Link flooding attack detection method and system based on SDN service priority

Abstract

The invention belongs to the field of network space, and relates to a link flooding attack detection method and system based on SDN (Software Defined Network) service priority. The method comprises the following steps: target link selection: acquiring actual routing paths from other switches in a network to a switch where a target service is located, and selecting a link with a high influence degree from the actual routing paths as a target link; monitoring a target link and judging whether the link is congested or not; when it is detected that the link is congested, the attack detection and mitigation module receives the congestion position information of the link sent by the SDN controller module, acquires flow table information forwarded to the congested link by a switch where the congested link is located, and integrates and extracts the acquired host behavior information as features of a machine learning model; and judging whether the host belongs to a malicious host or not, and then performing link congestion relief. According to the method, the malicious hosts can be quickly identified, and meanwhile, the method has relatively high detection accuracy and recall rate and relatively low false positive rate.

Description

Technical Field

[0001] The present invention belongs to the field of network space, and in particular relates to a link flooding attack detection method and system based on SDN service priority. Background Art

[0002] Unlike traditional distributed denial-of-service (DDoS) attacks, link flooding attacks (LFA) target links rather than services directly. Attackers congest the links leading to the target service, preventing legitimate users from accessing the service. Link flooding attacks have the following characteristics: they use real, legitimate IP addresses, the traffic bandwidth of a single attacking host is small, and the traffic characteristics are highly similar to those of legitimate hosts, making them difficult for victims to detect. LFAs include the Coremelt attack (Studer A, Perrig A. The Coremelt Attack [C]. Computer Security-ESORICS 2009 (ESORICS), 2009, 5789: 37-52.) and the Crossfire attack (Kang MS, Lee SB, Gligor V D. The Crossfire Attack [C]. 2013 IEEE Symposium on Security and Privacy, 2013: 127-141.). In a Coremelt attack, the attacker defines a target link and uses a group of malicious hosts to send data to each other to congest the target link. The Crossfire attack is a further development of the Coremelt attack, targeting more complex network environments. This attack uses a malicious host as the source and public services as the target. It is more common in network attacks, and current research on LFA focuses on Crossfire attacks. Crossfire attacks primarily consist of three phases: target network detection, target link selection, and rolling attacks. During the target network detection phase, the attacker aims to obtain network topology information in the area where the target service is located. During the target link selection phase, to achieve LFA, the attacker selects a group of specific target links and further selects a group of decoy services that are close to these links, such as public service websites and mail servers. During the rolling attack phase, the attacker typically selects a group of non-intersecting target links and periodically attacks them. This is to avoid changes in network topology caused by long-term network congestion, making it difficult for defenders to effectively defend against them.

[0003] Existing research on link flooding attack detection usually starts from the three stages of link flooding attacks:

[0004] In terms of target link identification, CFADefense (Rafique W, He X, Liu Z, et al. CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure[C]. 2019 IEEE 21st International Conference on High Performance Computing and Communications (HPCC), 2019.) detects the flow table starting from the ingress node, analyzes the traffic data between all switch pairs, generates a traffic weight for each link, and selects the link with the higher weight as the target link. Similarly, LFADefender (Wang J, Wen R, Li J, et al. Detecting and Mitigating Target Link-Flooding Attacks Using SDN[J]. IEEE Transactions on Dependable and Secure Computing, 2019, 16(6): 944-956.) analyzes the flow table obtained from the switch, counts the traffic passing through each link, and selects the link with the highest traffic density as the target link. However, in large networks, this will bring huge computational overhead. We believe that relying solely on traffic or graph attributes to identify target links is blind. These methods have limitations: the selected links may not necessarily pose a high threat to specific services, and even if link congestion occurs, it may not significantly impact certain important services.

