Low-network-overhead accurate and fast monitoring method for SDN traffic abnormity

Abstract

According to the low-network-overhead accurate and rapid monitoring method for the SDN traffic anomaly, the KNN algorithm is improved, the Relief algorithm is optimized to perform feature weighting and distance weighting on the original KNN algorithm, when classification is performed, the improved algorithm can well reflect that different features have different contribution degrees during classification decision making, and meanwhile, the algorithm can be used for performing classification on the basis of the Relief algorithm; in the classification decision making process, a traditional voting calculation mode is not adopted any more, the distance is subjected to weighted summation, and the error influence caused by uneven sample distribution is effectively relieved. Secondly, optimizing a flow abnormity monitoring mechanism, designing a monitoring triggering mechanism based on PacketIn message abnormity, judging whether the quantity of PacketIn messages is abnormal or not in a certain time by adopting a data flow abnormity monitoring algorithm so as to trigger a flow table information collection mechanism, and compared with a method for monitoring the flow abnormity regularly, the flow abnormity monitoring method has the advantages that the flow abnormity monitoring efficiency is greatly improved; the mechanism has obvious advantages in monitoring response time, system load and network bandwidth occupation.

Description

Technical Field

[0001] The present application relates to a method for accurately and quickly monitoring SDN traffic anomalies, and in particular to a method for accurately and quickly monitoring SDN traffic anomalies with low network overhead, belonging to the technical field of network traffic anomaly monitoring. Background Art

[0002] With the rise of intelligent information technologies such as virtual reality, smart home, and autonomous driving, and the gradual popularization of technologies such as cloud computing and the Internet of Things, Internet business types and network traffic have experienced a spurt in growth. Service providers need to invest huge amounts of money and manpower to meet the needs of hundreds of millions of users. With the growing demand for business scale, how to accelerate product launches, improve service quality, and ensure network security has become a focus of research and development for various companies and organizations.

[0003] The traditional network architecture represented by the TCP / IP protocol suite has made great contributions to the development of the Internet. However, the development of data center mergers, server virtualization, new application architectures, and cloud computing has already overwhelmed the traditional network architecture, which is under tremendous pressure. Network administrators need to spend a lot of time on network maintenance and equipment upgrades, which reduces the efficiency of business deployment and increases the operating costs of enterprises. Therefore, under the new situation, the traditional network architecture has gradually begun to hinder the development of network services.

[0004] In order to adapt to the growing demand for network services, software-defined networking (SDN) has been proposed as a new network architecture that is different from traditional networks. The most essential feature of SDN is the separation of the control plane and the forwarding plane, which realizes network programmability and centralized network control. However, these features bring convenience to the network while also exposing some new security threats. Therefore, exploring effective solutions to enable SDN to maximize its own advantages while ensuring the security and stable operation of the network itself is of great significance and role in promoting the long-term development of SDN.

[0005] The problems that need to be solved in the existing SDN traffic anomaly monitoring technology and the key technical difficulties of this application include:

[0006] (1) The current network architecture maintains a large number of proprietary devices with complicated configurations, and the complex built-in protocols make maintenance and upgrades increasingly difficult. SDN enables the network to have centralized control capabilities and programmability, and software programs can flexibly and effectively manage and operate the network, but these characteristics also expose some new security threats, among which the traffic anomaly problem caused by network attacks is particularly serious. In the existing traffic anomaly monitoring methods, it is impossible to apply the network's machine learning method to the SDN network, and it is impossible to fully utilize its fine-grained control capabilities of the network, and it is impossible to timely and accurately identify unknown security risks in the network. Although the K-nearest neighbor algorithm based on distance measurement in the existing technology has the advantages of no need for sample learning and few estimated parameters, for complex and changeable network traffic, the algorithm itself ignores the fact that the importance of different features also varies greatly, resulting in unsatisfactory classification results. In addition, the existing monitoring method adopts a periodic monitoring method. Although it can effectively identify most traffic anomaly problems, there are problems such as slow response time and high system and network overhead during the execution of the method. There is a lack of optimization in the classification algorithm and monitoring trigger mechanism for traffic anomaly monitoring problems, and it is impossible to reduce the network and system load while improving the monitoring accuracy.

[0007] (2) In terms of traffic classification algorithms, the existing technology lacks an improved K-nearest neighbor algorithm, cannot analyze the difference in the impact of different features of SDN network traffic on type discrimination, lacks an optimized Relief algorithm to solve the weight vector that measures the degree of feature contribution, lacks the introduction of feature weight vectors into the distance calculation of the K-nearest neighbor algorithm, and cannot achieve traffic type classification by accumulating distance voting weights. In terms of the monitoring trigger mechanism, it is impossible to analyze the internal message characteristics of the abnormal condition controller, lacks the number of Packet_In messages as the basis for judging the monitoring trigger, and cannot use the distance-based data flow anomaly monitoring algorithm to monitor the number of Packet_In messages to trigger the monitoring mechanism. Using the monitoring rate and false alarm rate as evaluation criteria to test under different detection samples, the existing technology method has poor classification effect. Due to the lack of comparison period monitoring method and the introduction of trigger mechanism, the existing technology method has a long response time and large hardware network overhead.

[0008] (3) SDN realizes network programmability and centralized network control, but these features bring convenience to the network while also exposing some new security threats. Traffic anomaly monitoring is very important in SDN security issues. The existing technology uses a timed collection method to collect flow table information, which makes the monitoring system have a long response time and a high network load. The existing technology lacks optimization of the KNN algorithm and the Relief algorithm to perform feature weighting and distance weighting on the original KNN algorithm. It cannot well reflect the different contributions of different features in classification decisions. When making classification decisions, the traditional calculation voting method is adopted, and the error caused by uneven sample distribution is easy to be affected. The existing technology lacks optimization of the traffic anomaly monitoring mechanism, lacks a monitoring trigger mechanism based on Packet_In message anomalies, lacks a data flow anomaly monitoring algorithm to determine whether there is an anomaly in the number of Packet_In messages within a certain period of time, lacks a trigger flow table information collection mechanism, and cannot meet application requirements in terms of monitoring response time, system load and network bandwidth occupancy. SDN traffic anomaly monitoring has low accuracy, slow speed, and high network overhead. Summary of the invention

[0009] This application analyzes and summarizes the shortcomings and deficiencies of existing monitoring methods, and designs a set of traffic anomaly monitoring solutions based on SDN based on the characteristics of SDN and the characteristics of traffic anomalies. The characteristics of SDN network architecture and OpenFlow standards are deeply analyzed, and the traffic anomaly threats and monitoring methods existing in traditional network architecture are summarized. By analyzing the security opportunities and security threats brought by the characteristics of SDN, a monitoring solution for traffic anomalies caused by attacks in SDN networks is established. This solution uses the characteristics of SDN network traffic and uses a data flow anomaly monitoring method to monitor Packet_In data packet anomalies to trigger the flow table information collection mechanism. Then, by extracting the five-tuple of flow table features, the KNN algorithm is used to identify whether the network traffic is abnormal. An improved KNN algorithm based on feature and distance weighting is proposed, and the Relief algorithm is optimized to calculate the weight of each feature of the sample. The weight consideration is added to the distance calculation of the KNN algorithm, so that it overcomes the shortcomings of the KNN algorithm and improves the classification accuracy. A network environment platform for accurate and fast monitoring of SDN traffic anomalies was built. The monitoring rate and false alarm rate were used as evaluation criteria. By comparing with other methods, it was verified that the application method has better recognition effect and SDN traffic anomaly monitoring is accurate and fast.

[0010] In order to achieve the above technical effects, the technical solutions adopted in this application are as follows:

[0011] The invention provides a precise and fast monitoring method for SDN traffic anomalies with low network overhead. The classification algorithm and monitoring trigger mechanism are optimized respectively for the problem of traffic anomaly monitoring. In the traffic classification algorithm, the K nearest neighbor algorithm is improved and the influence of different characteristics of SDN network traffic on type discrimination is analyzed. The Relief algorithm is optimized to solve the weight vector that measures the contribution of the feature. The feature weight vector is introduced into the distance calculation of the K nearest neighbor algorithm. The traffic type classification is realized by accumulating the distance voting weight. In the monitoring trigger mechanism, the characteristics of the internal messages of the abnormal condition controller are analyzed, and the number of Packet_In messages is used as the basis for judging the monitoring trigger. The distance-based data flow anomaly monitoring algorithm is used to monitor the abnormal number of Packet_In messages to trigger the monitoring mechanism. Compared with the periodic monitoring method, the introduction of the trigger mechanism enables the method of the present application to have a shorter response time and lower hardware network overhead.

