A method for mitigating low-rate DDoS attacks on SDN data plane based on ranking learning
By employing a ranking-based learning approach, low-rate DDoS attacks on SDN switches are identified and mitigated, solving the flow table overflow problem and achieving efficient attack detection and mitigation.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HUNAN UNIV CHONGQING RES INST
- Filing Date
- 2022-10-20
- Publication Date
- 2026-04-21
AI Technical Summary
SDN switches' flow tables are vulnerable to low-rate DDoS attacks, which can cause flow table overflows and affect normal traffic forwarding. Existing technologies struggle to effectively identify and mitigate such attacks.
A ranking-based learning approach is adopted. By polling flow entries, feature information is extracted, a ranking learning model is constructed, the ranking score of flow entries is predicted, and the flow entries are rearranged according to the scores. High-scoring entries are deleted to mitigate attacks.
It enables real-time detection and mitigation of low-rate DDoS attacks on the data plane, with low false alarm and false negative rates, adaptability to various network conditions, and immediate and effective mitigation results.
Smart Images
Figure CN115664765B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of computer network security, specifically relating to a method for mitigating low-rate DDoS attacks on the SDN data plane based on ranking learning. Background Technology
[0002] SDN is a centralized network architecture where the data plane and control plane of a traditional network layer are separated and decoupled. SDN's logical control resides on the control plane, typically handled by a single controller that executes network control, traffic forwarding, and other logic, enabling convenient centralized network management. Furthermore, the SDN data plane is simplified, requiring less integration of network logic and only needing to execute actions based on messages from the control plane. SDN offers advantages such as modularity and programmability, and is compatible with the latest technologies like programmable data planes and packet processing languages, making it widely considered one of the solutions for future networks.
[0003] In SDN, the simplified data plane is only responsible for packet matching and forwarding, while the flow table in an SDN switch is the key component responsible for storing packet forwarding rules. Packet forwarding rules are determined by the controller and distributed and installed into the switch's flow table via southbound interface protocols such as OpenFlow. Each rule is called a flow table entry. When a packet arrives at the switch, the switch parses the packet header fields and attempts to match them with existing flow table entries. If a match is successful, the switch performs the forwarding action specified by the flow table entry; otherwise, the switch considers it a new flow and reports it to the controller via a Packet-In message to install the new flow table entry.
[0004] Currently, ternary addressable memory (TCAM) is the mainstream storage unit for SDN flow tables. TCAM devices are characterized by high performance, making them very suitable for SDN scenarios with high-speed packet matching and low-latency network transmission; however, due to limitations in chip physical conditions, TCAM has shortcomings such as high power consumption and limited memory, resulting in a generally low capacity for flow tables, making it difficult to cope with wide-area scenarios with massive traffic.
[0005] As a scarce network resource, TCAM-based flow tables can become targets of malicious resource-consuming attacks: attackers fill the flow table with attacked entries until it overflows, at which point the flow table can no longer provide forwarding services for normal traffic. To make the attack more covert, attackers can periodically retransmit packets to the target switch during the flow table's soft timeout period when installing flow table entries, triggering the flow table entry matching mechanism to prevent the attack rules from being deleted. This type of attack, which evades the flow table entry timeout mechanism, has an extremely low attack rate, and attempts to occupy the flow table, is called a low-rate DDoS attack on the data plane.
