Method for detecting and mitigating slow flow table overflow attack based on two-level threshold

Abstract

This invention discloses a method for detecting and mitigating slow flow table overflow attacks based on a two-level threshold, belonging to the field of network security. The method includes: deploying on an SDN switch to monitor the flow table occupancy rate in real time; when the flow table occupancy rate reaches the first-level threshold, sampling the flow table and calculating its characteristics, then initiating attack detection. If a slow flow table overflow attack is detected, the malicious flow expulsion mode of the attack mitigation module is entered, and flow rules classified as malicious are expelled; when the flow table occupancy rate reaches the second-level threshold, the flow table overflow prevention mode of the mitigation module is entered, and suspected malicious flow rules are expelled proportionally to free up flow table space and prevent overflow. This method can monitor the flow table status of the switch in real time, accurately detect slow flow table overflow attacks, has a low false negative rate and low false positive rate, and can accurately identify and expel malicious flow rules. Therefore, this method can effectively detect and mitigate slow flow table overflow attacks in SDN environments.

Description

Technical Field

[0001] This invention belongs to the field of computer network security, specifically relating to a method for detecting and mitigating slow flow table overflow attacks based on two-level thresholds. Background Technology

[0002] To make more efficient use of resources, SDN (Software-Defined Networking) emerged to meet diverse network needs and provide elastic services. With the development of cloud computing technology, traditional network architectures have become slow to update, resulting in complex and rigid systems. SDN decouples network traffic management and packet forwarding functions, providing network programmability, centralized network management, dynamic network traffic control, and automated deployment.

[0003] SDN separates the data plane and control plane, connecting and exchanging information via the OpenFlow protocol. However, this unique network architecture also presents certain security vulnerabilities. The control plane needs to process a large amount of information from the entire network system, thus requiring high performance. Meanwhile, the data plane's forwarding capacity is limited by the flow table size, resulting in a performance bottleneck.

[0004] The storage and fast lookup of rules in flow tables rely on TCAM (Ternary Content Addressable Memory), which is expensive and consumes a lot of power, resulting in very limited memory size. Once a flow table is attacked and overflows, normal rules cannot be processed in a timely manner, thus reducing the TCP congestion window and even decreasing the overall network throughput. Slow flow table overflow attacks trigger the installation of malicious flow rules by sending packets at low rates that do not match the flow table, occupying available space in the flow table and causing it to overflow.

[0005] To ensure the availability of flow tables and the forwarding efficiency of normal flow rules, this invention proposes a two-level threshold-based method for detecting and mitigating slow flow table overflow attacks. This method sets two thresholds for flow table occupancy based on the urgency of the slow flow table overflow attack, corresponding to the malicious flow eviction mode and the flow table overflow prevention mode of the attack mitigation module. This method is deployed on an SDN switch to monitor the flow table occupancy in real time. When the flow table occupancy reaches the first-level threshold, the collected flow table content is sampled and flow table characteristics are calculated, and then attack detection is initiated. If a slow flow table overflow attack is detected, the system enters the malicious flow eviction mode of the attack mitigation module, eviction of flow rules classified as malicious; when the number of rules reaches the second-level threshold, the system directly enters the flow table overflow prevention mode of the mitigation module, proportionally eviction of suspected malicious flow rules from the flow table to free up flow table space and prevent overflow. This method can monitor the flow table status of SDN switches in real time, accurately detect slow flow table overflow attacks, and has a low false positive and false negative rate. It can also accurately identify and ban malicious flow rules. Therefore, this method can effectively detect and mitigate slow flow table overflow attacks in SDN environments. Summary of the Invention

[0006] To address the shortcomings of existing slow flow table overflow attack detection and mitigation methods, such as low attack detection rate, inability to promptly process malicious flow rules, and excessive system overhead, as well as the situation where normal rules cannot be processed in a timely manner when flow tables are overflowing, potentially even reducing the overall network throughput, a two-level threshold-based slow flow table overflow attack detection and mitigation method is proposed. This method can monitor the flow table status of SDN switches in real time, accurately detect slow flow table overflow attacks, and has a low false positive and false negative rate. Furthermore, it can accurately identify and expel malicious flow rules, thus effectively detecting and mitigating slow flow table overflow attacks in SDN environments.

[0007] The technical solution adopted by the present invention to achieve the above objectives is as follows: the slow flow table overflow attack detection and mitigation method mainly includes five steps: flow table occupancy monitoring, flow table data sampling, flow table feature calculation, attack detection, and attack mitigation.