[0012] 1) Establish a monitoring solution for traffic anomalies in SDN environment, which is divided into four modules: the monitoring trigger module determines whether to start flow table information collection by judging whether the number of Packet_In messages is abnormal, including three aspects: trigger rules, anomaly judgment and trigger process; the flow table information collection module uses controller query messages to collect flow table status information from switches; the traffic feature extraction module calculates the flow table status information, and calculates the median MPf of flow packets, the convection ratio PPf, the port growth rate GDP, the median MBf of flow bytes, and the source IP generation speed GDS to form a five-dimensional traffic feature vector; the traffic monitoring classification module uses the improved KNN algorithm based on features and distance weighting to judge the type of traffic, and finally identifies whether the network traffic is abnormal;

[0013] 2) Construct an improved KNN traffic anomaly monitoring platform in the SDN environment, improve the original KNN algorithm, propose an improved KNN algorithm that adds feature weights and distance voting weights, optimize the Relief algorithm to calculate the weight of each feature, use the distance association factor to represent the voting weight when performing classification calculations, and use the improved KNN algorithm to perform the classification process, and establish an accurate and fast SDN traffic anomaly monitoring platform.

[0014] Preferably, the traffic anomaly monitoring in the SDN environment of improved KNN is as follows: firstly, the Relief algorithm is optimized to calculate the weight of each feature, and when performing classification calculation, the distance association factor is used to represent the voting weight, and finally the improved KNN algorithm is used to perform the classification process. The specific classification method is as follows:

[0015] (1) Let the correctly classified sample set be trained_set = {y1, y2, ..., y m}, where y i ={y i1 ,y i2, …, y ip , c}, the feature set is {r1, r2, …, r p}, c represents the category to which the sample belongs, and the detection set is also set to test_set = {x1, x2, ..., x n};

[0016] (2) The feature vectors in the detection samples are normalized according to Formula 1 to prevent small data from being annihilated by large data, where r max and r min Respectively represent the maximum and minimum values ​​of feature i in the training set, r max represents the maximum value of i among all samples, r min Represents the minimum value of i among all samples:

[0017]

[0018] (3) The Relief algorithm is used to calculate the weights of the normalized features using Formula 2 to obtain the feature weight vector {λ1, λ2, …, λ p}, use the feature weights to calculate the distance between samples, the sample to be tested x i and training samples y i The distance calculation method is as follows:

[0019]

[0020] (4) Calculate the sample x to be tested i The distance value from all samples in trained_set, select k of them that are close to x i The closest value is denoted as d i1 , d i2 , …, d ik When counting voting is required, the voting value is no longer divided equally, but the voting weight is used as the basis for type discrimination. The voting weight of the mth training sample is:

[0021]

[0022] (5) Calculate the voting weights ω of the two categories in the k nearest neighbor samples im The sum of x i Divide into the category with greater voting weight.

[0023] Preferably, the abnormal traffic monitoring technology route is: monitoring the controller when it is attacked by traffic, instantiating it as an application running on the SDN controller, collecting network-related data for traffic anomaly monitoring through centralized management of the controller;

[0024] The invention is divided into four modules, namely: a monitoring trigger module, a flow table information collection module, a traffic feature extraction module and a traffic monitoring classification module. The monitoring trigger module triggers traffic monitoring, and determines whether the system needs to perform traffic anomaly monitoring by calculating whether the number of Packet_In messages within a period of time is abnormal. The flow table information collection and monitoring are started only after the number of Packet_In messages is abnormal. The flow table information collection module sends a query request message to all switches in the network, and the switch responds to the query reply message after receiving the request. The traffic feature extraction module calculates the associated traffic feature value according to the flow table status information returned by the switch, and forms a training sample set according to normal traffic and abnormal traffic. The traffic monitoring classification module classifies the network traffic according to the training sample set by using the improved KNN classification algorithm based on feature and distance weighting of the present application, and monitors whether the traffic is abnormal. When there is a traffic anomaly, the system issues an alarm, and the controller takes further measures to prevent the spread of the attack.

[0025] Preferably, the triggering rule is: when the switch receives a message, it will query the flow table to match the flow table entry. If there is no matching flow table entry, the data packet will be encapsulated into a Packet_In message and sent to the SDN controller via a secure channel by the switch. The Packet_In message structure is as follows. After receiving the message, the controller decides whether to discard the data packet or return a response message to establish a new flow table entry for the data packet. If the controller has not processed such messages, the switch will frequently hand over the messages to the controller for processing;

[0026] When the SDN network traffic becomes abnormal due to a network attack, a large number of attack packets with forged IP addresses in the network cannot match the flow table entries, and the controller continuously receives Packet_In messages from the switch. At this time, the number of messages in the controller will be obviously abnormal, but such abnormalities are not enough to indicate that the network is under a traffic attack. When there are multiple switches in the SDN network, a single switch cannot maintain all the flow table entries in the network, so some normal packets cannot be matched in the switch. Therefore, the switch will generate a large number of Packet_In messages. In this case, subsequent monitoring steps are required to further determine whether the network is abnormal.

[0027] Preferably, abnormality judgment: the abnormal number of Packet_In messages is used as the basis for judging the triggering of the monitoring system, and the sliding window model is used to judge whether the object is abnormal by judging the distance between the object to be monitored and other objects in the window at a certain time. The number of Packet_In messages within a fixed time is calculated as the object to be monitored, and a message quantity data stream can be generated. The algorithm is used for abnormality monitoring to judge whether the Packet_In message in the network is abnormal;

[0028] Let S be a set of n objects, S = {obj1, obj2, ..., obj n}, obj i is a specific object in S, let the positive integer k and the positive real number R, for an object obj i , when there are less than k objects in the set and the distance between them is less than R, the object obj is judged i The outliers are judged based on the distance. In a data stream, the stream data is regarded as the object in S. New data is constantly added to the stream, and the size of the object set is also expanded. The computational complexity and space complexity of the method increase linearly with the set. When a sliding window is added, only the outliers in the window are calculated each time. The legal object in the current window has at least k adjacent objects (the distance is less than R). Among the neighboring objects in the current window, there is a i appears in the monitored object obj i Before and b i appears after it, when a i +b i ≥k, the object to be monitored obj i is a legal value, but as the window slides, obj i The object in front keeps jumping out of the window, making a i decreases, resulting in a i +b i <k, then obj i From a legal value to an abnormal value, only when obj i Existence i When ≥k, the object is an absolutely safe object;

[0029] Judgment of abnormal number of Packet_In messages: The ISB queue is used to represent the current sliding window. ISB is a collection of object nodes in the data stream, that is, ISB = {n1, n2, ..., n w}, w is the window size, node n is a record in the data stream, and its attribute structure is n = {obj, id, count_after, nn_before}, where the meaning of each attribute is: obj represents the number of Packet_In messages, id represents the sequence number of the record, count_after represents the number of adjacent nodes after the node in the window, and nn_before represents the set of adjacent nodes before the node in the window;

[0030] The specific process of judging the abnormal number of Packet_In messages is as follows:

[0031] Step 1: Set the distance threshold as R, the neighboring node quantity threshold as k, the currently calculated number of Packet_In messages as m, and remove the node at the head of the current window ISB;

[0032] Step 2: Create a new node n curr , where n curr .obj = m, n curr .count_after = 1,

[0033] n curr .nn_before = {}, n curr .id = t;

[0034] Step 3: Traverse each node n in the ISB. If |n.obj - m| < R, then increment n.count_after by 1 and add n.id to the set n.nn_before. Then add n to the ISB;

[0035] Step 4: For each node n in the ISB j , set pre_neighs equal to the length of the set n.nn_before, succ_neighs = n.count_after. If (pre_neighs + succ_neighs) < k, then mark it as an outlier, otherwise mark it as a legitimate value; j j Mark whether each node in the sliding window at a certain moment is an outlier. For the newly added node at the tail of the queue, if this node is an outlier, it indicates that the currently calculated number of Packet_In messages is also an outlier, and then the monitoring system is triggered to start the subsequent monitoring process.

