Resource-efficient SDN low-speed flow table overflow attack early detection method
By constructing a directed graph sequence and GraphSAGE algorithm training model, combined with flow table feature extraction and polling information, the early detection and defense problems of low-speed flow table overflow attacks in SDN networks are solved, and efficient resource utilization and attack identification are achieved.
Patent Information
- Application Number
- CN202511113989.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-11
- Publication Date
- 2025-10-10
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Existing technologies are unable to efficiently identify and defend against low-speed flow table overflow attacks in SDN networks, resulting in waste of network resources and performance degradation, and traditional detection methods consume too many controller resources.
By building a directed graph sequence and GraphSAGE algorithm training model, and utilizing flow table feature extraction and polling information, low-speed flow table overflow attacks can be detected early, and mobile target defense measures can be initiated early to reduce resource consumption.
It achieves high-precision early detection of low-speed flow table overflow attacks with low resource consumption, reduces the impact of attacks and optimizes network resource utilization.
Smart Images
Figure CN120768663A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security, and in particular to a resource-efficient early detection method for SDN low-speed flow table overflow attacks. Background Art
[0002] SDN is a new network architecture that completely decouples control and forwarding. An SDN network primarily consists of a control plane and a data plane. The control plane includes an SDN controller, while the data plane consists of multiple SDN switches. The SDN controller is the centralized management unit for the entire SDN network. SDN switches are simple traffic forwarding devices without management capabilities. They rely on forwarding rules (also known as flow entries) issued by the SDN controller to manage data packets. SDN switches use flow tables to store flow entries. Each flow entry consists of three main components: a match field, an action, and statistics. The match field, which includes the source IP address, destination IP address, source port number, and destination port number, is used to match packets against flow entries. The action describes the network action to be performed on matching packets, including forwarding, broadcasting, or discarding. The statistics section accumulates statistics on matching packets, such as average packet size, total number of packets, and total bytes. Whenever an SDN switch receives a packet, it matches it against the flow entries in its flow table. If a matching flow entry is found, the switch processes the packet according to the action specified in the flow entry's action. Otherwise, the switch forwards the packet to the SDN controller to retrieve a matching flow entry. In addition to using flow entries to collect statistics, the SDN switch also collects statistics for the entire flow table and for each port. The SDN controller can query this statistical information through a standardized southbound interface to monitor the operating status of the SDN switch, formulate appropriate management and control policies, adjust switch load, optimize resource utilization, and ensure overall network operation.
[0003] Because SDN switches rely on high-speed, but expensive, and power-hungry TCAM memory to store flow tables, their flow table space is limited. To improve flow table space usage, the SDN controller assigns a validity period to each flow entry, controlling its lifecycle. However, this approach presents a potential security vulnerability: if an attacker has access to the flow table capacity and the validity period of a flow entry, they can carefully craft attack packet sequences to synchronize the attack packet transmission cycle with the flow entry validity period, causing each attack packet to install a new flow entry in the flow table. This allows the flow entries generated by the attack packets to not only occupy the remaining space in the flow table but also occupy the space left by the expiration of existing legitimate flow entries. Consequently, the flow table will have no space to store new legitimate traffic flow entries. New legitimate traffic will be dropped because it lacks a matching flow entry, resulting in a denial of normal network service and a flow table overflow attack.
[0004] The flow table overflow attack can be implemented in two ways, i.e., a saturation attack and a slow attack. The saturation attack sends a large number of attack packets in a short time to make the flow table overflow rapidly, but it is easy to be identified by a traditional detector based on a threshold value because the network packet speed is too large. The slow attack can slowly occupy the flow table space and eventually make the flow table overflow without significantly increasing the average network packet speed. The slow attack is difficult to be identified by the detector based on the threshold value, but a detection model can be established by using machine learning to detect the flow table overflow attack. A typical detection idea is to determine the attack flow and its attack path so as to block the attack flow and directly attack the attack source and the attack path. Therefore, the detection model needs to analyze the characteristics of a large amount of network traffic to be established. In the SDN network, the SDN controller usually collects the statistical information of the flow table entries of the SDN switch through polling to obtain the characteristics of the network traffic. However, the statistical information of the SDN flow table entries is large in size, and the collection process consumes a large amount of computing resources and control channel bandwidth of the SDN controller, which not only leads to poor scalability of the network, but also may directly affect the forwarding performance of the network, and has great limitations in practical application.
