An Adaptive SFTO Attack Detection and Mitigation Method Based on Flow Entry Number Prediction
By monitoring flow tables in SDN networks and using LRCN and LightGBM models for flow entry number prediction and feature analysis, attack flow entries can be detected and adaptively expelled in real time. This solves the flow table overflow problem caused by SFTO attacks in SDN networks, improving detection accuracy and network performance.
Patent Information
- Application Number
- CN202211668944.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-12-23
- Publication Date
- 2025-10-31
- Estimated Expiration
- 2042-12-23
AI Technical Summary
SFTO attacks in SDN networks cause flow table overflows, affecting normal packet forwarding and network throughput. Existing detection methods have low detection rates, slow response times, coarse mitigation granularity, and poor adaptability.
An adaptive SFTO attack detection method based on flow entry number prediction monitors the switch flow table and uses LRCN and LightGBM models to predict the number of flow entries and perform feature analysis. It then detects and adaptively removes attack flow entries in real time to prevent flow table overflow.
It enables real-time monitoring and accurate detection of SFTO attacks, reduces false alarm and false alarm rates, adaptively evicts attack flow entries, prevents flow table overflow, and protects network availability.
Smart Images
Figure CN116015847B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of computer network security, specifically relating to an adaptive SFTO attack detection and mitigation method based on flow entry number prediction. Background Technology
[0002] The development of emerging technologies such as cloud computing and edge computing has placed demands on network architectures for rapid updates and flexible management. Traditional network architectures handle the processing and forwarding of massive amounts of data from around the world, resulting in complex systems that are slow to update and unable to provide elastic services based on the needs of different networks. SDN (Software Defined Networking) uses a logically centralized controller instead of the packet switching equipment of traditional networks to manage the network, enabling network programmability, dynamic control of network traffic, and automated deployment of network components.
[0003] In an SDN network architecture, the logically centralized control plane consists of multiple SDN controllers. These controllers manage network traffic through open APIs, while the data plane is only responsible for forwarding data packets. OpenFlow, as the standard communication protocol for the southbound interface, enables information exchange between switches at the forwarding layer and SDN controllers at the control layer. Controllers control the data plane by managing flow tables on OpenFlow switches. While this unique network architecture promotes flexible network management, it also introduces specific security vulnerabilities. The massive amounts of data from the entire network require high processing performance from the controllers, and the forwarding capacity of the data plane is limited by the size of the flow tables, creating a performance bottleneck.
[0004] To address the limited flow table space, SFTO (Slow-rate Flow Table Overflow) attacks send specific, mismatched packets at a low rate to trigger the installation of new attack flow entries, consuming available flow table space. This overflow causes legitimate rules to fail to install or existing legitimate flow rules to be evicted. Flow table overflows also prevent subsequent normal rules from being processed in a timely manner, reducing the TCP congestion window and potentially lowering overall network throughput. Excessive control messages can overload the controller, potentially leading to denial-of-service attacks and impacting the entire network.
[0005] To promptly detect SFTO attacks and expel attacking flow entries, ensuring flow table availability and the forwarding efficiency of normal packets, this invention proposes an adaptive SFTO attack detection and mitigation method based on flow entry number prediction. This method is deployed on an SDN switch, monitoring and collecting the flow entry count of the switch's flow tables in real time using a sliding window, and predicting the flow entry count based on the LRCN prediction model. When the predicted flow entry count for the next two seconds reaches a threshold, flow table information is collected and features are extracted to obtain raw flow table data. Based on the raw flow table data, octal flow table statistical features are calculated and input into the LightGBM classification model. The attack probability output by the model determines whether the current flow table is under SFTO attack. If an SFTO attack is detected, an expulsion ratio is adaptively calculated based on the attack detection result and the flow entry count prediction module's prediction of the flow entry count for the next second. Flow entries sorted by the LightGBM sorting model are then expelled based on this ratio, freeing up flow table space to prevent overflow. This method can monitor and predict the number of flow entries on an SDN switch in real time, accurately detect SFTO attacks and execute proactive defense strategies. It has a low false negative rate and a low false positive rate, and can adaptively expel attack flow entries to prevent flow table overflow. Therefore, this method can effectively detect and mitigate SFTO attacks in an SDN environment. Summary of the Invention
[0006] To address the shortcomings of traditional SFTO attack detection and mitigation methods, such as low detection rate, slow response speed, coarse mitigation granularity, and poor adaptability, as well as the severe impact of SFTO attacks on normal packet forwarding and network throughput, an adaptive SFTO attack detection and mitigation method based on flow entry number prediction is proposed to ensure the availability of flow tables and the entire network. This method can monitor and predict the number of flow entries on SDN switches in real time, accurately detect SFTO attacks, and execute proactive defense strategies. It has a low false negative rate and low false positive rate, and can adaptively evict attack flow entries to prevent flow table overflow. Therefore, this method can effectively detect and mitigate SFTO attacks in SDN environments.