[0036] Preferably, the triggering process: The triggering module calculates the number of Packet_In messages within a certain time as the input of the outlier judgment algorithm for calculation, and judges whether its value is an outlier. First, set a timer and a counter. When there is a new Packet_In message in the controller, the counter is incremented and check whether the timer has ended. If the timing has not ended, then transfer this message to the controller for processing. Otherwise, the counter stops counting. Then use the counter value as the input, call the outlier judgment algorithm to judge the outlier value. If this value is an outlier, then start the subsequent monitoring module. Otherwise, transfer this message to the controller for processing, then reset the counter to zero and start a new round of timing.

[0037]

[0038] Preferably, the flow table information collection module: performs correlation information calculation for the flow table items of the switch, the controller sends an ofp_stats_request message to request the flow table status of the switch, and after receiving the message, the switch collects the flow table information and responds to the request of the controller through an ofp_stats_reply message, and the ofp_stats_request and ofp_stats_reply message structures are the same;

[0039] Set the collection interval to 5 seconds, extract data from the flow table status information after obtaining it, improve the efficiency of monitoring by the monitoring module, and set a 12-tuple in the flow table entry matching field to match data packets and flow table entries;

[0040] In the twelve-tuple, basic network five-tuple information is required, and counters in the flow table items are also needed to calculate the number of associated data packets and bytes, extract and reconstruct the relevant data, and send it to the feature extraction module to calculate the features.

[0041] Preferably, the traffic feature extraction module: the feature parameters used include feature angle and the source IP generation speed GDS is added as a supplement. The five features fully reflect the characteristics of traffic changes in the network from different angles, as follows:

[0042] (1) Median MPf of flow packets:

[0043] The median number of packets forwarded by each flow table entry within 5 seconds is taken as the first dimension of the feature vector. When the network is attacked by traffic, the attacker will forge the source IP address in the data flow. Compared with the normal state, the number of packets contained in each flow will be significantly reduced. The median flow packet calculation formula is:

[0044]

[0045] In formula 4, M(t) represents the median of the flow packets at time t, x i It represents the number of packets forwarded in the ith flow entry after all flow entries are sorted according to the number of packets at time t. n represents the total number of flow entries. The calculation formula of MPf is:

[0046] MPf=M(t+5)-M(t) Formula 5

[0047] The median objectively reflects the data flow in the network;

[0048] (2) Flow ratio PPf: In SDN, interactive flow table entries appear in pairs. Suppose there are two data flows X and Y in the network. When X and Y meet the following three conditions:

[0049] 1) X's destination IP address is the same as Y's source IP address;

[0050] 2) X's source IP address is the same as Y's destination IP address;

[0051] 3) X and Y use the same communication protocol;

[0052] At this time, X and Y are called a pair of convection flows. When sending traffic attacks, the attacker will send a large number of unidirectional flows with forged source IPs to the network, and the proportion of convection flows in the network will be significantly reduced. PPf defines the proportion of flow table entries belonging to convection flows to all flow table entries. PPf is used as the second dimension of the feature vector. The specific calculation formula is as follows:

[0053]

[0054] Where pairFlowNum represents the number of pairs of flows generated in the network within 5 seconds, and flowNum is the total number of flow entries in the flow table;

[0055] (3) Port growth rate GDP

[0056] Taking the port speed as the third dimension of the characteristic parameter, the calculation formula is as follows:

[0057]

[0058] Where numPort i is the number of ports added in the ith flow table entry within 5 seconds, n is the total number of flow table entries in the flow table, and interval represents the time interval, which is set to 5 seconds in this application;

[0059] (4) Median of stream bytes MBf

[0060] The median of the flow bytes is used as the fourth dimension of the feature vector. Each flow entry is sorted according to the number of bytes transmitted within 5 seconds, and the median is taken. The formula is as follows:

[0061]

[0062] MBf=M(t+5)-M(t) Formula 9

[0063] Where y i It represents the number of forwarding bytes of the i-th flow table entry sorted by byte number at time t, n is the total number of flow table entries, and M(t) represents the median of flow bytes in the flow table at time t.

[0064] Preferably, the traffic monitoring and classification module: in the SDN, according to the collected traffic features, uses an associated classification algorithm to classify the traffic, determines whether the traffic at that moment is normal traffic or abnormal traffic, and uses an improved KNN algorithm that adds features and distance weights to complete the traffic classification;

[0065] The specific process of traffic monitoring is: first, the traffic information collection module in the controller collects the switch flow table information every 5 seconds under normal traffic environment and abnormal traffic environment respectively; the traffic feature extraction module calculates the associated feature parameters to form feature vectors; and then these feature vectors are respectively formed into normal traffic training sample sets and abnormal traffic training sample sets; the traffic monitoring classification module optimizes the Relief algorithm to calculate the weight of each feature to form a weight vector, and completes the initialization of the monitoring system; when the network needs to monitor traffic anomalies, the controller collects network traffic in real time and calculates feature vectors, and uses them as detection samples for classification using the improved classification algorithm of this application; when the traffic in the network is detected to be abnormal at this moment, the controller issues an alarm and takes further measures to avoid the spread of danger.

[0066] Compared with the prior art, the innovations and advantages of this application are:

[0067] (1) This application analyzes and summarizes the shortcomings and deficiencies of existing monitoring methods, and designs a set of traffic anomaly monitoring solutions based on SDN based on the characteristics of SDN and the characteristics of traffic anomalies. The characteristics of SDN network architecture and OpenFlow standards are deeply analyzed, and the traffic anomaly threats and monitoring methods existing in traditional network architecture are summarized. By analyzing the security opportunities and security threats brought by the characteristics of SDN, a monitoring solution for traffic anomalies caused by attacks in SDN networks is established. This solution utilizes the characteristics of SDN network traffic and uses a data flow anomaly monitoring method to monitor Packet_In data packet anomalies to trigger the flow table information collection mechanism. Then, by extracting the five-tuple of flow table features, the KNN algorithm is used to identify whether the network traffic is abnormal. An improved KNN algorithm based on feature and distance weighting is proposed, and the Relief algorithm is optimized to calculate the weight of each feature of the sample. The weight consideration is added to the distance calculation of the KNN algorithm, so that it overcomes the shortcomings of the KNN algorithm and improves the classification accuracy. A network environment platform for accurate and fast monitoring of SDN traffic anomalies was built. The monitoring rate and false alarm rate were used as evaluation criteria. By comparing with other methods, it was verified that the application method has better recognition effect and SDN traffic anomaly monitoring is accurate and fast.

[0068] (2) This application designs a set of traffic anomaly monitoring solutions based on SDN, and improves the classification monitoring algorithm therein. The first is the improvement of the KNN algorithm. It proposes to optimize the Relief algorithm to perform feature weighting and distance weighting on the original KNN algorithm. When performing classification, the improved algorithm can well reflect the different contributions of different features in classification decisions. At the same time, when making classification decisions, the traditional method of calculating voting is no longer used, but the weighted summation of distances is performed, which effectively alleviates the error caused by uneven sample distribution. The second is the optimization of the traffic anomaly monitoring mechanism. A monitoring trigger mechanism based on Packet_In message anomalies is designed. The data flow anomaly monitoring algorithm is used to determine whether there is an anomaly in the number of Packet_In messages within a certain period of time, thereby triggering the flow table information collection mechanism. Compared with the method of periodically monitoring traffic anomalies, this mechanism has obvious advantages in monitoring response time, system load and network bandwidth occupancy.

[0069] (3) This application will optimize the classification algorithm and monitoring trigger mechanism for the problem of traffic anomaly monitoring, and further improve the monitoring accuracy while reducing the network and system load as much as possible. In the traffic classification algorithm, the improved K nearest neighbor algorithm analyzes the difference in the impact of different characteristics of SDN network traffic on type discrimination, optimizes the Relief algorithm to solve the weight vector that measures the contribution of the feature, introduces the feature weight vector into the distance calculation of the K nearest neighbor algorithm, and realizes the traffic type classification by accumulating the distance voting weight. In the monitoring trigger mechanism, this application analyzes the internal message characteristics of the abnormal condition controller, takes the number of Packet_In messages as the basis for judging the monitoring trigger, and uses the distance-based data flow anomaly monitoring algorithm to monitor the number of Packet_In messages to trigger the monitoring mechanism. By designing SDN simulation experiments and using the monitoring rate and false alarm rate as evaluation criteria, it is verified that the method of this application has better classification effect than other methods under different detection samples. Compared with the periodic monitoring method, the introduction of the trigger mechanism enables the method of this application to have a shorter response time and lower hardware network overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 It is a schematic diagram of the abnormal traffic monitoring technology route.