[0005] In addition to blocking the attack source or attack path by detecting the slow flow table overflow attack flow, the SDN network can also start a moving target defense measure based on the time jump of the flow table entry to destroy the synchronization between the attack packet sequence and the valid time of the flow table entry, so that the flow table entry of the slow flow table overflow attack packet cannot occupy the flow table entry space of the existing legal traffic, and cannot achieve the attack target of flow table overflow and denial of service. This method targets the attack target and does not need to identify the attack source and the attack path, but cannot avoid the flow table entry of the attack packet occupying a certain flow table space, which wastes valuable flow table resources. Therefore, it is necessary to select the appropriate time to start the moving target defense measure, and to reduce the damage of the attack and the resource consumption of the defense measure, which is a difficult problem in practical application. SUMMARY
[0006] The purpose of the present application is to overcome the shortcomings of the prior art and provide a resource-efficient early detection method for SDN low-speed flow table overflow attacks. This method is deployed in the SDN controller and can accurately predict the early detection of SDN low-speed flow table overflow attacks while consuming a small amount of SDN control channel bandwidth resources, determine the starting time point of the moving target defense measure based on the time jump of the flow table entry, and reduce the damage of the low-speed flow table overflow attack and the resource consumption of the detection and subsequent moving target defense measure.
[0007] The technical solution to achieve the purpose of the present application is:
[0008] A resource-efficient early detection method for SDN low-speed flow table overflow attacks, comprising the following steps:
[0009] 1) Training of the early detection model:
[0010] 1.1) Obtaining the original training dataset: Download a public dataset from the internet and add artificially generated slow flow table overflow attack packets to obtain a labeled traffic dataset.
[0011] 1.2) Training Data Feature Extraction: The traffic dataset obtained in step 1.1) is fed into a Python simulation program. This program simulates the storage and invalidation of flow table entries within the SDN switch flow table and samples the flow table state every second. This means that every second, six characteristic parameters of the flow table are calculated: flow table occupancy, average packet size, total number of packet bytes, source IP entropy, proportion of individual traffic items, and a factor related to flow table occupancy. Finally, for the traffic dataset obtained in step 1.1), the simulation program outputs a time series of six flow table characteristics in chronological order.
[0012] 1.3) Construct a directed graph sequence: The flow table at the sampling time point is used as the node of the graph. The node characteristics are the six characteristic parameters of the sampling time point calculated in step 1.2). The characteristic changes of the flow table at two sampling time points are used as edges. The edge characteristics include the time difference between the two sampling time points and the change in flow table occupancy. A fully connected directed graph is used to represent the continuous impact of network traffic on the flow table. There is an edge between any two nodes in the directed graph, that is, from the node representing the flow table sampled first to the node representing the flow table sampled later. Since a new node is added every 1 second, the number of nodes and the number of nodes in the directed graph increase over time. The number of edges will continue to increase. Using a 20-second time window, only the 20 most recent nodes and their edges are used as a graph for training the detection model. Each node in the graph has a label. A node with a label of 1 indicates that the flow table represented by the node has a flow table entry for a slow flow table overflow attack packet, that is, the flow table represented by the node has been attacked by a slow flow table overflow. A node with a label of 0 indicates that the flow table represented by the node does not contain a flow table entry for a slow flow table overflow attack packet, that is, the flow table represented by the node has not been attacked by a slow flow table overflow. Finally, a directed graph sequence is obtained, which constitutes the training graph dataset for the detection model.
[0013] 1.4) Use the GraphSAGE algorithm to train the detection model: GraphSAGE sets the hidden layer dimension to 64, the output layer dimension to 2, the training epochs to 400, and the learning rate to 0.01. The graph dataset obtained in step 1.3) is fed into the GraphSAGE algorithm as input to develop a detection model for slow flow table overflow attacks.