[0005] In attack detection, some methods rely on threshold judgment during congestion periods, such as detecting the occurrence of link flooding attacks by changes in the destination IP entropy value. However, relying solely on threshold detection will cause a high false alarm rate and make it difficult to detect malicious hosts. In the use of machine learning to detect link flooding attacks, existing methods such as CyberPulse++ (Rasool R, Ahmed K, Anwar Z, et al. CyberPulse++: A Machine Learning Based Security Framework for Detecting Link Flooding Attacks in Software Defined Networks[J]. International Journal of Intelligent Systems, 2021.) still rely on the features required for traditional DDoS attack detection. However, due to the similarity between LFA single attack traffic and normal user traffic and the small attack bandwidth, these methods are difficult to apply when defending against LFA.

[0006] In attack mitigation, some methods, such as CFADefense (Rafique W, He X, Liu Z, et al. CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure[C]. 2019IEEE 21st International Conference on High Performance Computing and Communications (HPCC), 2019.), consider using a mitigation-first, detection-later strategy, using rerouting to alleviate link congestion and then identifying malicious hosts through multiple rounds of interaction. However, this approach has the disadvantage of being unable to achieve the desired mitigation effect when the network lacks sufficient alternative links. Furthermore, detecting malicious hosts requires multiple rounds of interaction. Summary of the Invention

[0007] This paper addresses the issues in existing methods, such as blind target link selection, high false positive rates caused by relying solely on threshold detection, and difficulty achieving the desired mitigation effect. By proposing a service-prioritized link flooding attack detection and mitigation method (SPM) for software-defined networks (SDNs), this paper addresses the issues in existing methods, such as blind target link selection, high false positive rates caused by relying solely on threshold detection, and difficulty achieving the desired mitigation effect. Experimental results based on a simulation platform demonstrate that, compared to traditional feature-based methods, this method can rapidly identify malicious hosts while achieving higher detection accuracy and recall rates and a lower false positive rate.

[0008] The present invention specifically adopts the following technical solutions:

[0009] This method focuses on target services and monitors target links by mapping services to links. It deeply analyzes the characteristics of LFA attack behavior, extracts features from switch flow table information during periods of congestion, and uses machine learning models to identify these features. For detected malicious hosts, the method adopts a fast mitigation and slow detection defense strategy, effectively minimizing the impact on legitimate hosts.

[0010] The present invention provides a link flooding attack detection method based on SDN service priority, comprising:

[0011] Step 1: Target link selection: Obtain the actual routing paths from other switches in the network to the switch where the target service is located, and select the links with high influence, which are the target links; among them, according to the Pareto principle, the links with the top 20% of influence ranking are selected as high-influence links; in addition, the target service is selected by input in the present invention.

[0012] Step 2: Monitor the target link and determine whether the link is congested.

[0013] The present invention uses link delay as an indicator to determine whether a link is congested. The link delay is calculated using formula (1), where T1 and T2 are the delays between two adjacent switches receiving the LLDP data packet and reporting it to the SDN controller, and T A 、T B The round-trip delay from the SDN controller to the two switches is:

[0014] One-way link delay: link_delay = (T1 + T2 - T A -T B ) / twenty one)

[0015] Step 3: When link congestion is detected, the attack detection and mitigation module receives the link congestion location information from the SDN controller module, obtains the flow table information forwarded by the switch where the congested link is located to the congested link, and integrates the obtained host behavior information as a feature for extraction by the machine learning model.

[0016] The features include: number of destination IP addresses, number of high-frequency destination IP addresses, percentage of high-frequency destination IP addresses, current byte count, current number of packets, bytes per packet, total number of bytes, total number of packets, percentage of current byte count, percentage of current packet count, and duration. The machine learning model is a random forest algorithm. Based on the Pareto principle, the top 20% of traffic to different destination IP addresses is selected as the high-frequency destination IP addresses.

[0017] Step 4: Determine whether the host is a malicious host and then alleviate link congestion.

[0018] Specifically, a confidence threshold and an identification threshold are set. When the probability that a host is identified as a malicious host by the machine learning model exceeds the given confidence threshold, the sample is identified as a suspicious host and its traffic is temporarily blocked. When the number of times a host is identified as a suspicious host exceeds the given identification threshold, the sample is defined as a malicious host and is directly blocked.

[0019] The present invention provides a link flooding attack detection system based on SDN service priority, which includes an SDN controller module and an attack detection and mitigation module.