[0008] 1. Flow table occupancy monitoring. In SDN, the number of flow rules in the switch is acquired in real time. The OpenvSwitch command script polls the number of flow rules in the flow table of the SDN switch at 1.0 second intervals, and calculates the current flow table occupancy based on the total capacity of the flow table.

[0009] 2. Flow table data sampling. Set the secondary threshold to 75% of the total flow table capacity. That is, when the flow table occupancy rate calculated in step 1 reaches 75% of the total flow table capacity, use the OpenvSwitch command script to obtain the contents of the SDN switch flow table and obtain the raw flow table data. If the flow table occupancy rate does not reach the secondary threshold, repeat step 1 to continuously monitor the flow table occupancy rate.

[0010] 3. Flow Table Feature Calculation. The flow table is divided into three states to distinguish whether the current flow table is under slow flow table overflow attack and the different states of being attacked: State 1 is not under attack, State 2 is the flow table under attack but not overflowing, and State 3 is under attack and the flow table is continuously overflowing. Based on the flow table information collected in step 2, the average packet arrival interval time of all flow rules in the flow table is calculated, and the average packet arrival interval time and the number of flow rules in the flow table are selected as flow table features to represent the different states of the flow table.

[0011] 4. Attack Detection. When the flow table occupancy rate is between the secondary threshold and the primary threshold, the flow table features calculated in step 3 are input into the trained Catboost classification model 1. If the model determines that the current flow table is in state 1, it is considered that it has not been attacked. If the model determines that the flow table is in state 2 or state 3, it is considered that the flow table has been attacked by a slow flow table overflow attack.

[0012] 5. Attack Mitigation. If the flow table occupancy rate exceeds the first-level threshold, the flow table overflow prevention mode is activated. The cumulative byte count, average packet arrival time, and average packet size of the flow rules in the flow table are input into the Catboost sorting model to calculate the probability that each flow rule belongs to a malicious flow rule. A certain proportion of flow rules are evicted according to their probability from high to low to free up flow table space and prevent overflow. If the number of flow rules is between the second-level and first-level thresholds, and the attack detection module determines that the current flow table is under slow flow table overflow attack, the malicious flow eviction mode is activated. The cumulative byte count, average packet arrival time, and average packet size of the flow rules in the flow table are input into Catboost classification model 2, and flow rules identified by the model as malicious are evicted.

[0013] Beneficial effects

[0014] By analyzing the attack principles and the different effects produced at different stages of the attack, this method selects flow table features that can represent different states of flow tables to detect slow flow table overflow attacks. By comparing the differences between normal and malicious flows, this method selects flow rule features to identify malicious flow rules. Then, based on a two-level threshold of flow table occupancy rate, malicious flow rules are expelled at different proportions under different emergency situations of slow flow table overflow attacks, forming a two-level threshold-based slow flow table overflow attack detection and mitigation method for real-time detection and mitigation of slow flow table overflow attacks. This method can monitor the flow table status of SDN switches in real time, accurately detect slow flow table overflow attacks, has a low false positive and false negative rate, and can accurately identify and expel malicious flow rules. Therefore, this method can effectively detect and mitigate slow flow table overflow attacks in SDN environments. Attached Figure Description

[0015] Figure 1 This describes the changes in the characteristics of two flow tables under different states. When a switch is subjected to a slow flow table overflow attack, the sequence is as follows: From state 1 to state 3, the number of flow rules in the flow table gradually increases, eventually leading to flow table overflow. Because the average packet arrival interval of malicious flow rules is greater than that of normal flow rules, when a large number of malicious flow rules are installed in the flow table, the average packet arrival interval of the entire flow table will also increase with the increase of malicious flow rules.

[0016] Figure 2 The distribution of the two flow table features across three network states is shown. Points in different states are distributed in different regions, exhibiting a clear distinction, indicating that the two flow table features selected in this method can serve as the basis for distinguishing between different network states.

[0017] Figure 3 This figure shows the distribution of three flow rule features in a flow table. Dark and light dots represent malicious and normal flows, respectively. The light dots are concentrated in areas with larger average packet arrival time intervals but smaller cumulative byte counts and average packet sizes. This indicates that the features selected in this method can distinguish between normal and malicious flow rules and can serve as a basis for identifying malicious flow rules.