[0014] 2) Initialization of the Slow Flow Table Overflow Attack Early Detector: An SDN network consists of a centralized SDN controller and a large number of SDN switches and user terminals. The Slow Flow Table Overflow Attack Early Detector is a software integrated into the SDN controller. The detector first initializes the polling period (t) and uses the detection model obtained in step 1.4) as its own detection model.
[0015] 3) Processing of flow table information of the detected SDN switch:
[0016] 3.1) Test Data Collection: The slow flow table overflow attack early detector sends standardized OFPMP_TABLE and OFPMP_PORT_STATS requests to the detected SDN switch every t seconds to collect the switch's flow table statistics and port statistics. The slow flow table overflow attack early detector also reads the SDN controller's log file named conn.log every t seconds to collect relevant connection information. The time point at which this information is collected is also the sampling time point.
[0017] 3.2) Test Data Feature Extraction: The slow flow table overflow attack early detector extracts six flow table features from collected statistics and log files, including: flow table occupancy, average packet size, total packet bytes, source IP entropy, single-item traffic ratio, and flow table occupancy correlation factors.
[0018] 3.3) The slow flow table overflow attack early detector uses the method in step 1.3) to construct a directed graph to be detected;
[0019] 3.4) The slow flow table overflow attack early detector inputs the directed graph obtained in step 3.3) into the detection model in step 2) and outputs the detection result. A result of 1 indicates that the flow table of the detected SDN switch is attacked by a slow flow table overflow at the current polling time point, and a result of 0 indicates that the signpost of the detected SDN switch is not attacked by a slow flow table overflow at the current polling time point.
[0020] The flow table occupancy rate, average packet size, total number of packet bytes, source IP entropy value, single item traffic ratio, and flow table occupancy related factors in step 1.2) are specifically:
[0021] The flow table occupancy rate is equal to the number of valid flow table entries divided by the total number of flow table entries;
[0022] The total number of bytes in the data packets is equal to the sum of the total number of bytes in the received data packets;
[0023] The average packet size is equal to the total number of packet bytes received in 1 second divided by the total number of packets received; the source IP entropy value is calculated as follows: first count the source IPs of all flows in 1 second, then calculate the probability P(x) of each source IP appearing, and finally calculate the source IP entropy value , the calculation formula is ;
[0024] The proportion of single-item traffic is equal to the total number of single-item flows divided by the total number of all flows;
[0025] The flow table occupancy correlation factor is calculated as follows: take the current flow table occupancy value and the flow table occupancy value of the previous second, calculate their difference, and obtain a difference sequence. Then calculate the Pearson correlation coefficient of this sequence, which is the flow table occupancy correlation factor.
[0026] The specific calculation method for the flow table occupancy rate, average packet size, total number of packet bytes, source IP entropy value, single item traffic ratio, and flow table occupancy related factors in step 3.2) is as follows:
[0027] The flow table occupancy rate is extracted from the flow table statistics of the SDN switch and is calculated by dividing the occupied flow table space by the total flow table capacity;
[0028] The average packet size is extracted from the port statistics of the SDN switch and is calculated as the total number of packet bytes received by all ports divided by the total number of packets received by all ports;
[0029] The total number of bytes of data packets is extracted from the port statistics of the SDN switch and is calculated as the sum of the total number of bytes of data packets received by all ports;
[0030] The source IP entropy value is extracted from the conn.log file of the SDN controller. The method is as follows: first, all source IPs in the polling period are counted, then the probability P(x) of each source IP (x) appearing is calculated, and finally the source IP entropy value is calculated. , the calculation formula is ;
[0031] The proportion of unidirectional traffic is extracted from the conn.log file of the SDN controller. The method is as follows: extract the conn_state field within the polling period from the conn.log file, identify the unidirectional state code, and then count the number of unidirectional flows and the total number of flows, and finally calculate the proportion of unidirectional flows;
[0032] The correlation factor of flow table occupancy is obtained by taking the current flow table occupancy value and the flow table occupancy value of the previous second, calculating their difference to obtain a difference sequence, and then calculating the Pearson correlation coefficient of this sequence, which is the correlation factor of flow table occupancy.