[0020] The SDN controller module is used to select and monitor target links, obtain target link status information, and send link congestion location information to the attack detection and mitigation module; the SDN controller implements target link selection and link delay calculation.

[0021] The attack detection and mitigation module is configured to receive link congestion location information, request flow table information from the switch at the congested location, perform attack signature extraction and malicious host detection, and then issue mitigation policies to alleviate the congested link. Upon receiving the congestion location information, the attack detection and mitigation module directly requests flow table information from the switch at the congested location via the southbound interface. For detected malicious hosts, the attack detection and mitigation module issues a drop action flow table via the southbound interface to alleviate link congestion.

[0022] The beneficial effects of the present invention are:

[0023] The nature of the LFA mitigation method based on software defined network (SDN) service priority of the present invention determines that it cannot solve the problem locally or on a single link, and it must be detected and defended in the entire network. SDN has good global visibility, and its characteristics such as separation of forwarding and control, customizable control services and complete north-south interfaces provide defenders with a more convenient way to implement strategies. Service priority means not providing a unified and equal defense mechanism for the network, but focusing on several key services in the network, and shifting the defense target from specific links in the network to specific services. The advantage of doing this is that it can clearly define the correspondence between links and services, effectively reducing the cost of detection and defense.

[0024] This invention analyzes the characteristics of LFA and extracts behavioral features from the SDN switch flow table, overcoming the current limitation of LFA, which still uses the features required for traditional DDoS detection. By obtaining link statistics in real time during congestion, congestion can be alleviated promptly and quickly.

[0025] The present invention was tested on multiple machine learning models and found that the random forest (RF) algorithm performed better. For suspicious hosts detected by the model, the present invention adopts a defense strategy of fast mitigation and slow identification. Only when a host is identified as suspicious multiple times is it determined to be malicious; otherwise, the discard time is gradually increased. This can quickly alleviate link congestion while avoiding additional costs such as rerouting. Compared with methods that require multiple rounds of interaction, the present invention can quickly detect malicious hosts while having a higher recall rate and a lower false positive rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a link flooding attack detection system based on SDN service priority.

[0027] Figure 2 The impact of attack bandwidth ratio on round-trip delay under different bandwidths.

[0028] Figure 3 It is the Abilence topology.

[0029] Figure 4 Comparison of precision, recall, and false positive rates of different models; (a) the method of the present invention; (b) CyberPulse++; (c) CFADefense.

[0030] Figure 5 Comparison of recall rate and false positive rate under different total number of malicious hosts; (a) Recall rate; (b) False positive rate. In the figure, SPM represents the method of the present invention.

[0031] Figure 6 Comparison of recall rate and false positive rate under different attack cycles; (a) Recall rate; (b) False positive rate. In the figure, SPM represents the method of the present invention. DETAILED DESCRIPTION

[0032] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0033] Figure 1 A link flooding attack detection system based on SDN service priority is demonstrated, which includes an SDN controller module and an attack detection and mitigation module.

[0034] The SDN controller module is used to select and monitor target links, obtain target link status information, and send link congestion location information to the attack detection and mitigation module. Specifically, the SDN controller implements target link selection and link delay calculation. The SDN controller periodically obtains link status information to analyze whether a specific link is congested. If congestion is detected, the congestion location information is sent to the attack detection and mitigation module.

[0035] The attack detection and mitigation module is used to receive the congestion location information of the link, request flow table information from the switch at the congested location, extract attack features and detect malicious hosts, and then issue mitigation strategies to alleviate the congested link. Specifically, after receiving the congestion location information, the attack detection and mitigation module directly requests flow table information from the switch at the congested location via the southbound interface, further extracts attack features, and judges the host through a machine learning model. For detected malicious hosts, a discard action flow table is issued through the southbound interface to alleviate link congestion. This avoids the SDN controller from bearing a large load, and obtaining attack features from flow table data also makes attack detection more lightweight and efficient.