[0006] This invention addresses the security issues caused by low-rate DDoS attacks on the data plane. Based on the goal of protecting SDN security and availability, it proposes a ranking-based learning-based mitigation method for low-rate DDoS attacks on the SDN data plane. This method can be deployed in a distributed manner on SDN switches. First, it polls the switch's flow tables to calculate the current number of flow entries, monitors the flow table status, and determines whether a low-rate DDoS attack on the data plane has occurred. If such an attack has occurred, it extracts the statistical characteristics, source and destination addresses, and other information of each flow entry. Based on the flow entry characteristics and attack relevance labels, it employs an ensemble learning algorithm of Extreme Gradient Boosting (XGBoost) and a pairwise ranking mechanism to construct a ranking learning model for the flow entries. Then, for each flow entry in the flow table, based on its statistical characteristics, the ranking learning model predicts a "ranking score" for each entry, and the flow table is re-ranked according to the ranking scores from high to low. Finally, the SDN switch deletes all flow entries with ranking scores higher than a threshold, as well as a certain proportion of flow entries with relatively high ranking scores, ultimately achieving attack mitigation. This method can be practically deployed on SDN to achieve real-time detection and mitigation of low-rate DDoS attacks on the data plane, with low false positive and false negative rates and adaptability to various network conditions. Therefore, this detection method can be used in SDN to accurately detect and mitigate low-rate DDoS attacks on the data plane. Summary of the Invention
[0007] To address the security risks of low-rate DDoS attacks on the data plane faced by SDN switches and ensure the security and availability of SDN flow tables under such attacks, a mitigation method based on ranking learning is proposed. This mitigation method effectively identifies malicious flow table entries with low false positive and false negative rates, low algorithm overhead, and immediate mitigation effect. It can be deployed as a user program on SDN switches and adapts to real-world network traffic scenarios. Therefore, this detection method is universally applicable for accurately and in real-time detecting low-rate DDoS attacks on the data plane in SDN and protecting the security and availability of SDN flow tables.
[0008] The technical solution adopted by this invention to achieve the above objectives mainly includes six steps: flow table data sampling, flow table feature analysis, flow table classification and labeling, sorting model training, attack threshold setting, and network attack mitigation.
[0009] 1. Flow table data sampling. Based on the software switch OpenvSwitch, a script program containing OpenFlow switch flow table sampling commands is used to poll the switch flow table and obtain information on all flow table entries of the switch on the SDN data plane in real time, forming a dataset of raw flow table entries. To prevent inactive flow table entries from generating redundant records in the dataset, the polling interval should be at least greater than the soft timeout of the flow table.
[0010] 2. Flow Table Feature Analysis. Three fields—"Duration," "Cumulative Number of Matched Groups," and "Cumulative Number of Matched Bytes"—are extracted from flow table entries. Based on the combination of these three fields, six features of the flow table entry are calculated. Further, the source address, destination address, and other information of each flow table entry are extracted as identifiers for the flow table entry and its features. Finally, a preliminary dataset is formed.
[0011] 3. Flow Table Classification Labeling. Based on the extracted flow table entry identifiers, each flow table entry is labeled with "0" or "1" as its "relevance label"; then, each flow table entry in the dataset is labeled with a "query ID". For each flow table entry, its corresponding six features are combined with the flow table entry's "relevance label" and "query ID" to finally obtain a standard ranking learning dataset with "relevance label" and "query ID".
[0012] 4. Ranking Model Training. Using an ensemble learning method, a flow table item ranking learning model is trained on the dataset, and the ranking criterion is set as pairwise. During training, the optimization objective of the model is set, and the evaluation metrics are recall, normalized depreciation cumulative gain (NDCG), or mean precision (MAP).
[0013] 5. Attack Threshold Setting. Using the trained ranking learning model, predict the ranking score for each flow table entry in the dataset and normalize the ranking score. If the proportion of flow table entries with a "relevance label" of 1 in the dataset is N, then the attack detection threshold after normalizing the ranking score is 1-N, and the ranking score threshold for determining an attack is set accordingly.
[0014] 6. Network Attack Mitigation. When an SDN switch determines that a low-rate DDoS attack has occurred, the ranking learning model predicts the ranking score of each flow table entry and rearranges the flow table in descending order of the ranking score to obtain the eviction priority of the flow table entries. The higher the ranking score, the more relevant the flow table entry is to the attack flow. Finally, it determines which flow table entries should be deleted to free up flow table space and performs eviction operations on the corresponding flow table entries.