[0033] The advantages or beneficial effects of this technical solution are:
[0034] This technical solution constructs an original traffic dataset with labels by adding artificially synthesized slow flow table overflow attack packets to a public dataset, solving the problem of the lack of public datasets with slow flow table overflow attack packets in current model training. This technical solution obtains a 6-dimensional flow table feature sequence by inputting the original traffic dataset into the simulation program, and further constructs a fully connected directed graph sequence with a node scale of 20, 6-dimensional flow table-level features as node characteristics, and 2-dimensional flow table change characteristics as edge characteristics. It accurately captures the change characteristics of the switch flow table under the slow flow table overflow attack, and trains the slow flow table overflow attack detection model through the GraphSAGE graph neural network algorithm, which has high accuracy and low detection latency, and realizes early detection of attacks. In the detection stage, this technical solution obtains node and edge characteristics by polling the flow table statistics, port statistics and conn.log log files of the SDN switch, constructs a resource-efficient test directed graph, and performs early detection of whether the flow table is currently under attack. Because the switch's response bytes to the controller's requests for flow table statistics and port statistics are small, and log files are generated by the controller, control bandwidth consumption is significantly reduced, improving network resource utilization. This technical solution can identify whether a flow table is vulnerable to a slow flow table overflow attack at an early stage, allowing a time window to activate the flow table's moving target defense measures, reducing the attack's impact on the network.
[0035] This method is deployed on the SDN controller and can perform high-precision early prediction of SDN low-speed flow table overflow attacks while consuming a small amount of SDN control channel bandwidth resources. It can also determine the start time point of mobile target defense measures based on the effective time jump of flow table entries, which not only reduces the damage of low-speed flow table overflow attacks, but also reduces the resource consumption of detection and subsequent activation of mobile target defense measures. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] Figure 1 Schematic diagram of the synthesis of the original training data set of the embodiment;
[0037] Figure 2 Schematic diagram of flow table feature extraction in an embodiment;
[0038] Figure 3 Schematic diagram of the flow table feature sequence of the embodiment;
[0039] Figure 4 It is a diagram of a figure and a sequence of figures of an embodiment;
[0040] Figure 5 2 is a schematic diagram of the detection model training of the embodiment;
[0041] Figure 6 is an overall schematic diagram of the system in the embodiment;
[0042] Figure 7 is the detection accuracy test result of the embodiment;
[0043] Figure 8 is the detection delay test result of the embodiment;
[0044] Figure 9 1 is a bandwidth consumption test result of the embodiment. DETAILED DESCRIPTION
[0045] The present invention will be further described below with reference to the accompanying drawings and embodiments, but the present invention is not limited thereto.
[0046] Example:
[0047] Reference Figure 6 ,A resource-efficient SDN low-speed flow table overflow attack early detection method, comprising the following steps:
[0048] 1) Training of the early detection model:
[0049] 1.1) Obtaining the original training dataset: Figure 1 As shown in Figure 2, we download a public data set from the Internet and then add artificially generated slow flow table overflow attack packets to obtain a labeled traffic data set.
[0050] 1.2) Training data feature extraction: such as Figure 2 As shown, the traffic data set obtained in step 1.1) is input into a Python simulation program, which simulates the storage and invalidation operations of flow table items in the SDN switch flow table and samples the state of the flow table every 1 second, that is, the six characteristic parameters of the flow table are calculated every 1 second: flow table occupancy rate, average packet size, total number of packet bytes, source IP entropy value, single-item traffic ratio, and related factors of flow table occupancy; the flow table occupancy rate is equal to the number of valid flow table items divided by the total number of flow table settings; the total number of packet bytes is equal to the sum of the total number of received packet bytes; the average packet size is equal to the total number of received packet bytes divided by the total number of received packets in 1 second; the source IP entropy value is calculated as follows: first, the source IP of all flows in 1 second is counted, then the probability P(x) of each source IP appearing is calculated, and finally the source IP entropy value is calculated , the calculation formula is The proportion of single-item traffic is equal to the total number of single-item flows divided by the total number of all flows. The correlation factor of flow table occupancy is calculated as follows: take the current flow table occupancy value and the flow table occupancy value of the previous second, calculate their difference, and obtain a difference sequence. Then calculate the Pearson correlation coefficient of this sequence, which is the correlation factor of flow table occupancy. For the traffic data set obtained in step 1.1), the simulation program outputs a time series of six-element flow table characteristics in chronological order.