[0007] The technical solution adopted by the present invention to achieve the above objectives is as follows: the attack detection and mitigation method mainly includes five steps: flow entry number monitoring, flow entry number prediction, flow table information collection, attack detection, and attack mitigation.
[0008] 1. Flow entry count monitoring. A command script is used to sample the current number of flow entries in the OpenvSwitch switch flow table in real time at a sampling interval of one second, and a sliding window of fixed size 5 is maintained to store the number of flow entries in a recent period.
[0009] 2. Flow Entry Count Prediction. The flow entry counts obtained from the sliding window sampled in step 1 are normalized using a trained MinMaxScalar model and then input into a trained LRCN prediction model. The output of the model is then inversely normalized using the MinMaxScalar model to obtain the flow entry count prediction results for the next one second and two seconds.
[0010] 3. Flow Table Information Collection. If the number of flow entries predicted in step 2 for the next two seconds reaches 70% of the flow table capacity, it is considered that the current flow table may be under SFTO attack. The command script is used to obtain the flow table information in the SDN switch, extracting the duration, cumulative number of packets, and cumulative number of bytes for each flow entry, and calculating the average packet arrival interval and average packet size for each flow entry to obtain the original flow table data. If the number of flow entries predicted in step 2 does not reach the threshold, steps 1 and 2 are repeated to continuously monitor and predict the number of flow entries.
[0011] 4. Attack Detection. Based on the original flow table data obtained in step 3, calculate the mean of the average packet size, the total number of flow entries in the flow table, the interquartile range of the average packet size, the standard deviation of the average packet size, the skewness of the average packet size, the kurtosis of the average packet size, the median of the cumulative number of packets, and the port Shannon entropy to obtain octet flow table statistical features. Use labels 0 and 1 to represent flow tables that have not been attacked and flow tables that have been attacked by SFTO attacks, respectively. Input the above octet flow table statistical features into the trained LightGBM classification model and output the attack probability d of the current flow table. pred If d pred A value greater than or equal to 0.5 indicates that the current flow table may be under the influence of an SFTO attack. pred If the value is less than 0.5, the current flow table is considered not to be under SFTO attack.
[0012] 5. Attack Mitigation. Based on the probability of the flow table being attacked by SFTO as output by the model in step 4 and the number of flow entries predicted by the model in step 2 for the next second, the flow entry eviction ratio is adaptively calculated. Then, the cumulative byte count, cumulative packet count, average packet arrival time, and average packet size of each flow entry are input into the trained LightGBM ranking model. The model calculates the probability that a flow entry belongs to an attack flow entry and sorts them from high to low probability. Then, the flow entry eviction operation is performed according to the flow entry eviction ratio to mitigate the SFTO attack.
[0013] Beneficial effects
[0014] By real-time monitoring and overflow prediction of the number of flow entries in the flow table, this method can respond to SFTO attacks in real time. Through flow table analysis and extraction of octal flow table statistical features, this method accurately detects whether the current flow table is under SFTO attack, reducing false positives and false negatives of normal flow entries, thus enhancing the system's accuracy and proactive defense capabilities. Based on flow entry analysis and quaternary features, this method sorts flow entries and adaptively calculates the proportion of flow entries to be evicted, preventing flow table overflow and achieving fine-grained and adaptive mitigation of SFTO attacks while simultaneously protecting normal flow entries. This method can monitor and predict the number of flow entries on SDN switches in real time, accurately detect SFTO attacks, and execute proactive defense strategies. It has a low false negative rate and low false positive rate, and can adaptively evict attacking flow entries to prevent flow table overflow. Therefore, this method can effectively detect and mitigate SFTO attacks in SDN environments. Attached Figure Description
[0015] Figure 1 This is a model diagram of an SFTO attack. An SFTO attack includes the following three attack parameters: period (T), step size (S), and maximum number of attack packets (M). The period T of each attack must be less than the idle timeout to ensure that attack flow entries are not deleted by the switch due to timeout. The number of additional packets sent in each attack pulse compared to the previous attack is called the attack step size S. The attacker also sets a total number M of attack packets to be sent; the number of attack packets sent each time increases according to the attack step size, eventually reaching the maximum value M.