[0036] Table 1 Definition and explanation of symbols

[0037]

[0038] The link flooding attack detection method based on SDN service priority includes:

[0039] Step 1: Target link selection: Obtain the actual routing paths from other switches in the network to the switch where the target service is located, and select the link with the highest influence, which is the target link;

[0040] We believe that relying solely on link traffic or graph attributes to determine target links is blind and has limitations. Specifically, the selected links may not necessarily pose a high threat to a specific service, and even if link congestion occurs, it may not significantly impact certain critical services. By inputting the selected target service and clarifying the relationship between the target service and the link, we can clearly understand the impact of a specific link on the target service during congestion, thereby making attack detection and defense more effective. Here, we assume that all legitimate users are evenly distributed geographically, meaning that legitimate users connected to each switch have the same weight. Therefore, we obtain the actual routing paths from other switches in the network to the switch where the target service resides. These paths may overlap on some links. By referring to the Pareto principle (Harvey HB, Sotardi ST. The Pareto Principle [J]. Journal of the American College of Radiology, 2018), we select highly influential links (i.e., links in the top 20% of influence rankings) as target links. There are various methods for querying routing paths, such as obtaining them from the controller's routing policy or performing hop-by-hop measurements on the switch, which will not be detailed here. The algorithm for obtaining the target link is shown in Algorithm 1:

[0041]

[0042] Step 2: Monitor the target link and determine whether the link is congested.

[0043] In step 1, we obtain a set of links that have a high impact on the target service, and monitor these links to determine whether LFA occurs. Common indicators for determining whether a link is congested include link delay, remaining bandwidth, packet loss rate, etc. However, in terms of service quality, delay is the largest perceived influencing factor. Therefore, the present invention uses link delay as an indicator for determining whether a link is congested. We simulated link attacks. To simulate the actual link situation, we added 3ms of delay to each link, such as Figure 2 As shown in Figure 2, we give the link delay results for different attack bandwidth ratios under different link bandwidths. In the case of link delay, when the attack bandwidth is less than a specific threshold, the link delay is basically stable; when the attack bandwidth exceeds the threshold, the link delay will increase significantly. As the link bandwidth increases, the turning point of the delay change gradually advances, so it is not feasible to select a unified threshold for the link, and different choices should be made under different bandwidth conditions. The calculation of the link delay can be obtained by formula (1), where T1 and T2 are the delays for two adjacent switches to receive LLDP data packets and report them to the controller, and T A 、T BThe round-trip delay from the controller to the two switches is:

[0044] One-way link delay: link_delay = (T1 + T2 - T A -T B ) / twenty one)

[0045] We have the switches in the network periodically send LLDP packets, capture and process these packets in the controller, and integrate the calculation of link delay into the SDN controller. Here, we set the link congestion status to be detected every 5 seconds. When link congestion is detected, the controller requests the attack detection and mitigation module to obtain the flow table information forwarded by the switch where the congested link is located to the congested link. When the detection program receives the request, it starts a new thread, requests to obtain the flow table information once per second, and ends the thread after 5 seconds. Obtaining the switch flow table information is achieved through the southbound interface. For example, in the Ryu controller, the switch flow table can be issued, obtained, modified, and other operations by starting the ryu.app.ofctl_rest.py program.

[0046] Step 3: When link congestion is detected, the attack detection and mitigation module receives the link congestion location information from the SDN controller module, obtains the flow table information forwarded by the switch where the congested link is located to the congested link, and integrates the obtained host behavior information as a feature for extraction by the machine learning model.

[0047] The flow table information obtained typically includes the following: priority, timeout, matching domain, number of packets, number of bytes, action, etc. The most important of these flow table information is the matching domain. A source IP may have multiple flow tables reaching different destinations. We integrate information belonging to the same source IP to obtain information such as the number of bytes sent by the source IP, the number of packets, and the destination IP list. In addition, we count the size of all traffic reaching different destination IPs and select the destination IPs with the top 20% of traffic as high-frequency destination IPs based on the Pareto principle. We consider the behavioral characteristics of hosts during congestion within a certain historical time window. For source IPs that appear for the first time or have exceeded the historical window, they are only updated in the historical data; otherwise, we further process the data and ultimately integrate the obtained host behavior information as a judgment feature for the machine learning model.