[0051] 1.3) Construct a directed graph sequence: Figure 3 As shown in the figure, the flow table at the sampling time point is used as the node of the graph, and the node characteristics are the six characteristic parameters of the sampling time point calculated in step 1.2). The characteristic changes of the flow table at two sampling time points are used as edges. The edge characteristics include the time difference between the two sampling time points and the change of flow table occupancy. A directed graph is used to represent the continuous impact of network traffic on the flow table. There is an edge between any two nodes in the directed graph, that is, from the node representing the flow table sampled first to the node representing the flow table sampled later. Since a new node is added every 1 second, the number of nodes and edges in the directed graph will continue to increase over time. In addition, using a 20-second time window, only the 20 most recent nodes and the edges of these 20 nodes are taken as a graph for training the detection model. Each node in the graph has a label. A node with a label of 1 indicates that the flow table represented by the node has a flow table entry for a slow flow table overflow attack packet, that is, the flow table represented by the node has been attacked by a slow flow table overflow. A node with a label of 0 indicates that the flow table represented by the node does not contain a flow table entry for a slow flow table overflow attack packet, that is, the flow table represented by the node has not been attacked by a slow flow table overflow. Finally, a directed graph sequence is obtained, which constitutes the training graph dataset of the detection model.
[0052] 1.4) Use GraphSAGE algorithm to train the detection model: Figure 4 As shown in the figure, the GraphSAGE algorithm sets the hidden layer dimension to 64, the output layer dimension to 2, the number of training times to 400, and the learning rate to 0.01. The graph dataset obtained in step 1.3) is sent as input to the GraphSAGE algorithm to obtain a detection model for slow flow table overflow attacks.
[0053] 2) Initialization of the slow flow table overflow attack early detector: The SDN network consists of a centralized SDN controller and a large number of SDN switches and user terminals. The slow flow table overflow attack early detector is a software integrated in the SDN controller, such as Figure 5 As shown, the detector first initializes the polling cycle (t=1) and uses the detection model obtained in step 1.4) as its own detection model;
[0054] 3) Processing of flow table information of the detected SDN switch:
[0055] 3.1) Test Data Collection: The slow flow table overflow attack early detector sends standardized OFPMP_TABLE and OFPMP_PORT_STATS requests to the detected SDN switch every t seconds to collect the switch's flow table statistics and port statistics. The slow flow table overflow attack early detector also reads the SDN controller's log file named conn.log every t seconds to collect relevant connection information. The time point at which this information is collected is also the sampling time point.
[0056] 3.2) Test data feature extraction: The slow flow table overflow attack early detector extracts six flow table features from the collected statistical information and log files, including: flow table occupancy, average packet size, total number of packet bytes, source IP entropy, single traffic ratio, and related factors of flow table occupancy; the flow table occupancy is extracted from the flow table statistics of the SDN switch, and the calculation method is the occupied flow table space divided by the total flow table capacity; the average packet size is extracted from the port statistics of the SDN switch, and the calculation method is the total number of packet bytes received by all ports divided by the total number of packets received by all ports; the total number of packet bytes is extracted from the port statistics of the SDN switch, and the calculation method is the sum of the total number of packet bytes received by all ports; the source IP entropy is extracted from the conn.log file of the SDN controller, and the method is: first, count all source IPs in the polling period, then calculate the probability P(x) of each source IP (x) appearing, and finally calculate the source IP entropy value , the calculation formula is The proportion of single-item traffic is extracted from the conn.log file of the SDN controller. The method is as follows: extract the conn_state field within the polling cycle from the conn.log file, identify the single-item state code, and then count the number of single-item flows and the total number of flows, and finally calculate the proportion of unidirectional flows. The correlation factor of flow table occupancy is taken from the current flow table occupancy value and the flow table occupancy value of the previous second, and the difference between them is calculated to obtain a difference value sequence. The Pearson correlation coefficient of this sequence is then calculated, which is the correlation factor of flow table occupancy.