[0018] Figure 4 This is a flowchart of a slow flow table overflow attack detection and mitigation method based on two-level thresholds. Detailed Implementation

[0019] The invention will be further described below with reference to the accompanying drawings.

[0020] like Figure 4As shown, the slow flow table overflow attack detection and mitigation method mainly includes five steps: flow table occupancy monitoring, flow table data sampling, flow table feature calculation, attack detection, and attack mitigation.

[0021] 1. Flow table occupancy monitoring. The OpenvSwitch command script polls the number of flow rules in the flow tables of the SDN switch at 1-second intervals and calculates the current flow table occupancy based on the total capacity of the flow tables.

[0022] The flow table occupancy rate is the ratio of the number of flow rules in the flow table to the total capacity of the flow table.

[0023] This method uses two threshold levels for flow table utilization based on the urgency of the slow flow table overflow attack. The second-level threshold is set at 75% of the total flow table capacity, and the first-level threshold is set at 90% of the total flow table capacity.

[0024] This method starts in the monitoring phase. When the number of flow rules is less than the secondary threshold, this method considers the network to be in a normal state and the flow table to be free from slow flow table overflow attacks. Because the network is not under attack most of the time, in order to reduce the overhead of collecting network data and computation, this method only polls the number of flow rules in the switch flow table every second during the initial monitoring phase.

[0025] 2. Flow table data sampling. If the flow table occupancy rate reaches the secondary threshold, use the OpenvSwitch command script to obtain the contents of the SDN switch flow tables and obtain the raw flow table data.

[0026] We only consider a potential slow flow table overflow attack to exist in the network when the flow table occupancy rate exceeds the set secondary threshold, and then initiate further flow table data sampling and subsequent attack detection.

[0027] This step collects the flow table content of the switch, including the duration, cumulative number of packets, and cumulative number of bytes for each flow rule, to be used in step 5 for the identification of malicious flow rules.

[0028] 3. Flow table feature calculation. Based on the flow rule information in the current flow table, flow table features are calculated to indicate whether the flow table is subject to slow flow table overflow attacks and the different stages of such attacks.

[0029] To distinguish whether an attack has occurred and the state of the flow table, this method divides the state of the flow table into three categories, the specific situations and characteristics of which are as follows:

[0030] Status 1: The current network is not under slow flow table overflow attack, the number of rules in the flow table fluctuates within the normal range, and the average packet arrival interval of the flow table is small;

[0031] State 2: The current network has just begun to be attacked by a slow flow table overflow attack (i.e., in the first stage of the slow flow table overflow attack). The number of rules in the flow table gradually increases with fluctuations, but there is no overflow. The average packet arrival interval of the flow table gradually increases accordingly.

[0032] State 3: The current network has been subjected to a slow flow table overflow attack for some time (i.e., in the second stage of the slow flow table overflow attack) and the number of rules in the flow table has reached the maximum value that the flow table can hold, i.e., a flow table overflow has occurred; at this time, the number of malicious flow rules in the flow table basically no longer changes, so the average packet arrival interval of the flow table also basically stops increasing and fluctuates slightly around a value higher than the normal interval.

[0033] To better detect slow flow table overflow attacks in their early stages, before they cause serious network impact, this method divides the attack into two phases. Furthermore, during actual operation, the attack mitigation module will expel rules classifying flows as malicious, causing flow tables to remain in the first phase of the slow flow table overflow attack for an extended period. Therefore, dividing the attack into two phases allows for more accurate detection.

[0034] Figure 2 This diagram illustrates the distribution of two flow table features across three network states. Before the 100th second, the network is in normal state 1. At the 100th second, the network is subjected to a slow flow table overflow attack, entering state 2. At the 137th second, the flow table is filled, and the network enters state 3. In these three different states, the number of rules in the flow table and the average packet arrival interval of the flow table exhibit different distribution ranges. Based on the changes in these two feature values, we can detect whether a flow table is subjected to a slow flow table overflow attack, and we can also classify the stages at which a flow table is subjected to a slow flow table overflow attack.

[0035] To differentiate whether a switch is under a slow flow table overflow attack and to determine the different stages of such an attack, this module selects two flow table features to represent the overall state of the current flow table. The changes in these features under different flow table states are shown below. Figure 1 As shown.

[0036] When a switch is subjected to a slow flow table overflow attack, the number of malicious flow rules in the flow table gradually increases, leading to an increase in the total number of flow rules in the flow table, eventually resulting in a flow table overflow. The number of flow rules in the flow table reflects the adverse effects of a slow flow table overflow attack and is the most intuitive feature for detecting such attacks.