[0016] Figure 2 This is a structural diagram of the LRCN prediction model. The LRCN prediction model used in this method places a CNN model at the front end for pre-training. The first convolutional layer reads the time series of the number of stream entries within the sliding window as input and projects the result onto a feature map. A second convolutional layer performs the same operation on the feature map as the first layer to amplify salient features. Each convolutional layer uses 64 feature maps, and the kernel size for the time step of reading the input stream entry sequence is set to 3. The pool_size of the max-pooling layer is set to 1. A Flatten layer flattens the feature map into a one-dimensional vector, which serves as the input to the LSTM decoder layer. The LSTM layer has 200 memory units. A TimeDistributed layer encapsulates a fully connected layer with 100 nodes, and finally, the fully connected output layer is also encapsulated using a TimeDistributed layer.
[0017] Figure 3This figure shows the distribution of features in the original flow table data for normal flow entries and attack flow entries. Dark and light colors represent attack flow entries and normal flow entries, respectively. The duration, cumulative number of packets, cumulative number of bytes, average packet arrival interval, and average packet size of attack flow entries and normal flow entries in the flow table show different distributions. Therefore, collecting flow table information and extracting features to form the original flow table data in step 3 can reflect the difference between normal flow entries and attack flow entries, and can serve as a basis for subsequent attack detection and attack flow entry identification.
[0018] Figure 4 This is a flowchart of an adaptive SFTO attack detection and mitigation method based on flow entry number prediction. Detailed Implementation
[0019] The invention will be further described below with reference to the accompanying drawings.
[0020] like Figure 4 As shown, the attack detection and mitigation method mainly includes five steps: flow entry number monitoring, flow entry number prediction, flow table information collection, attack detection, and attack mitigation.
[0021] 1. Flow entry count monitoring. A command script is used to sample the current number of flow entries in the OpenvSwitch switch flow table in real time at a sampling interval of one second, and a sliding window of fixed size 5 is maintained to store the number of flow entries in a recent period.
[0022] 2. Flow Entry Count Prediction. The flow entry counts obtained in step 1, sampled in the sliding window, are normalized using a trained MinMaxScalar model and then input into a trained LRCN prediction model. The model's output is then inversely normalized using the MinMaxScalar model to obtain the flow entry count predictions for the next one and two seconds. The structure of the LRCN prediction model is as follows: Figure 2 .
[0023] Predicting the number of flow entries allows for timely responses when the number of flow entries exceeds a threshold. By taking appropriate measures to detect and mitigate SFTO attacks before flow table overflow occurs, flow table overflow and its adverse effects on the network can be effectively reduced and avoided.
[0024] Since attacks are not present in the network in most cases, in order to reduce the overhead of deploying this method on the switch to collect network data and perform calculations, this method only polls the number of flow entries in the switch flow table every second to predict the number of flow entries in the initial monitoring phase, and monitors in real time whether the number of flow entries exceeds the threshold.
[0025] If the predicted result for the next two seconds exceeds 70% of the flow table capacity, it is considered that the current flow table may be under SFTO attack. Then, commands are used to collect the specific information contained in the switch flow table, and the attack detection module is started to determine whether the current flow table has been under SFTO attack.
[0026] 3. Flow table information collection. If the number of flow entries predicted in step 2 for the next two seconds reaches 70% of the flow table capacity, use a command script to obtain the flow table information in the SDN switch, extract the switch flow table information, and calculate the original flow table data. If the number of flow entries predicted in step 2 does not reach the threshold, repeat steps 1 and 2 to continuously monitor and predict the number of flow entries.
[0027] This step collects and extracts information from the switch flow tables to obtain raw flow table data, including the duration of each flow entry, the cumulative number of packets, the cumulative number of bytes, the average packet arrival interval, and the average packet size, for use in the detection and identification of subsequent attacks.
[0028] The duration, cumulative number of packets, and cumulative number of bytes of a flow entry can be directly extracted from the flow table, while the average packet arrival interval and average packet size need to be calculated.
[0029] The average packet arrival interval of a flow entry is the ratio of its duration to the cumulative number of packets.
[0030] The average packet size of a flow entry represents the average number of bytes contained in each packet matched after the flow entry is installed in the flow table. It is calculated as the ratio of its cumulative byte count to its cumulative packet count.
[0031] 4. Attack Detection. Based on the raw flow table data obtained in step 3, the octal statistical features of the current flow table are calculated. These statistical features are then input into the trained LightGBM classification model, and the attack probability d of the current flow table is output. pred If d pred A value greater than or equal to 0.5 indicates that the current flow table may be under the influence of an SFTO attack. pred If the value is less than 0.5, the current flow table is considered not to be under SFTO attack.