[0015] Beneficial effects
[0016] This SDN data plane low-rate DDoS attack mitigation method is fully compatible with SDN scenarios, the OpenFlow protocol, and OpenvSwitch software switches, and can be practically deployed on SDN switches to achieve real-time data plane low-rate DDoS attack mitigation. The attack mitigation method in this invention is comprehensive, accurately identifying the overall anomaly caused by the attack from a holistic, macroscopic perspective of SDN flow tables. Furthermore, it analyzes the differences between traffic flows by examining the microscopic behavioral characteristics of each flow table entry, and uses ranking learning techniques to predict the order in which flow table entries are evicted. This method has high accuracy in identifying attack flows, and the mitigation method is immediate and effective. Moreover, compared to classification methods that directly predict the category of flow table entries, this method predicts the order in which flow table entries are evicted, making the attack mitigation steps more interpretable. Therefore, this detection method can be used in SDN environments to achieve accurate, real-time detection and mitigation of SDN data plane low-rate DDoS attacks. Attached Figure Description
[0017] Figure 1 This is a parameter model for low-rate DDoS attacks on the data plane in SDN. The attack model includes three main parameters: Attack Period (AP), which is the interval between attacker retransmissions of packets. In a low-rate DDoS attack, the attacker needs to continuously retransmit attack packets to ensure that malicious flow entries occupy the flow table for a long time, evading the soft timeout mechanism; Attack Step (AS), which is the number of additional packets the attacker sends between adjacent APs. The parameter AS is used to maintain the stealth of the attack. By controlling AS, the attacker can slowly increase the total number of attack flow entries, thus gradually increasing the attack strength and reducing the likelihood of detection; Maximum Attack Strength (MAS) refers to the maximum number of attack rules that the attacker possesses or can maintain.
[0018] Figure 2 This is a scatter plot showing four sets of characteristics for normal flow entries and attack flow entries. Compared to normal flows, low-rate DDoS attack flows in the data plane have a longer flow duration, fewer packets and bytes transmitted, and a lower average packet size. Furthermore, because low-rate DDoS attacks only need to maintain the existence of attack flow entries without transmitting any valid information, their transmission speed and scale are typically lower than normal flows.
[0019] Figure 3 This diagram illustrates the importance of six features of flow table entries. Based on the statistical features in flow table entries, ensemble learning techniques can be used to learn the morphological characteristics of various types of traffic, thereby effectively distinguishing between normal and attack flow table entries.
[0020] Figure 4This diagram illustrates the SHAP values of the six features of a flow entry. Under different environments, the six features of a flow entry may have varying degrees of influence on predicting the flow entry ranking score. Therefore, to train an excellent flow entry ranking learning model, multiple optimization metrics need to be set.
[0021] Figure 5 The distribution of ranking scores on the flow table item dataset is shown. It can be seen that the ranking learning model can effectively distinguish between attack flows and normal flows, and attack flows have higher ranking scores and will be ranked before normal flows, thus being expelled first.
[0022] Figure 6 The diagram shows a comparison of flow table entry components in SDN flow tables with and without the present invention deployed. It can be seen that deploying the attack mitigation module of this invention significantly reduces the proportion of attack flow table entries.
[0023] Figure 7 This is a flowchart of a low-rate DDoS attack mitigation method for SDN data plane based on ranking learning. Detailed Implementation
[0024] The invention will be further described below with reference to the accompanying drawings.
[0025] like Figure 6 As shown, the method of the present invention mainly includes six steps: flow table data sampling, flow table feature analysis, flow table classification and labeling, sorting model training, attack threshold setting, and network attack mitigation.
[0026] 1. Flow table data sampling. Raw flow table entries are collected using the software switch OpenvSwitch.
[0027] If the SDN switch supports the OpenvSwitch command-line program, the switch command-line command "ofctldump-flows" can be used directly to extract all flow table entries in the switch flow table and perform polling sampling.
[0028] If the SDN switch does not support the OpenvSwitch command-line program, the controller can poll and sample the switch flow table based on the OpenFlow protocol message events OFPFlowStatsRequest or OFPFlowStatsReply.
[0029] The polling interval for flow table sampling should be no less than the soft timeout of the SDN flow table, so that inactive flow table entries can expire naturally and avoid creating a large number of redundant records in the dataset.
