derived features are extracted, a two-stage attack detection algorithm is designed by adopting an SPRT (Sequential Probability Ratio Test) and a Light Gradient Boosting Machine (Lightweight GBM) for attack detection, and the two-stage DDoS attack detection and defense method is applied to the software defined network. The SPRT first-level attack detection algorithm is used for quickly positioning an attack port in the early stage of an attack, the LightGBM second-level attack detection algorithm is used for specifically classifying the attack, attack defense filters attack traffic in real time by issuing a flow table rule, and a coarse-grained rule is used for quickly responding to the attack, so that the safety of a controller is protected; and the fine-grained rule is used for defending against a specific type of attack to prevent filtering of normal communication traffic, so that the security of the SDN network can be effectively protected when the DDoS attack occurs.

Description

technical field [0001] The invention belongs to the network security field of network attack detection and defense, and more specifically relates to a two-stage DDoS attack detection and defense method in a software-defined network. Background technique [0002] In traditional networks, network devices integrate a control plane with routing decision-making functions and a data plane for forwarding network traffic, and network operators need to independently configure traffic policies on each network device. In recent years, with the rapid development of the Internet, the traditional network structure has made the deployment and management of the traditional network more and more complicated and difficult. A more flexible and open network architecture is urgently needed, and the concept of SDN came into being. SDN is a new type of network architecture, including application plane, control plane and data plane. The biggest difference between SDN and traditional networks is th...

AI Technical Summary

Problems solved by technology

Current research often ignores the problem of controller resource exhaustion caused by cyber attacks

[0006]2. In the SDN network environment, due to the particularity of the controller, in addition to DDoS attacks, other malicious attacks such as Probe attacks and R2L attacks will also cause a large number of data packets Uploaded to the controller, causing a unique DDoS attack on the controller under the SDN network, threatening the security of the controller

Attacks involved in current research work do not take into account the diversity of attack types in SDN networks

[0007]3. The current research usually uses the controller to issue a flow table to prevent the forwarding of attack traffic after detecting the attack behavior. This method has the advantages of low overhead, flexible configuration and Efficient execution has the advantage, but if the defense rules issued are not targeted enough, it may cause the switch to discard normal data packets and affect network communication. Therefore, it is necessary to accurately classify attack types and design more targeted defense measures. To reduce the filtering of normal traffic by defense measures

Images