[0037] Most network traffic is short-lived, with packet arrival intervals being relatively short. To minimize attack traffic while refreshing the idle timeout of malicious flow rules, attackers typically set their attack cycles to be as close as possible to and shorter than the idle timeout, resulting in an average packet arrival interval for malicious flow rules that is longer than that of normal flow rules. When a large number of malicious flow rules are installed in the flow table, the average packet arrival interval across the entire flow table increases with the number of malicious flow rules, reflecting the cycle length of the malicious flow rules installed in a slow flow table overflow attack. The average packet arrival interval is the average packet arrival interval of each flow rule in the flow table, calculated by dividing the average duration of the flow rules in the flow table by the average number of packets per flow rule.

[0038] 4. Attack Detection. When the flow table occupancy rate is between the secondary threshold and the primary threshold, the flow table features calculated in step 3 are input into the trained Catboost classification model 1. If the model determines that the current flow table is in state 1, it is considered that it has not been attacked. If the model determines that the flow table is in state 2 or state 3, it is considered that the flow table has been attacked by a slow flow table overflow attack.

[0039] This method uses the Catboost algorithm for network state classification and malicious flow rule identification. The Catboost algorithm improves upon the GBDT framework by using a symmetric decision tree as the base classifier and employing unbiased estimation of the gradient step size during the tree structure selection phase, mitigating overfitting caused by gradient bias. The Catboost algorithm also employs an improved Ordered Boosting algorithm to combat noisy points in the training set, addressing prediction bias and improving the model's robustness.

[0040] 5. Attack Mitigation. Based on the different relationships between flow table occupancy and the two-level thresholds, as well as the results of attack detection, different mitigation modes are activated to mitigate slow flow table overflow attacks of varying urgency: malicious flow expulsion mode and flow table overflow prevention mode.

[0041] The characteristics of the flow rules used to classify and sort flow rules are: cumulative number of bytes, average packet arrival time and average data packet size.

[0042] Most short flows in a network have a short lifespan in the flow table, resulting in a small cumulative number of matched bytes. However, because attackers intermittently send data packets to refresh the idle timeout of malicious flow rules, these rules remain in the flow table for a long time, causing the cumulative number of matched bytes for malicious flow rules to continuously increase. Therefore, the cumulative number of bytes for a flow rule can be used as a characteristic to identify malicious flow rules.

[0043] The average packet arrival interval is the ratio of the duration of each flow rule to the number of its packets.

[0044] The average packet size is the ratio of the number of bytes per flow rule to the number of its packets.

[0045] When the flow table occupancy rate exceeds the first-level threshold, the flow table is about to be filled. At this time, the situation of the flow table being attacked is relatively urgent. At this time, the attack is no longer detected. In addition to expelling the flow rules that are judged to be malicious by the algorithm, some suspected malicious flow rules also need to be expelled in proportion to prevent the flow table from overflowing, so as to ensure that the flow table has enough space to install new flow rules.

[0046] If the flow table occupancy rate is higher than the first-level threshold, the flow table overflow prevention mode is activated. The features of the flow rules in the flow table are input into the Catboost sorting model to calculate the probability that each flow rule belongs to a malicious flow rule. The flow rules are sorted from high to low probability, and a certain proportion of the flow rules are selected. This proportion is set to 15% to 30%, which can alleviate the flow table overflow while avoiding the deletion of too many normal flow rules.

[0047] If the number of flow rules is between the secondary and primary thresholds, and the attack detection module determines that the current flow table is under attack by a slow flow table overflow, the malicious flow eviction mode is activated. At this time, there is still some space remaining in the flow table, and the attack on the flow table is not urgent. Therefore, in this mode, only flow rules classified as malicious are evicted.

[0048] In the malicious flow expulsion mode, for each flow rule in the current flow table, this method selects the cumulative number of bytes, the average packet arrival time, and the average packet size as features. It uses the Catboost classification model 2, which is trained on flow tables collected in the same network environment, to classify normal flow rules and malicious flow rules. The classification label 0 represents normal flow rules, and the label 1 represents malicious flow rules. If the output result of Catboost classification model 2 is 1, the flow rule is determined to be a malicious flow rule and is deleted from the flow table.