[0048] The resulting feature information is shown in Table 2. The reason for counting the number of destination IPs and the number of high-frequency destination IPs is that within the historical window, legitimate hosts typically have relatively few destination IPs. LFA frequently changes target links to implement rolling attacks. However, at a given moment of congestion, the attack's destination IPs will still be concentrated on a small number of high-frequency destination IPs. Congestion duration refers to the duration a source IP appears during the congestion period, and the sum of the time a source IP appears on different congested links is calculated. This is based on the assumption that the longer a source IP appears during the congestion period, the more likely it is a malicious host. Although a single attacking host and legitimate hosts have similar traffic characteristics, it is feasible to prioritize bandwidth-intensive traffic during congestion. Therefore, information such as the host's byte count and packet count are also considered. The reason for considering the current number of packets / bytes as a percentage of the total number of packets / bytes within the time window is that the attacking host's attack pattern is simple, while the traffic pattern of legitimate hosts is more complex and variable. Similarly, the reason for considering the number of bytes per packet is that legitimate hosts' access behavior is sporadic, and achieving a saturation attack requires that attacking hosts under the attacker's unified control find it difficult to mimic this behavior.

[0049] Table 2 Extracted features and definitions

[0050]

[0051]

[0052] After data preprocessing, we believe that the choice of machine learning model should be robust. Given the small number of features, we selected algorithm models with high precision, recall, and low false positive rate from the following classic machine learning methods.

[0053] (1) Logistic Regression (LR)

[0054] Logistic regression is a classification algorithm primarily used for binary classification problems, but can also be extended to multi-classification. Essentially, it uses a nonlinear activation function (usually a sigmoid function) based on linear regression to map the output of linear regression to a probability interval, thereby predicting the probability of an event occurring or not.

[0055] (2) Random Forest (RF)

[0056] Random forest is a powerful ensemble learning algorithm that builds multiple decision trees and combines their results to make predictions. In classification tasks, random forests determine the final classification result by voting on multiple decision trees. This approach makes random forests highly accurate and stable, effectively avoiding overfitting.

[0057] (3) Support Vector Machine (SVM)

[0058] Support vector machines (SVMs) are highly efficient supervised learning algorithms. Their core concept is to find an optimal hyperplane that separates data points of different categories as closely as possible. For linearly separable data, this hyperplane can directly separate the two categories while maximizing the distance between them. For nonlinearly separable data, SVMs introduce a kernel function to map the data into a higher-dimensional space, rendering the data linearly separable in that space.

[0059] (4) Naive Bayes (NB)

[0060] Naive Bayes is a classification method based on probability statistics. Its basic principle is to assume that features are independent of each other and then calculate the conditional probability of each feature under each category based on the training data. During classification, the Bayesian principle is used to calculate the posterior probability that a given sample belongs to each category, and the category with the highest probability is finally used as the prediction result.

[0061] (5) Decision Tree (DT)

[0062] A decision tree is an intuitive classification and regression model that gradually divides data into subsets by applying a series of conditional judgments to features, ultimately forming a tree-like structure. Starting from the root node, data is divided into child nodes based on the values of a particular feature. Each child node is further divided based on another feature, until a leaf node is reached. The leaf node represents the final classification or prediction result.

[0063] (6) Gradient Boosting Tree (GBT)

[0064] Gradient boosting tree is an ensemble learning algorithm based on decision trees. Its essence is to gradually reduce the value of the loss function by iteratively training decision trees. In each iteration, the model will fit a new decision tree based on the negative gradient value of the loss function of the current model, and then add this new decision tree to the existing model to update the model's prediction results. By continuously adding decision trees, the model can continuously correct previous errors, thereby improving prediction accuracy.

[0065] The aforementioned algorithm models all provide a probability that a host is malicious during congestion. Specific model comparison results will be described in the experimental section. During congestion, the model evaluates the characteristics of each source IP address. If a host is deemed suspicious, further action will be taken against it.

[0066] Step 4: Determine whether the host is a malicious host and then alleviate link congestion.