[0032] The octet statistical characteristics of a flow table include the mean of the average packet size, the total number of flow entries in the flow table, the interquartile range of the average packet size, the standard deviation of the average packet size, the skewness of the average packet size, the kurtosis of the average packet size, the median of the cumulative number of packets, and the port Shannon entropy.
[0033] When a switch is subjected to an SFTO attack, the number and proportion of attack flow entries in the flow table increase continuously, which also directly causes an increase in the total number of flows in the flow table, or even overflow. Therefore, this method uses the total number of flow entries in the flow table as a feature for detecting SFTO attacks.
[0034] The source and destination port numbers of attack flow entries sent and installed in the flow table by SFTO attackers also exhibit different levels of disorder compared to normal flow entries. The port numbers of attack flow entries are more concentrated, while the port numbers of normal flow entries are more dispersed. Therefore, this method selects the Shannon entropy of port numbers to represent the degree of disorder in the port number distribution in order to distinguish whether the current flow table is under SFTO attack.
[0035] like Figure 3 Attack flow entries differ from normal flow entries in terms of duration, number of packets, number of bytes, average arrival interval, and average packet size, resulting in changes in the overall numerical value and data distribution of flow entries in the flow table. Therefore, the statistical characteristics of these information in the flow table can be calculated and compared to identify whether the current flow table is under an SFTO attack.
[0036] 5. Attack Mitigation. Based on the probability of the flow table being attacked by SFTO as output by the model in step 4 and the number of flow entries predicted by the model in step 2 for the next second, the flow entry eviction ratio is adaptively calculated. Then, the cumulative byte count, cumulative packet count, average packet arrival interval, and average packet size of each flow entry's four-element features are input into the trained LightGBM ranking model. The model calculates the probability that a flow entry belongs to an attack flow entry and sorts them from high to low probability. Then, the flow entry eviction operation is performed according to the flow entry eviction ratio to mitigate the SFTO attack.
[0037] In the later stages of an SFTO attack, when attackers simultaneously send a large number of attack flows and there are many attack flow entries in the flow table, simply deleting the attack flow entries identified by the algorithm may not be enough to process the flow entries in time, causing flow table overflow and affecting the matching and forwarding of normal flow entries. Therefore, this step adaptively calculates the flow entry eviction ratio based on the severity of the SFTO attack on the flow table and the size of the remaining space in the flow table.
[0038] The calculation process for the expulsion ratio of flow entries is as follows:
[0039] First, based on the proportion p of the predicted value of the computational stream entry exceeding the threshold:
[0040]
[0041] Where fn1 is the predicted number of flow entries in the flow table for the next second, as determined in step 2, and Size flowtable It is the flow table capacity, and TH is a preset threshold, which is 70% of the flow table capacity;
[0042] Then, based on the p-value and the probability d of the current flow table being attacked by SFTO obtained in step 4... pred The proportion P of the calculated flow entry eviction e The calculation formula is as follows:
[0043] P e =p×k×d pred +b
[0044] Here, k ranges from 0 to 1, and is set to 0.75 in this step. The flow entry eviction ratio is proportional to the predicted number of flow entries and the probability that the flow table is attacked, and then the result of multiplying them is added to b. The reason is that even if the predicted number of flow entries is small after an attack is detected, a certain proportion of the attacking flow entries still need to be evicted.