[0071] Figure 2 This is a schematic diagram of the sliding window for instance anomaly judgment.

[0072] Figure 3 It is the trigger module workflow diagram.

[0073] Figure 4 This is a schematic diagram of the 12-tuple of flow table matching fields.

[0074] Figure 5This is a schematic diagram of the data format extracted by the flow table information collection module.

[0075] Figure 6 This is the flow chart of the traffic anomaly monitoring solution for this application.

[0076] Figure 7 It is a schematic diagram of the detection results of the method of the present application when k takes different values.

[0077] Figure 8 It is a schematic diagram comparing the method of the present application and the SVM method when the training samples are different. DETAILED DESCRIPTION

[0078] The following, in conjunction with the accompanying drawings, further describes the technical solution of the method for accurately and quickly monitoring SDN traffic anomalies with low network overhead provided by the present application, so that those skilled in the art can better understand the present application and implement it.

[0079] With the vigorous development of Internet technology and network service applications, the types of Internet services and the scale of traffic have experienced a blowout growth. The increasingly diverse user needs have put forward higher requirements for service quality and security. In this environment, the current network architecture maintains a large number of proprietary devices with cumbersome configurations, and the complex built-in protocols make maintenance and upgrades increasingly difficult. The emergence of SDN (Software Development Network) separates the control layer from the data layer, giving the network centralized control capabilities and programmability, and software programs can flexibly and effectively manage and operate the network. At the same time, these characteristics have also exposed some new security threats, among which the traffic anomaly problem caused by network attacks has attracted widespread attention and research. Among the existing traffic anomaly monitoring methods, the machine learning method of traditional networks is applied to SDN networks, making full use of its fine-grained control capabilities of the network, and can timely and accurately identify unknown security risks in the network.

[0080] Although the K-nearest neighbor algorithm based on distance measurement has the advantages of not requiring sample learning and having few estimated parameters, for complex and changeable network traffic, the algorithm itself ignores the fact that the importance of different features also varies greatly, resulting in generally unsatisfactory classification results. In addition, the existing monitoring methods use a periodic monitoring method. Although it can effectively identify most traffic anomalies, there are problems such as slow response time and high system and network overhead during the execution of the method. This application will optimize the classification algorithm and monitoring trigger mechanism for the traffic anomaly monitoring problem, while further improving the monitoring accuracy and reducing the network and system load as much as possible.

[0081] In terms of traffic classification algorithms, the improved K-nearest neighbor algorithm of this application analyzes the differences in the impact of different characteristics of SDN network traffic on type discrimination, uses the Relief algorithm to solve the weight vector that measures the degree of feature contribution, introduces the feature weight vector into the distance calculation of the K-nearest neighbor algorithm, and realizes traffic type classification by accumulating distance voting weights. In terms of the monitoring trigger mechanism, this application analyzes the internal message characteristics of the abnormal condition controller, uses the number of Packet_In messages as the basis for judging monitoring triggers, and uses a distance-based data flow anomaly monitoring algorithm to monitor the number of Packet_In messages to trigger the monitoring mechanism. By designing SDN simulation experiments and using monitoring rate and false alarm rate as evaluation criteria, it is verified that the method of this application has better classification effects than other methods under different detection samples. Compared with the periodic monitoring method, the introduction of the trigger mechanism enables the method of this application to have a shorter response time and lower hardware network overhead.

[0082] 1. Improve KNN for traffic anomaly monitoring in SDN environment

[0083] The traffic of SDN is monitored for abnormalities. By collecting traffic data, a classification algorithm is used to distinguish whether the current network traffic is abnormal. However, the classification algorithms in the prior art all have their own shortcomings. For the traffic classification problem in SDN, this application will be based on the KNN algorithm and improved by the Relief algorithm to achieve better classification effect.

[0084] Improvements are made to the original KNN algorithm: First, the Relief algorithm is optimized to calculate the weight of each feature. When performing classification calculations, the distance association factor is used to represent the voting weight. Finally, the improved KNN algorithm is used to perform the classification process. The specific classification method is as follows:

[0085] (1) Let the correctly classified sample set be trained_set = {y1, y2, ..., y m}, where y i ={y i1 ,y i2 , …, y ip , c}, the feature set is {r1, r2, …, r p}, c represents the category to which the sample belongs, and the detection set is also set to test_set = {x1, x2, ..., x n};

[0086] (2) The feature vectors in the detection samples are normalized according to Formula 1 to prevent small data from being annihilated by large data, where r max and r min Respectively represent the maximum and minimum values ​​of feature i in the training set, r max represents the maximum value of i among all samples, rmin Represents the minimum value of i among all samples:

[0087]

[0088] (3) The Relief algorithm is used to calculate the weights of the normalized features using Formula 2 to obtain the feature weight vector {λ1, λ2, …, λ p}, use the feature weights to calculate the distance between samples, the sample to be tested x j and training samples y j The distance calculation method is as follows:

[0089]

[0090] (4) Calculate the sample x to be tested i The distance value from all samples in trained_set, select k of them that are close to x i The closest value is denoted as d i1 , d i2 , …, d ik When counting voting is required, the voting value is no longer divided equally, but the voting weight is used as the basis for type discrimination. The voting weight of the mth training sample is:

[0091]

[0092] (5) Calculate the voting weights ω of the two categories in the k nearest neighbor samples im The sum of x i Divide into the category with greater voting weight.

[0093] The Relief algorithm is optimized to evaluate the different contributions of each feature in the classification, and the feature weight vector is obtained. When calculating the sample distance, the feature weight is added for calculation, which effectively overcomes the error defect caused by the traditional KNN algorithm that all features have the same contribution, and reduces the impact of noise. At the same time, when making classification decisions, the traditional counting method is no longer used, but the distance is weighted and summed. When the sample distribution is unbalanced, the number of samples of the large proportion class within the k nearest neighbor range of the sample to be tested usually exceeds the number of samples of the small proportion class to be tested. By giving larger weights to training samples closer to the sample to be tested, the misclassification problem caused by the unbalanced sample distribution can be effectively alleviated.

[0094] 2. Abnormal traffic monitoring technology route

[0095] The security threats of SDN include traffic attacks on the controller and information theft by exploiting the security channel loopholes between the controller and the switch. Monitoring traffic anomalies in SDN is to monitor the controller when it is attacked by traffic. It is instantiated as an application running on the SDN controller. Through the centralized management of the controller, network-related data is collected to monitor traffic anomalies.

[0096] It is divided into four modules: monitoring trigger module, flow table information collection module, traffic feature extraction module and traffic monitoring classification module. The process relationship between the modules is as follows: Figure 1 As shown. The monitoring trigger module triggers traffic monitoring, and determines whether the system needs to perform traffic anomaly monitoring by calculating whether the number of Packet_In messages within a period of time is abnormal. Only when the number of Packet_In messages is abnormal, flow table information collection and monitoring begins. Compared with the mechanism of collecting flow table information at a fixed time, it can effectively reduce the number of times the controller sends flow table query requests, thereby reducing the load on system resources; the flow table information collection module sends a query request message to all switches in the network, and the switch responds to the query reply message after receiving the request; the traffic feature extraction module calculates the associated traffic feature value based on the flow table status information returned by the switch, and forms a training sample set based on normal traffic and abnormal traffic; the traffic monitoring classification module classifies the network traffic based on the training sample set using the improved KNN classification algorithm based on feature and distance weighting in this application, and monitors whether the traffic is abnormal. When there is a traffic anomaly, the system issues an alarm, and the controller takes further measures to prevent the spread of the attack.