Claims

1. A method for detecting and mitigating slow flow table overflow attacks based on a two-level threshold, characterized in that, The method for detecting and mitigating slow flow table overflow attacks includes the following five steps: Step 1, Flow Table Occupancy Monitoring: In SDN, the number of flow rules in the switch is obtained in real time. The OpenvSwitch command script is used to poll the number of flow rules in the flow table of the switch in SDN at a time interval of 1.0 seconds, and the current flow table occupancy is calculated based on the total capacity of the flow table. Step 2, Flow Table Data Sampling: Set the secondary threshold to 75% of the total flow table capacity. That is, when the flow table occupancy rate calculated in Step 1 reaches 75% of the total flow table capacity, use the OpenvSwitch command script to obtain the contents of the SDN switch flow table and get the original flow table data. If the flow table occupancy rate does not reach the secondary threshold, repeat Step 1 to continuously monitor the flow table occupancy rate. Step 3, Flow Table Feature Calculation: Calculate flow table features based on the flow rule information in the current flow table to indicate whether the flow table is subject to slow flow table overflow attack and the different stages of the attack. Step 4, Attack Detection: When the flow table occupancy rate is between the secondary threshold and the primary threshold, the flow table features are input into Catboost classification model 1. The label value obtained from the classification can determine whether the current flow table is under slow flow table overflow attack. Step 5, Attack Mitigation: Based on the different relationships between flow table occupancy and the two-level thresholds, and the results of attack detection, different mitigation modes are activated to mitigate slow flow table overflow attacks of varying urgency, in order to respond appropriately to these attacks. Step 5.1: If the flow table occupancy rate is higher than the first-level threshold, start the flow table overflow prevention mode. Input the cumulative number of bytes of the flow rules in the flow table, the average packet arrival time and the average data packet size into the Catboost sorting model, calculate the probability that each flow rule belongs to a malicious flow rule, and expel a certain proportion of flow rules according to the probability from high to low to free up flow table space to prevent overflow. Step 5.2: If the number of flow rules is between the secondary threshold and the primary threshold, and the attack detection module determines that the current flow table is under slow flow table overflow attack, start the malicious flow expulsion mode, input the cumulative number of bytes of the flow rules in the flow table, the average packet arrival interval time and the average data packet size into Catboost classification model 2, and determine the model as a malicious flow rule expulsion.

2. The method for detecting and mitigating slow flow table overflow attacks according to claim 1, characterized in that, In step 3, the flow table is divided into three states to distinguish whether the current flow table is under slow flow table overflow attack and the different states under attack: state 1 is not under attack, state 2 is the flow table under attack but not overflowing, and state 3 is under attack and the flow table continues to overflow.

3. The method for detecting and mitigating slow flow table overflow attacks according to claim 1, characterized in that, In step 3, the mean packet arrival interval time of all flow rules in the flow table is calculated based on the flow table information collected in step 2. The mean packet arrival interval time and the number of flow rules in the flow table are selected as flow table features to represent different states of the flow table.

4. The method for detecting and mitigating slow flow table overflow attacks according to claim 1, characterized in that, In step 4, the first-level threshold is set to 90% of the total capacity of the flow table. That is, when the flow table occupancy rate calculated in step 1 is between 75% and 90% of the total capacity of the flow table, the flow table features calculated in step 3 are input into the trained Catboost classification model 1. If the model determines that the current flow table is in state 1, it is considered that it has not been attacked. If it determines that the flow table is in state 2 or state 3, it is considered that the flow table has been attacked by a slow flow table overflow attack.

5. The method for detecting and mitigating slow flow table overflow attacks according to claim 1, characterized in that, In step 5.1, when the flow table occupancy rate is higher than 90% of the total flow table capacity, the features of the flow rules in the flow table are input into the trained Catboost ranking model to calculate the probability that each flow rule belongs to a malicious flow rule. The flow rules are sorted from high to low probability, and a certain proportion of the flow rules are selected. This proportion is set to 15% to 30%, which can alleviate the flow table overflow while avoiding the deletion of too many normal flow rules.

6. The method for detecting and mitigating slow flow table overflow attacks according to claim 1, characterized in that, In step 5.2, when the flow table occupancy rate is between 75% and 90% and the flow table is determined to be under attack in step 4, the features of the flow rules in the flow table are input into the trained Catboost classification model 2 to classify normal flow rules and malicious flow rules. The classification label 0 represents normal flow rules and label 1 represents malicious flow rules. If the output result of Catboost classification model 2 is 1, then the flow rule is determined to be a malicious flow rule and is deleted from the flow table.

Images