[0057] 3.3) The slow flow table overflow attack early detector uses the method in step 1.3) to construct a directed graph to be detected;
[0058] 3.4) The slow flow table overflow attack early detector inputs the directed graph obtained in step 3.3) into the detection model in step 2) and outputs the detection result. A result of 1 indicates that the flow table of the detected SDN switch is attacked by the slow flow table overflow at the current polling time point, and a result of 0 indicates that the signpost of the detected SDN switch is not attacked by the slow flow table overflow at the current polling time point. Figure 7 and Figure 8 As shown, the Graphsage model represents a method with high accuracy and low detection latency. Figure 9 The method of this example shown consumes little bandwidth resources.
[0059] In this example, by extracting flow table-level features, information collection is facilitated and bandwidth consumption is minimized. A fully connected directed graph with 20 nodes, 6-dimensional node features, and 2-dimensional edge features is constructed. This graph, which changes over time, forms a fully connected directed graph sequence. Using the GraphSAGE algorithm, an early detection model for slow flow table overflow attacks is trained. This model accurately captures the temporal characteristics of slow flow table overflow attacks, achieving high detection accuracy and low latency.
[0060] The slow flow table overflow attack early detector polls SDN switch flow table statistics and port statistics, as well as the SDN controller's conn.log log file, to extract the six-dimensional features of the detected flow table. It then constructs a 20-node fully connected directed graph with six-dimensional node features and two-dimensional edge features. This graph is fed into a trained early detection model and outputs a detection structure, indicating whether the flow table of the SDN switch under test is vulnerable to a slow flow table overflow attack at the current polling time. This novel method of obtaining statistical and log information significantly reduces bandwidth consumption in SDN networks and improves network scalability.
Claims
1. A resource-efficient SDN low-speed flow table overflow attack early detection method, characterized by: The steps include: 1) Training of the early detection model: 1.1) Obtaining the original training dataset: Download a public dataset from the internet and add artificially generated slow flow table overflow attack packets to obtain a labeled traffic dataset. 1.2) Training Data Feature Extraction: The traffic dataset obtained in step 1.1) is fed into a Python simulation program. This program simulates the storage and invalidation of flow table entries within the SDN switch flow table and samples the flow table state every second. This means that every second, six characteristic parameters of the flow table are calculated: flow table occupancy, average packet size, total number of packet bytes, source IP entropy, proportion of individual traffic items, and a factor related to flow table occupancy. Finally, for the traffic dataset obtained in step 1.1), the simulation program outputs a time series of six flow table characteristics in chronological order. 1.3) Construct a directed graph sequence: The flow table at the sampling time point is used as the node of the graph. The node characteristics are the six characteristic parameters of the sampling time point calculated in step 1.2). The characteristic changes of the flow table at two sampling time points are used as edges. The edge characteristics include the time difference between the two sampling time points and the change in flow table occupancy. A fully connected directed graph is used to represent the continuous impact of network traffic on the flow table. There is an edge between any two nodes in the directed graph, that is, from the node representing the flow table sampled first to the node representing the flow table sampled later. Since a new node is added every 1 second, the number of nodes and the number of nodes in the directed graph increase over time. The number of edges will continue to increase. Using a 20-second time window, only the 20 most recent nodes and their edges are used as a graph for training the detection model. Each node in the graph has a label. A node with a label of 1 indicates that the flow table represented by the node has a flow table entry for a slow flow table overflow attack packet, that is, the flow table represented by the node has been attacked by a slow flow table overflow. A node with a label of 0 indicates that the flow table represented by the node does not contain a flow table entry for a slow flow table overflow attack packet, that is, the flow table represented by the node has not been attacked by a slow flow table overflow. Finally, a directed graph sequence is obtained, which constitutes the training graph dataset for the detection model. 1.4) Use the GraphSAGE algorithm to train the detection model: GraphSAGE sets the hidden layer dimension to 64, the output layer dimension to 2, the training epochs to 400, and the learning rate to 0.
