DDoS defense system and method based on deep reinforcement learning under SDN

Abstract

The invention discloses a DDoS (Distributed Denial of Service) attack active defense system and method based on deep reinforcement learning under an SDN (Software Defined Network) architecture, and the system collects the state characteristics of an edge switch, extracts network characteristics from a dynamic environment through a near-end strategy optimization algorithm, and makes a defense decision for each flow, i.e., decides the allowed passing proportion of each flow, and enables normal flow to pass as much as possible. And malicious traffic is discarded, and deep reinforcement learning actions are verified through network constraint conditions, so that the robustness of the method is improved, and active defense against DDoS attacks is completed. The construction method is simple, flexible to implement and high in efficiency.

Description

technical field [0001] The invention belongs to the field of network security active defense under SDN, and in particular relates to a DDoS attack active defense system and method based on deep reinforcement learning under SDN architecture. Background technique [0002] The number of DDoS attack incidents is still increasing year by year, and with extremely high attack traffic and short attack duration, it is crucial to take timely defensive measures before such attacks rise. Due to the advantages of the software-defined network architecture in defending against DDoS attacks, such as flexible programming and control features, methods based on statistical models and machine learning models can effectively defend against DDoS attacks in software-defined networks (SDNs). But these methods are less real-time, and when the attack characteristics change, these methods need to re-collect samples and rebuild the model before the model becomes invalid. The advent of deep reinforceme...

AI Technical Summary

Problems solved by technology

Due to the advantages of software-defined network architecture in defending against DDoS attacks, such as flexible programming and control features, methods based on statistical models and machine learning models can effectively defend against DDoS attacks in software-defined networks (Software-Defined Network, SDN), However, these methods are weak in real-time, and when the attack characteristics change, these methods need to re-collect samples and rebuild the model before the model becomes invalid.

Images