[0030] The extracted flow table entry data should include at least the following fields or information:
[0031] Network protocol type (TCP, UDP, IP), flow duration, cumulative number of packets matched in the flow table, cumulative number of bytes matched in the flow table, flow IP source address, flow IP destination address, flow MAC source address, and flow MAC destination address.
[0032] After sampling for a period of time, the flow table entries collected by all switches are aggregated to obtain the dataset of the original flow table entries.
[0033] To collect the above information, SDN switches or controllers are required to perform at least Layer 3 or higher information forwarding.
[0034] 2. Flow Table Feature Analysis. Using the dataset of original flow table entries extracted in step 1, extract the features of each flow table entry and the identifiers for those features.
[0035] Each flow entry is defined as a six-tuple consisting of six features: "duration", "cumulative number of matching packets", "cumulative number of matching bytes", "average packet interval", "transmission speed", and "average packet size".
[0036] The “Duration” (FD) feature is extracted directly from the data set of the flow table entry, which is the “Flow Duration” field, indicating the duration of the flow table entry since its installation.
[0037] The "Cumulative Number of Matched Packets" (PiF) feature is extracted directly from the data set of the flow table entry. It is the "Cumulative Number of Matched Packets in Flow Table" field, which indicates the cumulative number of times the flow table entry has been matched.
[0038] The "Cumulative Matched Bytes" (BiF) feature is extracted directly from the data set of the flow table entry, which is the "Cumulative Matched Bytes" field of the flow table, indicating the total size of all packets matched by the flow table entry.
[0039] The "Mean Interval Between Matches" (MPI) feature is defined as the ratio of "cumulative number of matched pairs" to "duration," i.e. The higher the MPI, the lower the activity level of the stream; higher MPI is more associated with attack stream behavior that evades soft timeout mechanisms.
[0040] The "Transmission Speed" (TS) feature is defined as the ratio of "cumulative matched bytes" to "duration," i.e., The higher the TS value, the more efficient the stream transmission; a lower TS value may correspond to a lower priority transmission task or an attack stream.
[0041] The "Average Packet Size" (MPS) feature is defined as the ratio of "cumulative matched bytes" to "cumulative matched packets," i.e. The lower this characteristic, the more likely the flow entry corresponds to a lower priority transport task or attack flow.
[0042] Figure 3 and Figure 4 This demonstrates the relationship between the importance of these six features in ranking learning.
[0043] The identifier of a flow table entry includes the following fields: flow IP source address, flow IP destination address, flow MAC source address, and flow MAC destination address.
[0044] The identifier of a flow entry is used to correspond a unique flow entry to its characteristic six-tuple. That is, the "identifier" is used to uniquely locate a flow entry with the characteristic of the "six-tuple".
[0045] 3. Traffic Classification and Labeling. Based on the identifier of each flow table entry, a "relevance label" and "query ID" are labeled for the flow table entry to construct a complete ranking learning training dataset.
[0046] The "relevance label" can be either "0" or "1", which means that the flow entry is (1) or (0) related to the attack flow.
[0047] When building the training set, the relevance label is "1" if the source IP of the flow table entry is the attacker's IP, and "0" otherwise. The relevance label is only used during the training phase. In actual deployment, the source IP address of the flow table entry is not used to identify attack flows.
[0048] The "Query ID" is the same in all flow table entries and can be set to any integer.
[0049] Flow entries with the same "Query ID" represent entries that will be placed under the same query during training. Since the purpose of this invention is solely to target "query attack flows," all flow entries contain only this one query.
[0050] At the end of step 3, the "relevance label" and "query ID" are bound to the corresponding flow table entries and converted to libSVM format to obtain a standard ranking learning dataset.
[0051] 4. Ranking Model Training. The XGBoost ensemble learning algorithm is used to train the flow table item ranking learning model by combining query ID, relevance label, feature six-tuple, and flow table item identifier, setting the ranking criterion as Pairwise, and defining evaluation and metrics.
[0052] The features required for training the XGBoost model are six-tuple features that reflect the behavior of flow entries. In addition, query ID, relevance label and flow entry identifier are only used as training aids and are not used as the basis for predicting ranking scores.