[0067] Specifically, a confidence threshold and an identification threshold are set. When the probability that a host is identified as a malicious host by the machine learning model exceeds the given confidence threshold, the sample is identified as a suspicious host and its traffic is temporarily blocked. When the number of times a host is identified as a suspicious host exceeds the given identification threshold, the sample is defined as a malicious host and is directly blocked.

[0068] In the early stages of an attack, the lack of historical data makes it easy to misjudge legitimate hosts. Therefore, we use confidence and identification thresholds, further implementing a fast mitigation and slow detection defense strategy to minimize the impact on legitimate hosts while promptly alleviating link congestion.

[0069] The specific link congestion relief algorithm is shown in Algorithm 2. When a host is identified as suspicious, we do not completely block it directly. Instead, we first query the number of times the source IP address has been identified as a suspicious host and generate a drop time based on this historical number. Through the southbound interface, a high-priority DROP action flow table is directly sent to the source switch, temporarily blocking the source IP address's traffic. The drop time increases gradually with the number of times the source IP address is identified as malicious. When the number of identifications exceeds the identification threshold, we identify the host as malicious and directly block it. Although this method may result in some legitimate hosts being misidentified, the impact on legitimate hosts is limited and is acceptable for alleviating global congestion.

[0070]

[0071] Table 3 Evaluation experimental parameters

[0072]

[0073] To evaluate the effectiveness of the proposed method, we constructed the Abilence topology of the American education backbone network in the Mininet simulation environment (Laszka A, Gueye A. Network topology vulnerability / cost trade-off: Model, application, and computational complexity[J]. Internet Mathematics, 2015, 11(6): 588-626.). Figure 3As shown in Figure 1, the network consists of 11 nodes and 15 links. The link bandwidth is set to 20 Mbps, the one-way link propagation delay is 3 ms, and the one-way propagation delay of 100 ms is used as the basis for judging link congestion. At the same time, a customized controller and attack detection and mitigation program are implemented on the Ryu controller. Due to the lack of a standard data set for LFA, we refer to the literature (Kang MS, Lee SB, Gligor V D. The Crossfire Attack [C]. 2013 IEEE Symposium on Security and Privacy, 2013: 127-141.) and give the following attack data set construction process. Table 3 gives the specific parameters used in the attack simulation. All experiments were carried out on the Ubuntu 20.04.6 LTS 64-bit operating system. Core TM The test was performed under the environment of i9-9980XE CPU@3.00GHz processor and 64G memory.

[0074] like Figure 3 As shown in the topology, three hosts are connected to each switch. M simulates a malicious host, and N simulates a legitimate host. Multithreading is enabled on these hosts to simulate a variety of attack and legitimate behaviors. Host S uses a simple HTTP service as a decoy, with S9 selected as the target service. The actual routing paths from the remaining switches to switch v9 are shown in the figure. Based on the Pareto principle, the target links selected are L1, L2, and L3. To simulate normal user behavior, N periodically randomly selects 10 legitimate IP addresses from a source IP pool of 50 to access the decoy service. Traffic from a single legitimate IP address consumes approximately 0.15 Mbps of bandwidth. Table 4 provides detailed attack information. To achieve a saturation attack, each attack source M must simultaneously select 30 malicious IP addresses, simulating a total of 90 malicious host behaviors per attack round. At the end of each attack round, the attacker changes the target link, using the corresponding attack source to randomly select a new malicious IP address and relaunch the attack. After simulating the legitimate host for 5 minutes, LFA is implemented, resulting in a total attack duration of 10 minutes.

[0075] Table 4 Attack information selection

[0076]

[0077]

[0078] We divided the dataset into two parts, one for each of 0.7 and 0.3, and performed performance tests on the selected machine learning models. The selected evaluation criteria included accuracy, precision, recall, and false positive rate. Their calculation methods are shown in formulas (2) to (5), where TP represents the number of samples that were actually attack hosts but detected as attack hosts, FN represents the number of samples that were actually attack hosts but detected as legitimate hosts, FP represents the number of samples that were detected as attack hosts but were actually legitimate hosts, and TN represents the number of samples that were actually legitimate hosts but were detected as legitimate hosts. Table 5 shows the evaluation results under several preselected machine learning classifiers. The test results show that the random forest method achieved the best results among the several compared methods.