[0097] 3. Monitoring trigger module

[0098] Under SDN, due to the real-time nature of network traffic, the state of the network is also changing dynamically. When to trigger the monitoring mechanism to analyze and identify traffic in a timely manner will greatly affect the monitoring efficiency and system performance. The existing technology adopts the method of periodically initiating monitoring. By setting a timer, traffic anomaly monitoring is performed every same time period. However, there are many disadvantages in the periodic method. First, the monitoring system is an instantiated application running on the controller platform. The periodic operation of the monitoring system will increase a large amount of data interaction between the controller and the switch, which brings additional load to the controller and the security channel. Secondly, choosing an appropriate monitoring interval becomes an important factor in determining the monitoring efficiency. If the time interval is too long, the response time of the monitoring system will be longer. Before the monitoring system is triggered, the entire network will be in a state of being attacked for a long time. The controller needs to receive and process a large number of attack data packets, and the network will eventually be paralyzed before the attack is discovered; if the time interval is set too short, the controller will frequently initiate flow table query requests to the switch, and the switch will also need to respond continuously. The communication bandwidth of the security channel will be occupied by a large number of such query and response messages, which will increase the load of the controller and the security channel, and may even amplify the attack effect.

[0099] Therefore, the present application adopts a method of triggering the monitoring system according to the Packet_In message anomaly, which can monitor network traffic anomalies more quickly and effectively, including three aspects: triggering rules, anomaly judgment and triggering process.

[0100] (I) Triggering rules

[0101] When the switch receives a message, it will query the flow table to match the flow table entry. If there is no matching flow table entry, the data packet will be encapsulated into a Packet_In message and sent to the SDN controller via a secure channel. The Packet_In message structure is as follows. After receiving the message, the controller decides whether to discard the data packet or return a response message to create a new flow table entry for the data packet. If the controller has not processed such messages, the switch will frequently hand over the messages to the controller for processing;

[0102] When the SDN network traffic becomes abnormal due to a network attack, a large number of forged IP attack packets in the network cannot match the flow table entries, and the controller continuously receives Packet_In messages from the switch. At this time, the number of messages in the controller will be obviously abnormal, but such anomalies are not enough to indicate that the network is under a traffic attack, because when there are multiple switches in the SDN network, a single switch cannot maintain all the flow table entries in the network, so some normal data packets cannot be matched in the switch. Therefore, the switch will generate a large number of Packet_In messages. In this case, subsequent monitoring steps are required to further determine whether the network is abnormal.

[0103] (II) Abnormality judgment

[0104] The abnormal number of Packet_In messages is used as the basis for judging the triggering of the monitoring system. The sliding window model is used to judge whether the object is abnormal by judging the distance between the monitored object and other objects in the window at a certain time. The number of Packet_In messages within a fixed time is calculated as the monitored object, and a message quantity data stream can be generated. The algorithm is used for abnormal monitoring to determine whether the Packet_In message in the network is abnormal.

[0105] Let S be a set of n objects, S = {obj1, obj2, ..., obj n}, obj i is a specific object in S, let the positive integer k and the positive real number R, for an object obj i , when there are less than k objects in the set and the distance between them is less than R, the object obj is judged i The outliers are judged based on the distance. In a data stream, the stream data is regarded as the object in S. New data is constantly added to the stream, and the size of the object set is also expanded. The computational complexity and space complexity of the method increase linearly with the set. When a sliding window is added, only the outliers in the window are calculated each time. The legal object in the current window has at least k adjacent objects (the distance is less than R). Among the neighboring objects in the current window, there is a i appears in the monitored object obj i Before and b i appears after it, when a i +b i ≥k, the object to be monitored obj i is a legal value, but as the window slides, obj i The object in front keeps jumping out of the window, making a i decreases, resulting in a i +b i <k, then obj i From a legal value to an abnormal value, only when obj i Existence i When ≥k, the object is an absolutely safe object;

[0106] Exception judgment through examples: Figure 2It represents the monitoring method when the data is one-dimensional. Among them, k = 3, the window size W = 15. When the window slides to t18, within the distance R, t9 has four adjacent values (t5, t10, t14, t15), and t11 has four adjacent values (t3, t4, t6, t13), all of which are greater than k. Both the number t9 and t11 are legal values. However, when the window slides to t, the adjacent values of o9 within the distance R become (t10, t14, t15), and the adjacent value of t11 is (t13). Then t11 changes from a legal value to an outlier, and t11 is an absolutely safe value. By calculating the distance for all objects within the window after each slide of the sliding window, it is possible to monitor whether there are outliers in the data stream.

[0107] Judgment of abnormal number of Packet_In messages: Use the ISB queue to represent the current sliding window. ISB is a set of object nodes in the data stream, that is, ISB = {n1, n2,..., n w}, w is the window size, the node n is a record in the data stream, and its attribute structure is n = {obj, id, count_after, nn_before}, where the meaning of each attribute is: obj represents the number of Packet_In messages, id represents the serial number of this record, count_after represents the number of adjacent nodes after this node within the window, and nn_before represents the set of adjacent nodes before this node within the window;

[0108] The specific process for judging the abnormal number of Packet_In messages is as follows:

[0109] The first step: Set the distance threshold as R, the adjacent node quantity threshold as k, the currently calculated number of Packet_In messages as m, and remove the node at the head of the current window ISB;

[0110] The second step: Create a new node n curr , where n curr .obj = m, n curr .count_after = 1,

[0111] n curr .nn_before = {}, n curr .id = t;

[0112] The third step: Traverse each node n, in ISB. If |n,obj - m| < R, then n,.count_after is incremented by 1, and n,.id is added to the set n...nn_before. Then n.. is added to ISB.

[0113] The fourth step: For each node n in ISB j, set pre_neighs equal to n j .nn_before The length of the set, succ_neighs = n j .count_after, if (pre_neighs+succ_neighs)<k, it is marked as an abnormal value, otherwise it is marked as a legal value;

[0114] Each node in the sliding window at a certain moment is marked to determine whether it is abnormal. For the newly added tail node, if the node is an abnormal value, it means that the currently calculated number of Packet_In messages is also an abnormal value, and the monitoring system is triggered to start the subsequent monitoring process.

[0115] (III) Triggering process

[0116] The trigger module calculates the number of Packet_In messages within a certain period of time as the input of the abnormality judgment algorithm to determine whether its value is abnormal. The trigger module workflow is as follows: Figure 3 As shown. First, a timer and a counter are set. When there is a new Packet_In message in the controller, the counter accumulates and checks whether the timer has ended. If the timing has not ended, the message is forwarded to the controller for processing, otherwise the counter stops counting, and then the counter value is used as input to call the abnormal judgment algorithm for abnormal value judgment. If the value is abnormal, the subsequent monitoring module is started, otherwise the message is forwarded to the controller for processing, and then the counter is reset to zero and a new round of timing is started.

[0117] 4. Flow table information collection module

[0118] The controller calculates the associated information for the flow table entries of the switch and sends an ofp_stats_request message to request the flow table status of the switch. After receiving the message, the switch collects the flow table information and responds to the controller's request through an ofp_stats_reply message. The ofp_stats_request and ofp_stats_reply message structures are the same.

[0119] After the flow anomaly monitoring begins, the flow table information collection module collects data on flow table state changes over a period of time, and the selection of the state change interval will affect the efficiency of the entire monitoring process. If the interval is too long, the monitoring system will run longer and reduce monitoring efficiency; if the collection interval is too short, the data will not change much in a short period of time, and will not be clearly representative of the abnormal situation, affecting the accuracy of monitoring. Therefore, after many experiments, the collection interval was finally set to 5 seconds.

[0120] Since the switch sends all flow table entries as responses to the controller, only part of the information in the flow table entries is needed by the subsequent feature extraction module. Therefore, after obtaining the flow table status information, data is extracted to improve the efficiency of the monitoring module. A 12-tuple is set in the flow table entry matching field to match the data packet and the flow table entry, such as Figure 4 As shown;

[0121] In the twelve-tuple, basic network five-tuple information is required, and the counters in the flow table entry are also needed to calculate the number of associated data packets and bytes, extract and reconstruct the relevant data, and send it to the feature extraction module for feature calculation. The final data format is as follows Figure 5 shown.