[0053] This invention can sort flow table entries based on flow table characteristics. The criteria for sorting flow table entries are as follows: Compared with normal network traffic, the traffic behavior of low-rate DDoS attacks on the data plane exhibits the following anomalies: 1) Long duration: Attack flow table entries occupy the flow table space for a long time, and FD is significantly increased; 2) Abnormal traffic behavior: Attackers only need to resend attack packets within each soft timeout period, without continuously transmitting data, and MPI is significantly increased; 3) Less data transmitted: Attackers only need to send a single packet to install a new flow table entry, without transmitting any valid data, i.e., BiF, PiF, and TS are low. Figure 2 The correspondence between these features is shown.
[0054] In this invention, the ranking training criterion is Pairwise, meaning the metadata used for training is a pair of flow table entries. During training, the relative order of the two flow table entries in a pair is compared, and the final output is a ranked sequence of all flow table entries. Compared to the Pointwise method, which treats the ranking problem as a classification problem, Pairwise effectively reflects the order in which flow table entries are evicted, obtains the eviction priority of flow table entries, and increases the interpretability of attack mitigation.
[0055] When training a ranking learning model, the metrics used for evaluation and optimization can be recall, normalized depreciation cumulative gain (NDCG), or average precision (MAP).
[0056] Recall focuses on the correctness of distinguishing between "attack flow" and "normal flow," while Normalized Discount Cumulative Gain (NDCG) and Mean Precision (MAP) focus on the relative ranking order between "attack flow" and "normal flow." Therefore, all three metrics can be used to evaluate and optimize flow table item ranking learning models.
[0057] For a feature 6-tuple, the expected output of the flow table item ranking learning model is a "ranking score".
[0058] The ranking score has no practical meaning; it only indicates the ranking priority of flow entries. When there are multiple flow entries as input, a higher ranking score indicates that the flow entry is more likely to be associated with the attack flow.
[0059] Ideally, the ranking score of an attack flow table entry will always be higher than that of a normal flow table entry. Figure 5 The distribution of the ranking scores is shown.
[0060] 5. Attack Threshold Determination. Using the flow table entry ranking learning model obtained in step 4, the ranking score of all flow table entries is predicted to finally obtain the attack determination threshold.
[0061] The ranking scores of all flow entries are normalized. If the proportion of flow entries with a relevance label of "1" in the original dataset is N, then after normalization, the ranking score threshold for attack flow entries is 1-N.
[0062] Find the flow table entry whose normalized sort score is closest to 1-N. Its original sort score is the threshold for attack determination. That is, if the sort score exceeds this value, it is considered to be related to the attack flow.
[0063] The main purpose of setting a pre-defined attack threshold is to reduce the number of times the flow table is traversed. When traversing the flow table from highest to lowest sorted score, it is not necessary to traverse the entire flow table to find all attack flow table entries that exceed the threshold.
[0064] 6. Network attack mitigation. When a low-rate DDoS attack on the data plane causes a flow table overflow, attack mitigation actions are performed.
[0065] First, the feature six-tuples of all flow entries in the flow table are calculated. Then, the trained flow entry ranking learning model is used to predict the ranking score of each flow entry in the current SDN switch flow table. Finally, the flow tables are rearranged in descending order of the ranking scores.
[0066] The flow table entries are traversed sequentially according to their sorting scores from highest to lowest. If the sorting score of the current flow table entry is greater than the threshold, the flow table entry is "marked" and its "identity" is added to the "deletion list".
[0067] The "marked" flow entries are the detected attack flow entries; the "deletion list" is a temporary file that stores the identification information of the flow entries. After the flow entries have been traversed, a unified deletion action will be performed.
[0068] If the sorting score of the current flow entry is less than the threshold, it means that the attack flow entry has been added. Here, because there is a sorting score threshold, it is not necessary to traverse the entire flow table, thus reducing the number of flow entry traversals.
[0069] At this point, in order to ensure sufficient flow table space, some normal flows with high sorting scores (which usually have lower transmission efficiency and priority) can be further deleted.