[0079] Accuracy:

[0080] Accuracy:

[0081] Recall:

[0082] False positive rate:

[0083] Table 5 Evaluation results of machine learning classifiers

[0084]

[0085] The data presented in Table 5 are the results before threshold discrimination. To further improve the performance of the proposed method and reduce the false positive rate, the probability output by the model is first compared with a confidence threshold. When the model output indicates that the probability of a sample belonging to a malicious host is greater than the given confidence threshold, the sample is identified as a suspicious host and is temporarily discarded. When the number of times a sample is identified as a suspicious host exceeds the given identification threshold, the sample is defined as a malicious host. At this point, we are more concerned with the recall rate and false positive rate after threshold discrimination—that is, the detection rate of malicious hosts and the false alarm rate of legitimate hosts. To find the optimal confidence and identification thresholds, we present experimental results under different threshold conditions, as shown in Tables 6 and 7. The experimental results show that when the confidence threshold is less than 0.95, the method has a high false positive rate, while when the confidence threshold is greater than 0.95, the recall rate decreases significantly. Therefore, we choose a confidence threshold of 0.95. Similarly, we choose a identification threshold of 5.

[0086] Table 6 Recall rate and false positive rate under different confidence thresholds

[0087]

[0088]

[0089] Table 7 Recall rate and false positive rate under different recognition thresholds

[0090]

[0091] To verify the effectiveness of our method, we compared it with the CyberPulse++ method (Rasool R, Ahmed K, Anwar Z, et al. CyberPulse++: AMachine Learning Based Security Framework for Detecting Link Flooding Attacks in Software Defined Networks [J]. International Journal of Intelligent Systems, 2021.), which uses traditional DDoS detection features, and the CFADefense method (Rafique W, He X, Liu Z, et al. CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure [C]. 2019 IEEE 21st International Conference on High Performance Computing and Communications (HPCC), 2019.), which requires multiple rounds of interaction. Our method obtains feature information from the switch flow table during congestion and makes judgments based on a random forest model. The CyberPulse++ method uses traditional 15-dimensional features to detect LFA. These features include used bandwidth, packet loss rate, total bandwidth, and packet size. The authors achieved optimal values on 10 machine models. Similarly, we reproduced these 10 models, extracted 15-dimensional features after attacking through traffic capture, and selected the optimal value from the 10 model results. The CFADefense method identifies the intersection of high-frequency hosts between multiple rounds of attacks as malicious hosts when mitigating LFA. We statistically analyze the detection results of this method after each round of attack. We will compare the performance of the three methods from the following aspects: (1) real-time detection capability comparison; (2) the impact of the total number of malicious hosts on the performance of the methods; and (3) the impact of different attack cycles on the performance of the methods.

[0092] First, we compare the real-time precision, recall, and false positive rate of the three methods. For the method of the present invention and the CyberPulse++ method, confidence thresholds and recognition thresholds are applied; for the CFADefense method, we present the results after each round of attack. Figure 4 As shown, due to the use of a threshold, both the method of the present invention and the CyberPulse++ method have high precision, but the recall rate of our method increases faster, and it can detect malicious hosts more quickly. At 5 minutes into the attack, the recall rate of the detection results of the method of the present invention reached 94.68%, while the recall rate of the comparison method was 88.35%. At the 10th minute of the attack, the recall rate of the traditional feature method was 94.58% and the false positive rate was 3.40%, while the method of the present invention achieved a recall rate of 97.52% and a false positive rate of only 1.36%. The results of the CFADefense method fluctuated greatly in the early stages of the attack. After the 25th round of attack, the precision rate gradually increased and the false positive rate gradually decreased, with the final precision rate of 91.56%, the recall rate of 46.57%, and the false positive rate of 12.91%. The experimental results show that the method of the present invention can detect malicious hosts more quickly and has a lower false positive rate.