[0122] 5. Traffic feature extraction module

[0123] The characteristic parameters used include characteristic angle and the source IP generation speed GDS as a supplement. The five characteristics fully reflect the characteristics of traffic changes in the network from different angles. The details are as follows:

[0124] (1) Median number of flow packets MPf

[0125] The median number of packets forwarded by each flow table entry within 5 seconds is taken as the first dimension of the feature vector. When the network is attacked by traffic, the attacker will forge the source IP address in the data flow. Compared with the normal state, the number of packets contained in each flow will be significantly reduced. The median flow packet calculation formula is:

[0126]

[0127] In formula 4, M(t) represents the median of the flow packets at time t, x i It represents the number of packets forwarded in the ith flow entry after all flow entries are sorted according to the number of packets at time t. n represents the total number of flow entries. The calculation formula of MPf is:

[0128] NPf=M(t+5)-M(t) Formula 5

[0129] The median objectively reflects the data flow situation in the network.

[0130] (2) Convection ratio PPf

[0131] In SDN, interactive flow table entries appear in pairs. Suppose there are two data flows X and Y in the network. When X and Y meet the following three conditions:

[0132] 1) X's destination IP address is the same as Y's source IP address;

[0133] 2) X's source IP address is the same as Y's destination IP address;

[0134] 3) X and Y use the same communication protocol;

[0135] At this time, X and Y are called a pair of convection flows. When sending traffic attacks, the attacker will send a large number of unidirectional flows with forged source IPs to the network, and the proportion of convection flows in the network will be significantly reduced. PPf defines the proportion of flow table entries belonging to convection flows to all flow table entries. PPf is used as the second dimension of the feature vector. The specific calculation formula is as follows:

[0136]

[0137] Where pairFlowNum indicates the number of flow pairs generated in the network within 5 seconds, and flowNum is the total number of flow entries in the flow table.

[0138] (3) Port growth rate GDP

[0139] When the network is in a normal state, the change range of the port in the data flow is small, and the normal data packet has a fixed source port and destination port. When the network is attacked, the attacker not only uses a false source IP, but also forges the port number, and the speed of the port increase in the traffic will be significantly accelerated. Therefore, the port growth rate is used as the third dimension of the characteristic parameter, and its calculation formula is as follows:

[0140]

[0141] Where numPort i is the number of ports added in the ith flow entry within 5 seconds, n is the total number of flow entries in the flow table, and interval represents the time interval, which is set to 5 seconds in this application.

[0142] (4) Median of stream bytes MBf

[0143] When an attacker conducts a traffic attack, he sends smaller attack packets to the network to improve the attack effect. The median of the flow bytes is used as the fourth dimension of the feature vector, and each flow table entry is sorted according to the number of bytes transmitted within 5 seconds, and the median is taken. The formula is as follows:

[0144]

[0145] MBf=M(t+5)-M(t) Formula 9

[0146] Where y i It represents the number of forwarding bytes of the i-th flow table entry sorted by byte number at time t, n is the total number of flow table entries, and M(t) represents the median of flow bytes in the flow table at time t.

[0147] (5) Source IP generation speed GDS

[0148] When a traffic attack occurs, a large number of packets with false source IPs will flood into the network, and the attacker will constantly change the source IP address, making a large number of packets in the flow table unable to match. The number of source IP addresses in the traffic will increase significantly, so the source IP is used as the fifth dimension of the feature vector, and its calculation formula is:

[0149]

[0150] where numSrc i is the number of source P addresses added in the ith flow entry within 5 seconds, n is the total number of flow entries in the flow table, and interval represents the time interval, which is set to 5 seconds in this application.

[0151] 6. Traffic monitoring classification module

[0152] In SDN, according to the collected traffic features, an associated classification algorithm is used to classify the traffic to determine whether the traffic at that moment is normal or abnormal. The improved KNN algorithm that adds features and distance weights is used to complete the traffic classification.

[0153] The specific process of traffic monitoring is: first, the traffic information collection module in the controller collects the switch flow table information every 5 seconds under normal traffic environment and abnormal traffic environment respectively; the traffic feature extraction module calculates the associated feature parameters to form feature vectors; and then these feature vectors are respectively formed into normal traffic training sample sets and abnormal traffic training sample sets; the traffic monitoring classification module optimizes the Relief algorithm to calculate the weight of each feature to form a weight vector, and completes the initialization of the monitoring system; when the network needs to monitor traffic anomalies, the controller collects network traffic in real time and calculates feature vectors, and uses them as detection samples for classification using the improved classification algorithm of this application; when the traffic in the network is detected to be abnormal at this moment, the controller issues an alarm and takes further measures to avoid the spread of danger.

[0154] Therefore, when the SDN network is attacked by traffic or abnormal conditions, the monitoring solution process of this application is as follows: Figure 6 shown.

[0155] VII. Experimental Design and Results Analysis

[0156] For the traffic anomaly monitoring solution in the SDN environment designed in this application, taking the DDos attack on the SDN controller as an example, the solution is evaluated by building an SDN network environment for experiments, verifying the effect and performance of the solution in monitoring DDos attacks, and performing correlation analysis on the experimental results data.

[0157] (I) Building the experimental environment

[0158] A SDN network traffic anomaly monitoring solution was designed using modularization. In order to verify the monitoring effect of the solution, experiments were carried out on a simulation platform.

[0159] The experiment was conducted in an SDN environment, and the experimental platform consisted of an SDN controller, an OpenFlow switch, and a network emulator. An open source controller based on the OpenDayLight architecture was selected, OpenvSwitch was used as the virtual switch in the network, and the network emulator was the Mininet platform.

[0160] 1. Generation of experimental data

[0161] The experimental data is generated in two stages. When accumulating training samples, normal sample traffic is generated by simulating daily communication and link establishment requests by hosts in the SDN network; and the attack traffic is generated by the DDos attack tool TFN. Since the normal network contains different proportions of TCP, UDP and ICMP traffic, TFN is used to randomly initiate SYNflood, UDPflood, ICMPflood and other DDos attacks, so that a variety of data packets are mixed in the attack traffic to improve the authenticity of the experimental data. During the above attack process, the flow table information collection module is used to collect flow table data every 5 seconds, and feature vectors are extracted to generate two types of training sample sets. In order to reduce the deviation caused by additional factors, the experiment ensures that the number of samples in the two types of training sample sets is the same.

[0162] In the traffic anomaly monitoring stage, the timer of the trigger module is set to 1 minute, and the trigger module monitors the number of Packet_In messages every one minute. If the monitoring result is abnormal, the traffic collection module collects the associated flow table information twice at an interval of 5 seconds, calculates the flow table feature vector as a detection sample, and classifies it through the traffic monitoring classification module to complete the identification of DDos attacks.

[0163] 2. Experimental platform architecture

[0164] The network topology used in the experiment includes an OpenDayLight controller and two virtual switches based on OpenvSwitch. Switch 1 is connected to Network 1 with three hosts, and the default IP addresses of the hosts are 10.0.0.1-10.0.0.3. Switch 2 is connected to Network 2 with three hosts, and the default IP addresses of the hosts are 10.0.0.4--10.0.0.6. As an attack network, Network 1 will send attack packets to any host in Network 2. At the same time, Network 1 can also access Network 2 normally to generate normal access traffic for the network to accumulate normal traffic samples.

[0165] (II) Experimental results and evaluation

[0166] For the DDos attack experiment, the traffic anomaly monitoring results are reflected in two aspects: monitoring rate DR and false alarm rate FA.

[0167] When conducting the experiment, the length of the sliding window ISB of the trigger module is 20, the distance critical value R is 150, and the threshold value k of the number of neighboring nodes is 10. The number of attack traffic samples and normal traffic samples used for distance calculation is 3000, and the number of normal traffic samples and attack traffic samples used for monitoring is 1500 respectively. When the k value in the KNN algorithm is 10, 20, and 30 respectively, the monitoring results are as follows: Figure 7 As shown:

[0168] Depend on Figure 7 It can be seen that under the same parameter settings and the same number of samples, when k = 20, the monitoring rate and false alarm rate of the monitoring scheme of this application are better than other k values. Then we set k equal to 20, and add the SVM classification algorithm in the experiment for comparison under the same sample set. The SVM algorithm is implemented using the LIBSVM component, and the kernel function uses the Gaussian kernel function. The experimental monitoring results are shown in the following table under different numbers of training samples. Figure 8 .