Claims
1. An adaptive SFTO attack detection and mitigation method based on flow entry number prediction, characterized in that, SFTO attack, or Slow Flow Table Overflow attack, is an attack that targets the limited flow table space in an SDN switch. The attack detection and mitigation method includes the following five steps: Step 1, Flow Entry Count Monitoring: Use a command script to sample the current number of flow entries in the OpenvSwitch switch flow table in real time at a sampling interval of one second, and maintain a sliding window of fixed size 5 to store the number of flow entries in the most recent period. Step 2, Stream Count Prediction: The number of streams in the sliding window obtained in Step 1 is normalized using the trained MinMaxScalar model and then input into the trained LRCN prediction model. The output of the model is then inversely normalized using the MinMaxScalar model to obtain the predicted number of streams for the next one second and two seconds. Step 3, Flow Table Information Collection: If the number of flow entries predicted in Step 2 for the next two seconds reaches the preset threshold, use a command script to obtain the flow table information in the SDN switch, extract the duration, cumulative number of packets and cumulative number of bytes for each flow entry, and calculate the average packet arrival interval and average packet size for each flow entry to obtain the original flow table data. If the number of flow entries predicted in Step 2 does not reach the threshold, repeat Step 1 and Step 2 to continuously monitor and predict the number of flow entries. Step 4, Attack Detection: Based on the original flow table data obtained in Step 3, calculate the octal statistical features of the current flow table, and input the flow table statistical features into the trained LightGBM classification model. If the attack probability output by the model is greater than or equal to 0.5, that is, the current flow table may be under the influence of SFTO attack, then execute Step 5 to mitigate SFTO attack. If the attack probability output by the model is less than 0.5, then it is considered that the current flow table has not been attacked by SFTO, and Step 1 and Step 2 are repeated. Step 5, Attack Mitigation: Based on the probability of the flow table being attacked by SFTO as output by the model in Step 4 and the number of flow entries predicted by the model in Step 2 for the next second, the flow entry eviction ratio is adaptively calculated. Then, the cumulative number of bytes, cumulative number of packets, average packet arrival time and average packet size of the four-element features of each flow entry are input into the trained LightGBM ranking model. The model calculates the probability that a flow entry belongs to an attack flow entry and sorts them from high to low probability. Then, the flow entry eviction operation is performed according to the flow entry eviction ratio to mitigate the SFTO attack.
2. The attack detection and mitigation method according to claim 1, characterized in that, In the LRCN prediction model used in step 2, the CNN model is placed at the front end for pre-training. The first convolutional layer reads the time series of the number of stream entries in the sliding window as input and projects the result onto the feature map. The second convolutional layer then performs the same operation on the feature map as the first layer to amplify the salient features. Each convolutional layer uses 64 feature maps. The kernel size of the time step for reading the input stream entry sequence is set to 3, the pool_size of the max pooling layer is set to 1, and the Flatten layer is used to flatten the feature map into a one-dimensional vector as the input of the decoder LSTM layer. The number of memory units in the LSTM layer is 200. After that, the TimeDistributed layer is used to encapsulate the fully connected layer with 100 nodes. Finally, the fully connected output layer is also encapsulated using the TimeDistributed layer.
3. The attack detection and mitigation method according to claim 1, characterized in that, In step 3, the threshold for the predicted value of a flow entry is set to 70% of the flow table size. That is, if the predicted value of a flow entry in the next two seconds exceeds 70% of the flow table size, it is considered that the current flow table may be under SFTO attack. Therefore, flow table information is collected and features are extracted to form the original flow table data. The average packet arrival interval of a flow entry is the ratio of its duration to the cumulative number of packets. The average packet size of a flow entry represents the average number of bytes contained in each packet matched after the flow entry is installed in the flow table. It is calculated as the ratio of its cumulative number of bytes to the cumulative number of packets.
4. The attack detection and mitigation method according to claim 1, characterized in that, In step 4, the mean of the average packet size, the total number of flow entries in the flow table, the interquartile range of the average packet size, the standard deviation of the average packet size, the skewness of the average packet size, the kurtosis of the average packet size, the median of the cumulative number of packets, and the port Shannon entropy are calculated to obtain the octet flow table statistical features. Labels 0 and 1 are used to represent flow tables that have not been attacked and flow tables that have been attacked by SFTO attacks, respectively. These octet flow table statistical features are then input into the trained LightGBM classification model, which outputs the attack probability d of the current flow table. pred If d pred A value greater than or equal to 0.5 indicates that the current flow table may be under the influence of an SFTO attack. pred If the value is less than 0.5, the current flow table is considered not to be under SFTO attack.
5. The attack detection and mitigation method according to claim 1, characterized in that, The calculation process for the flow entry expulsion ratio in step 5 is as follows: First, calculate the proportion p of the predicted flow entry value exceeding the threshold: Where fn1 is the predicted number of flow entries in the flow table for the next second, as determined in step 2, and Size flowtable It is the flow table capacity, and TH is a preset threshold, which is 70% of the flow table capacity; Then, based on the p-value and the probability d of the current flow table being attacked by SFTO obtained in step 4... pred The proportion P of the calculated flow entry eviction e The calculation formula is as follows: P e =p×k×d pred +b Wherein, the value of k ranges from 0 to 1, and is set to 0.75 in this step; the flow entry eviction ratio is proportional to the predicted value of the number of flow entries and the probability of the flow table being attacked, and then the result of multiplying them is added to b; the reason is that even if the predicted value of the number of flow entries is small after an attack is detected, a certain proportion of the attack flow entries still need to be evictioned.