[0093] In addition, we tested the performance of several methods under different attack parameters. Because the method of the present invention has a high accuracy rate, here we only consider the differences between several methods in recall rate and false positive rate. First, we consider the impact of the total number of attacking host source IPs on the method. The parameter here is the ratio of the total number of malicious host IPs to the number of malicious IPs launching attacks at the same time. For example, when the ratio is 5, a single host M enables 30 malicious source IPs at the same time. The experiment uses a total of 8 hosts M, and the total number of malicious source IPs is 1200. Figure 5 As shown in FIG, as the ratio increases, the recall rate of the proposed method decreases less than that of the CyberPulse++ method, while the CFADefense method performs better only when the ratio is small.

[0094] Finally, if Figure 6 As shown, we also compared the results of different methods under different attack cycles, where the parameter here refers to the duration of each attack round. As the attack cycle increases, the proposed method consistently outperforms the CyberPulse++ method in terms of recall and false positive rate. Across different attack cycles, the detection rate for malicious hosts remains above 90%, and the false positive rate is less than 1.5%. The CFADefense method, on the other hand, requires longer attack rounds to effectively capture attacks. While the attack duration remains constant, the false positive rate increases significantly with the increase in the attack cycle. Comprehensive experimental results demonstrate that the proposed method can detect malicious hosts more quickly and is more adaptable to different attack environments.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A link flooding attack detection method based on SDN service priority, characterized in that: include: Step 1: Target link selection: Obtain the actual routing paths from other switches in the network to the switch where the target service is located, and select the link with the highest influence, which is the target link; Step 2: Monitor the target link and determine whether the link is congested; Step 3: When link congestion is detected, the attack detection and mitigation module receives the link congestion location information from the SDN controller module, obtains the flow table information forwarded by the switch where the congested link is located to the congested link, and integrates the obtained host behavior information as features for machine learning model extraction; Step 4: Determine whether the host is a malicious host and then alleviate link congestion.

2. The method according to claim 1, characterized in that In step 1, according to the Pareto principle, the links with the top 20% of influence ranking are selected as high-influence links.

3. The method according to claim 1, characterized in that In step 2, the indicator for determining whether the link is congested includes the link delay.

4. The method according to claim 2, characterized in that In step 2, the link delay is calculated using formula (1), where T1 and T2 are the delays between two adjacent switches receiving the LLDP data packet and reporting it to the SDN controller, and T A 、T B The round-trip delay from the SDN controller to the two switches is: One-way link delay: link_delay = (T1 + T2 - T A -T B ) / twenty one).

5. The method according to claim 1, wherein In step 3, the features include: number of destination IPs, number of high-frequency destination IPs, proportion of high-frequency destination IPs, number of bytes at the current moment, number of packets at the current moment, number of bytes per packet, total number of bytes, total number of packets, proportion of bytes at the current moment, proportion of packets at the current moment, and duration; among them, according to the Pareto principle, the top 20% of the traffic reaching different destination IPs is selected as the high-frequency destination IP.

6. The method according to claim 1, characterized in that In step 3, the machine learning model is a random forest algorithm.

7. The method according to claim 1, characterized in that In step 4, the confidence threshold and identification threshold are first set. When the probability that the host is identified as a malicious host by the machine learning model is greater than the given confidence threshold, the sample is identified as a suspicious host and the host traffic is temporarily blocked; when the number of times the host is identified as a suspicious host is greater than the given identification threshold, the sample is defined as a malicious host and is directly blocked.

8. The link flooding attack detection system based on SDN service priority is characterized by: Includes SDN controller module and attack detection and mitigation module; The SDN controller module is used to select and monitor target links, obtain target link status information, and send link congestion location information to the attack detection and mitigation module; The attack detection and mitigation module is used to receive the congestion location information of the link, request flow table information from the switch at the congested location, extract attack features and detect malicious hosts, and then issue mitigation strategies to alleviate the congested link.

9. The system according to claim 8, characterized in that After receiving the congestion location information, the attack detection and mitigation module directly requests flow table information from the switch at the congested location via the southbound interface; for the detected malicious host, the attack detection and mitigation module sends a discard action flow table through the southbound interface to alleviate link congestion.

Images