[0070] Specifically, the process is as follows: First, determine whether the number of flow table entries in the "to be deleted list" exceeds 20% of the flow table capacity. If it does, the traversal ends; if it does not, continue adding flow table entries to the "to be deleted list" in descending order of sorting score until the "to be deleted list" contains 20% of the maximum flow table capacity of flow table entries.
[0071] Execute the flow table entry deletion command, based on the OpenFlow protocol, to delete flow table entries in the "to be deleted list" and complete the attack mitigation.
[0072] Figure 6 This paper compares the components of flow table entries with and without the present invention. Without the present invention, the flow table space is gradually occupied by attack flows; with the present invention deployed, the flow component structure of the flow table space is improved, and the proportion of attack flows is significantly reduced.
[0073] When deploying this invention, the data plane low-rate DDoS attack detection and mitigation method described herein should be distributed across various switches in the SDN data plane, with each switch responsible for its own flow table entry management, thereby reducing the operating load of the SDN controller.
Claims
1. A method for mitigating low-rate DDoS attacks on SDN data plane based on ranking learning, characterized in that, The low-rate DDoS attack mitigation method described above includes the following steps: Step 1, Flow Table Data Sampling: Using a script program containing OpenFlow switch flow table sampling commands, poll the switch flow tables to obtain all flow table entry information of the switches on the SDN data plane in real time, forming a dataset of raw flow table entries; to prevent inactive flow table entries from generating redundant records in the dataset, the polling interval should be at least greater than the soft timeout of the flow table. Step 2, Flow Table Feature Analysis: Process the dataset of the original flow table entries from Step 1; extract the "duration", "cumulative number of matched packets", and "cumulative number of matched bytes" of each flow table entry in the switch as the three basic features of the flow table entry; then, based on the combination of these three basic features, extract the three combined features of "average packet interval", "transmission speed" and "average packet size" of the flow table entry; next, further extract the "identifier" information of each flow table entry, which is used to match the six features of the flow table entry with the unique flow table entry in the switch, and finally form a new dataset composed of the above features and identifiers; Step 3, Flow Table Classification Labeling: In the new dataset obtained in Step 2, each flow table entry is labeled with "0" or "1" as its "relevance label" based on its "identifier"; then, each flow table entry in the dataset is labeled with a "query ID", finally resulting in a standard ranking learning dataset with "relevance label" and "query ID". Step 4, Ranking Model Training: Based on the standard ranking learning dataset obtained in Step 3, train the flow table item ranking learning model using an ensemble learning method, and set the ranking criterion as Pairwise; during the training process, the optimization objective and evaluation metric can be any one of recall, normalized depreciation cumulative gain, and average precision. Step 5, Attack Threshold Setting: Using the flow table entry ranking learning model obtained in Step 4, predict the ranking score of each flow table entry in the entire dataset and perform 0-1 normalization; let N be the proportion of flow table entries with "relevance label" of "1" in Step 3 in the dataset, and let its value range from 0.00 to 1.
00. Then the attack detection threshold after normalization of the ranking score is 1-N; find the flow table entry whose normalized ranking score is closest to 1-N, and its original ranking score TH is the attack judgment threshold. That is, when the ranking score exceeds TH, it is considered to be related to the attack flow. Step 6, Network Attack Mitigation: Deploy the flow table entry ranking learning model obtained in Step 4 on the switches of the SDN data plane; when a low-rate DDoS attack on the SDN data plane causes the flow table of the switch to overflow, extract all flow table entries, predict the ranking score of each flow table entry, and arrange the flow table entries in descending order according to the ranking score; finally, traverse the flow table in descending order of ranking score, and delete the low-rate DDoS attack flow in turn to fully mitigate the low-rate DDoS attack on the SDN data plane.
2. The low-rate DDoS attack mitigation method of claim 1, wherein, The flow table entry polling sampling in step 1 is based on the OpenvSwitch software switch that supports the OpenFlow protocol. When performing flow table entry polling sampling, each software switch on the SDN data plane executes the data sampling command in its own command control line to obtain the flow table entry information of its own switch.