01. The graph dataset obtained in step 1.3) is fed into the GraphSAGE algorithm as input to develop a detection model for slow flow table overflow attacks. 2) Initialization of the Slow Flow Table Overflow Attack Early Detector: An SDN network consists of a centralized SDN controller and a large number of SDN switches and user terminals. The Slow Flow Table Overflow Attack Early Detector is a software integrated into the SDN controller. The detector first initializes the polling period (t) and uses the detection model obtained in step 1.4) as its own detection model. 3) Processing of flow table information of the detected SDN switch: 3.1) Test Data Collection: The slow flow table overflow attack early detector sends standardized OFPMP_TABLE and OFPMP_PORT_STATS requests to the detected SDN switch every t seconds to collect the switch's flow table statistics and port statistics. The slow flow table overflow attack early detector also reads the SDN controller's log file named conn.log every t seconds to collect relevant connection information. The time point at which this information is collected is also the sampling time point. 3.2) Test Data Feature Extraction: The slow flow table overflow attack early detector extracts six flow table features from collected statistics and log files, including: flow table occupancy, average packet size, total packet bytes, source IP entropy, single-item traffic ratio, and flow table occupancy correlation factors. 3.3) The slow flow table overflow attack early detector uses the method in step 1.3) to construct a directed graph to be detected; 3.4) The slow flow table overflow attack early detector inputs the directed graph obtained in step 3.3) into the detection model in step 2) and outputs the detection result. A result of 1 indicates that the flow table of the detected SDN switch is attacked by a slow flow table overflow at the current polling time point, and a result of 0 indicates that the flow table of the detected SDN switch is not attacked by a slow flow table overflow at the current polling time point.
2. A resource-efficient SDN low-speed flow table overflow attack early detection method according to claim 1, characterized in that: The flow table occupancy rate, average packet size, total number of packet bytes, source IP entropy value, single item traffic ratio, and flow table occupancy related factors in step 1.2) are specifically: The flow table occupancy rate is equal to the number of valid flow table entries divided by the total number of flow table entries; The total number of bytes in the data packets is equal to the sum of the total number of bytes in the received data packets; The average packet size is equal to the total number of packet bytes received in 1 second divided by the total number of packets received; the source IP entropy value is calculated as follows: first count the source IPs of all flows in 1 second, then calculate the probability P(x) of each source IP appearing, and finally calculate the source IP entropy value , the calculation formula is ; The proportion of single-item traffic is equal to the total number of single-item flows divided by the total number of all flows; The correlation factor of flow table occupancy is calculated as follows: take the current flow table occupancy value and the flow table occupancy value of the previous second, calculate their difference, and obtain a difference sequence. Then calculate the Pearson correlation coefficient of this sequence, which is the correlation factor of flow table occupancy.
3. The resource-efficient SDN low-speed flow table overflow attack early detection method according to claim 1 is characterized in that: The specific calculation method for the flow table occupancy rate, average packet size, total number of packet bytes, source IP entropy value, single item traffic ratio, and flow table occupancy related factors in step 3.2) is as follows: The flow table occupancy rate is extracted from the flow table statistics of the SDN switch and is calculated by dividing the occupied flow table space by the total flow table capacity; The average packet size is extracted from the port statistics of the SDN switch and is calculated as the total number of packet bytes received by all ports divided by the total number of packets received by all ports; The total number of bytes of data packets is extracted from the port statistics of the SDN switch and is calculated as the sum of the total number of bytes of data packets received by all ports; The source IP entropy value is extracted from the conn.log file of the SDN controller. The method is as follows: first, all source IPs in the polling period are counted, then the probability P(x) of each source IP (x) appearing is calculated, and finally the source IP entropy value is calculated. , the calculation formula is ; The proportion of unidirectional traffic is extracted from the conn.log file of the SDN controller. The method is as follows: extract the conn_state field within the polling cycle from the conn.log file, identify the unidirectional state code, and then count the number of unidirectional flows and the total number of flows, and finally calculate the proportion of unidirectional flows; The correlation factor of flow table occupancy is obtained by taking the current flow table occupancy value and the flow table occupancy value of the previous second, calculating their difference to obtain a difference sequence, and then calculating the Pearson correlation coefficient of this sequence, which is the correlation factor of flow table occupancy.