[0169] Depend on Figure 8 It can be concluded that when using the same training samples and detection samples, compared with the SVM algorithm, the improved KNN algorithm of the present application has a higher monitoring rate and fewer false alarms; as the number of training samples increases, the monitoring rate of each classification algorithm is improved, but the number of false alarms also increases. The reason is that as the number of training samples increases, the KNN algorithm includes more sample points when calculating the distance, and the increase in reference data makes the classification effect more accurate. At the same time, the increase in training samples increases the probability of isolated sample points and other noise appearing in the samples collected on the normal network traffic, which makes it easy for normal traffic to be judged as abnormal traffic, thereby increasing the false alarm rate. Therefore, in summary, the KNN algorithm based on feature and distance weighting in the present application is better than the SVM algorithm.

[0170] In terms of monitoring time, the improved algorithm of this application is compared with the KNN algorithm and the SVM algorithm. The monitoring time is calculated by the time consumed by the flow monitoring classification module for classification. When the three algorithms use the same sample, the SVM algorithm consumes the shortest time, and the KNN algorithm and the improved KNN algorithm of this application consume similar time. The reason is that compared with the KNN algorithm, the method of this application only performs weighted calculations on the distance, and the overall amount of calculation has not increased too much. Therefore, in general, the KNN algorithm based on feature and distance weighting in this application has a model improvement in monitoring rate without a significant increase in time consumption, so the method of this application is better.

[0171] In addition, a comparative experiment was conducted on the monitoring trigger module and the timing monitoring method. Ten DDos attacks were launched at random intervals within one hour to compare the response time, CPU load, and network load of the two methods. The parameters of the monitoring trigger module are the same as above, and the monitoring interval of the timing monitoring method is 3 minutes.

[0172] The average response time of the monitoring trigger module is significantly shorter than that of the timing monitoring method. This is because the monitoring interval of the timing monitoring method is set to 3 minutes, so the average response time is about half of the interval, that is, about 90 seconds. The monitoring trigger module monitors the number of Packet_In messages every 1 minute, making the average response time about 30 seconds.

[0173] Compared with the timed monitoring method, the use of the monitoring trigger module significantly reduces the CPU occupancy rate and the rate of network traffic. The reason is that compared with the trigger monitoring method, the average response time of the timed monitoring method is longer, so that the controller will receive more Packet_In messages sent by the switch before the monitoring starts. Therefore, the computing resources and network bandwidth required to process these Packet_In messages will also be more, resulting in the timed monitoring method occupying more CPU resources and causing a greater network load. In summary, the monitoring trigger module can effectively solve the problems of slow response and high resource occupation of timed monitoring, and effectively improve the efficiency of abnormal traffic monitoring.

Claims

1. A low-network-overhead, accurate and fast SDN traffic anomaly monitoring method, characterized in that: In order to solve the problem of traffic anomaly monitoring, the classification algorithm and monitoring trigger mechanism are optimized respectively; in the traffic classification algorithm, the K nearest neighbor algorithm is improved and the influence of different characteristics of SDN network traffic on type discrimination is analyzed, the Relief algorithm is optimized to solve the weight vector that measures the contribution of the feature, the feature weight vector is introduced into the distance calculation of the K nearest neighbor algorithm, and the traffic type classification is realized by accumulating the distance voting weight; in the monitoring trigger mechanism, by analyzing the internal message characteristics of the abnormal condition controller, the number of Packet_In messages is used as the basis for judging the monitoring trigger, and the distance-based data flow anomaly monitoring algorithm is used to monitor the abnormal number of Packet_In messages to trigger the monitoring mechanism. Compared with the periodic monitoring method, the introduction of the trigger mechanism makes the method of this application have a shorter response time and lower hardware network overhead; 1) Establish a monitoring solution for traffic anomalies in SDN environment, which is divided into four modules: the monitoring trigger module determines whether to start flow table information collection by judging whether the number of Packet_In messages is abnormal, including three aspects: trigger rules, anomaly judgment and trigger process; the flow table information collection module uses controller query messages to collect flow table status information from switches; the traffic feature extraction module calculates the flow table status information, calculates the median MPf of flow packets, the convection ratio PPf, the port growth rate GDP, the median MBf of flow bytes, and the source IP generation speed GDS to form a five-dimensional traffic feature vector; The traffic monitoring classification module uses an improved KNN algorithm based on features and distance weighting to judge the type of traffic and ultimately identify whether the network traffic is abnormal; 2) Construct an improved KNN traffic anomaly monitoring platform in the SDN environment, improve the original KNN algorithm, propose an improved KNN algorithm that adds feature weights and distance voting weights, optimize the Relief algorithm to calculate the weight of each feature, use the distance association factor to represent the voting weight when performing classification calculations, and use the improved KNN algorithm to perform the classification process, and establish an accurate and fast SDN traffic anomaly monitoring platform.

2. According to the low network overhead SDN traffic anomaly accurate and fast monitoring method of claim 1, it is characterized in that: Improved KNN for traffic anomaly monitoring in SDN environment: First, optimize the Relief algorithm to calculate the weight of each feature. When performing classification calculations, use the distance association factor to represent the voting weight. Finally, use the improved KNN algorithm to perform the classification process. The specific classification method is as follows: (1) Let the correctly classified sample set be trained_set = {y1, y2, ..., y m }, where y i ={y i1 ,y i2 , ..., y ip , c}, the feature set is {r1, r2, ..., r p }, c represents the category to which the sample belongs, and the detection set is also set to test_set = {x1, x2, ..., x n }; (2) The feature vectors in the detection samples are normalized according to Formula 1 to prevent small data from being annihilated by large data, where r max and r min Respectively represent the maximum and minimum values ​​of feature i in the training set, r max represents the maximum value of i among all samples, r min Represents the minimum value of i among all samples: (3) The Relief algorithm is used to calculate the weights of the normalized features using Formula 2 to obtain the feature weight vector {λ1, λ2, ..., λ p }, use the feature weights to calculate the distance between samples, the sample to be tested x i and training samples y i The distance calculation method is as follows: (4) Calculate the sample x to be tested i The distance value from all samples in trained_set, select k of them that are close to x i The closest value is denoted as d i1 ,d i2 ,…,d ik When counting voting is required, the voting value is no longer divided equally, but the voting weight is used as the basis for type discrimination. The voting weight of the mth training sample is: (5) Calculate the voting weights ω of the two categories in the k nearest neighbor samples im The sum of x i Divide into the category with greater voting weight.

3. According to the low network overhead SDN traffic anomaly accurate and fast monitoring method of claim 1, it is characterized in that: Abnormal traffic monitoring technology route: Monitor when the controller is attacked by traffic, instantiate it as an application running on the SDN controller, collect network-related data through the centralized management of the controller to monitor traffic anomalies; It is divided into four modules, namely: monitoring trigger module, flow table information collection module, traffic feature extraction module and traffic monitoring classification module. The monitoring trigger module triggers traffic monitoring, and determines whether the system needs to perform traffic anomaly monitoring by calculating whether the number of Packet_In messages within a period of time is abnormal. Only when the number of Packet_In messages is abnormal will flow table information collection and monitoring begin; the flow table information collection module sends a query request message to all switches in the network, and the switch responds with a query response message after receiving the request; The traffic feature extraction module calculates the associated traffic feature value based on the flow table status information returned by the switch, and forms a training sample set based on normal traffic and abnormal traffic; The traffic monitoring and classification module classifies network traffic according to the training sample set and adopts the improved KNN classification algorithm based on features and distance weighting in this application to monitor whether there are any abnormalities in the traffic. When there are abnormalities in the traffic, the system will issue an alarm and the controller will take further measures to prevent the spread of the attack.

4. According to the low network overhead SDN traffic anomaly accurate and fast monitoring method of claim 1, it is characterized in that: Triggering rules: When the switch receives a message, it will query the flow table to match the flow table entry. If there is no matching flow table entry, the data packet will be encapsulated into a Packet_In message and sent to the SDN controller via a secure channel. The Packet_In message structure is as follows. After receiving the message, the controller decides whether to discard the data packet or return a response message to create a new flow table entry for the data packet. If the controller has not processed such messages, the switch will frequently hand over the messages to the controller for processing; When the SDN network traffic becomes abnormal due to a network attack, a large number of forged IP attack packets in the network cannot match the flow table entries, and the controller continuously receives Packet_In messages from the switch. At this time, the number of messages in the controller will be obviously abnormal, but such anomalies are not enough to indicate that the network is under a traffic attack. When there are multiple switches in the SDN network, a single switch cannot maintain all the flow table entries in the network, so some normal data packets cannot be matched in the switch. Therefore, the switch will generate a large number of Packet_In messages. In this case, subsequent monitoring steps are required to further determine whether the network is abnormal.