3. The low-rate DDoS attack mitigation method as claimed in claim 1, wherein, In step 2, the three basic features, "duration", "cumulative number of matched packets" and "cumulative number of matched bytes", should be extracted from the fields of each flow table entry. The three combined features, "average packet interval", "transmission speed" and "average packet size", are all calculated from the three basic features. Among them, "average packet interval" is defined as the ratio of "cumulative number of matched packets" to "duration", "transmission speed" is defined as the ratio of "cumulative number of matched bytes" to "duration", and "average packet size" is defined as the ratio of "cumulative number of matched bytes" to "cumulative number of matched packets".
4. The low-rate DDoS attack mitigation method as claimed in claim 1, wherein, The "identifier" information of the flow table entry mentioned in step 2 consists of four parts: "source and destination IP addresses" and "source and destination port numbers". That is, the "identifier" field contains Layer 3 forwarding information. In order to effectively record flow table entries that conform to the Layer 3 forwarding granularity, the SDN controller is required to run Layer 3 and above forwarding logic when the method is executed.
5. The low-rate DDoS attack mitigation method as claimed in claim 1, wherein, In step 3, the "relevance label" of a flow table entry is either "0" or "1", indicating whether the flow table entry is related to the attack flow table entry. Flow table entries from low-rate DDoS attack source IP addresses are marked as 1, i.e., related, while other flow table entries are marked as 0, i.e., unrelated. The "query ID" of all flow table entries is set to any integer value, indicating that when training the ranking learning model, all flow table entries are under the same query targeting the "attack flow table entry".
6. The low-rate DDoS attack mitigation method as claimed in claim 1, wherein, In step 4, the flow table item ranking learning model is trained based on the ensemble learning method "extreme gradient boosting," which can be divided into the following steps: Step 4.1: Data partitioning; The standard ranking learning dataset finally obtained in Step 3 is divided into a training set and a test set in a ratio of 6:4; Step 4.2: Model training; For the training set, train an extreme gradient boosting model by combining the query ID, relevance label and six features of each flow table entry, and set the ranking criterion to Pairwise, the ranking basis to the six features of the flow table entry, and the ranking label to the relevance label of each flow table entry. Step 4.3: Evaluation and optimization; Set the optimization metric for training the ranking learning model to any one of recall, normalized depreciation cumulative gain, and average precision, and continue to iterate the model until the selected optimization metric is lower than the set threshold, at which point training ends.
7. The low-rate DDoS attack detection and mitigation method as claimed in claim 1, wherein, The ranking score obtained in step 5 has no practical significance; it only indicates the correlation between flow table entries and low-rate DDoS attack flows. That is, the higher the ranking score, the more likely the flow table is to be related to the attack flow. The attack determination threshold TH is the interval threshold of the highest 100N×100% ranking score in the dataset, which means that under ideal conditions, the ranking of attack flow table entries is always higher than that of normal flow table entries.
8. The low-rate DDoS attack mitigation method of claim 1, wherein, Step 6 involves mitigation of attacks when low-rate DDoS attacks on the data plane cause SDN flow table overflows. This mainly includes the following steps: Step 6.1: Using the flow table entry ranking learning model trained in Step 4, predict the ranking score of each flow table entry in the flow table of this switch, and then sort them from high to low according to the ranking score. Step 6.2: Using the command-line program of the software switch OpenvSwitch, traverse the flow table in descending order of sorting score, delete the flow table entries one by one, and record the number of deleted flow table entries until the sorting score of the flow table entry at the current traversal position is less than TH, then end the deletion action. Step 6.3: If the number of deleted flow table entries is less than 20% of the flow table capacity after step 6.2 is completed, continue to delete flow table entries in descending order of sorting score until the number of deleted flow table entries reaches 20% of the flow table capacity, thereby clearing enough flow table space.
9. The low-rate DDoS attack mitigation method of claim 1, wherein, In practice, the method described above should be deployed in a distributed manner on various switches in the SDN data plane, with each switch responsible for its own flow table entry management, thereby reducing the operating load of the SDN controller.