5. According to the low network overhead SDN traffic anomaly accurate and fast monitoring method of claim 1, it is characterized in that: Abnormal judgment: The abnormal number of Packet_In messages is used as the basis for judging the triggering of the monitoring system. The sliding window model is used to judge whether the object is abnormal by judging the distance between the object to be monitored and other objects in the window at a certain time. The number of Packet_In messages within a fixed time is calculated as the object to be monitored, and a message quantity data stream can be generated. The algorithm is used for abnormal monitoring to determine whether the Packet_In message in the network is abnormal. Let S be a set of n objects, S = {obj1, obj2, ..., obj n }, obj i is a specific object in S, let the positive integer k and the positive real number R, for an object obj i , when there are less than k objects in the set and the distance between them is less than R, the object obj is judged i The outliers are judged based on the distance. In a data stream, the stream data is regarded as the object in S. New data is constantly added to the stream, and the size of the object set is also expanded. The computational complexity and space complexity of the method increase linearly with the set. When a sliding window is added, only the outliers in the window are calculated each time. The legal object in the current window has at least k adjacent objects (the distance is less than R). Among the neighboring objects in the current window, there is a i appears in the monitored object obj i Before and b i appears after it, when a i +b i ≥k, the object to be monitored obj i is a legal value, but as the window slides, obj i The object in front keeps jumping out of the window, making a i decreases, resulting in a i +b i <k, then obj i From a legal value to an abnormal value, only when obj i Existence i When ≥k, the object is an absolutely safe object; Judgment of abnormal number of Packet_In messages: The ISB queue is used to represent the current sliding window. ISB is a collection of object nodes in the data stream, that is, ISB = {n1, n2, ..., n w }, w is the window size, node n is a record in the data stream, and its attribute structure is n = {obj, id, count_after, nn_before}, where the meaning of each attribute is: obj represents the number of Packet_In messages, id represents the sequence number of the record, count_after represents the number of adjacent nodes after the node in the window, and nn_before represents the set of adjacent nodes before the node in the window; The specific process of judging the abnormal number of Packet_In messages is as follows: Step 1: Set the distance critical value to R, the number of neighboring nodes critical value to k, the number of Packet_In messages currently calculated to m, and remove the node at the head of the queue in the ISB of the current window; Step 2: Create a new node n curr , where n curr .obj=m,n curr .count_after=1, n curr .nn_before={},n curr .id=t; Step 3: Traverse each node n, in ISB. If |n,obj-m / <R, then add 1 to nu..count_after and add n,.id to the set n.....nn_before. Then add n.. to ISB; Step 4: For each node n in ISB j , set pre_neighs equal to n j .nn_before The length of the set, succ_neighs = n j .count_after, if (pre_neighs+succ_neighs)<k, it is marked as an abnormal value, otherwise it is marked as a legal value; Each node in the sliding window at a certain moment is marked to see if it is abnormal. For the newly added tail node, if the node is an abnormal value, it means that the currently calculated number of Packet_In messages is also an abnormal value, and the monitoring system is triggered to start the subsequent monitoring process.

6. According to the low network overhead SDN traffic anomaly accurate and fast monitoring method of claim 1, it is characterized in that: Trigger process: The trigger module calculates the number of Packet_In messages within a certain period of time as the input of the abnormal judgment algorithm to determine whether its value is abnormal. First, a timer and a counter are set. When there is a new Packet_In message in the controller, the counter accumulates and checks whether the timer has ended. If the timing has not ended, the message is forwarded to the controller for processing, otherwise the counter stops counting, and then the counter value is used as input to call the abnormal judgment algorithm for abnormal value judgment. If the value is abnormal, the subsequent monitoring module is started, otherwise the message is forwarded to the controller for processing, and then the counter is reset to zero and a new round of timing is started.

7. According to the low network overhead SDN traffic anomaly accurate and fast monitoring method of claim 1, it is characterized in that: Flow table information collection module: Calculates the associated information for the flow table items of the switch. The controller sends an ofp_stats_request message to request the switch flow table status. After receiving the message, the switch collects the flow table information and responds to the controller's request through an ofp_stats_reply message. The ofp_stats_request and ofp_stats_reply message structures are the same. Set the collection interval to 5 seconds, extract data from the flow table status information after obtaining it, improve the efficiency of monitoring by the monitoring module, and set a 12-tuple in the flow table entry matching field to match data packets and flow table entries; In the twelve-tuple, basic network five-tuple information is required, and counters in the flow table items are also needed to calculate the number of associated data packets and bytes, extract and reconstruct the relevant data, and send it to the feature extraction module to calculate the features.

8. According to the low network overhead SDN traffic anomaly accurate and fast monitoring method of claim 1, it is characterized in that: Traffic feature extraction module: The feature parameters used include feature angle and the source IP generation speed GDS as a supplement. The five features fully reflect the characteristics of traffic changes in the network from different angles, as follows: (1) Median MPf of flow packets: The median number of packets forwarded by each flow table entry within 5 seconds is taken as the first dimension of the feature vector. When the network is attacked by traffic, the attacker will forge the source IP address in the data flow. Compared with the normal state, the number of packets contained in each flow will be significantly reduced. The median flow packet calculation formula is: In formula 4, M(t) represents the median of the flow packets at time t, x i It represents the number of packets forwarded in the ith flow entry after all flow entries are sorted according to the number of packets at time t. n represents the total number of flow entries. The calculation formula of MPf is: MPf=M(t+5)-M(t) Formula 5 The median objectively reflects the data flow in the network; (2) Flow ratio PPf: In SDN, interactive flow table entries appear in pairs. Suppose there are two data flows X and Y in the network. When X and Y meet the following three conditions: 1) X's destination IP address is the same as Y's source IP address; 2) X's source IP address is the same as Y's destination IP address; 3) X and Y use the same communication protocol; At this time, X and Y are called a pair of convection flows. When sending traffic attacks, the attacker will send a large number of unidirectional flows with forged source IPs to the network, and the proportion of convection flows in the network will be significantly reduced. PPf defines the proportion of flow table entries belonging to convection flows to all flow table entries. PPf is used as the second dimension of the feature vector. The specific calculation formula is as follows: Where pairFlowNum represents the number of pairs of flows generated in the network within 5 seconds, and flowNum is the total number of flow entries in the flow table; (3) Port growth rate GDP Taking the port speed as the third dimension of the characteristic parameter, the calculation formula is as follows: Where numPort i is the number of ports added in the ith flow table entry within 5 seconds, n is the total number of flow table entries in the flow table, and interval represents the time interval, which is set to 5 seconds in this application; (4) Median of stream bytes MBf The median of the flow bytes is used as the fourth dimension of the feature vector. Each flow entry is sorted according to the number of bytes transmitted within 5 seconds, and the median is taken. The formula is as follows: MBf=M(t+5)-M(t) Formula 9 Where y i It represents the number of forwarding bytes of the i-th flow table entry sorted by byte number at time t, n is the total number of flow table entries, and M(t) represents the median of flow bytes in the flow table at time t.

9. According to the low network overhead SDN traffic anomaly accurate and fast monitoring method of claim 1, it is characterized in that: Traffic monitoring and classification module: In SDN, traffic is classified based on the collected traffic features using an associated classification algorithm to determine whether the traffic at that moment is normal or abnormal. The improved KNN algorithm that adds features and distance weights is used to complete traffic classification. The specific process of traffic monitoring is as follows: First, the traffic information collection module in the controller collects the switch flow table information every 5 seconds under normal traffic environment and abnormal traffic environment, and the traffic feature extraction module calculates the associated feature parameters. The feature vectors are then combined into a normal traffic training sample set and an abnormal traffic training sample set. The traffic monitoring classification module optimizes the Relief algorithm to calculate the weight of each feature to form a weight vector, and the monitoring system is initialized. When the network needs to monitor traffic anomalies, the controller collects network traffic in real time and calculates the feature vector, and uses it as a detection sample for classification using the improved classification algorithm of this application. When the traffic in the network is abnormal at this moment, the controller issues an alarm and takes further measures to avoid the spread of danger.

Images