New DDOS attack defense system and method based on IP and topology confusion

Abstract

The present invention discloses a novel DDOS attack defense system and method based on IP and topology obfuscation. This system primarily addresses the problem of insufficient defense against novel DDOS attacks in existing methods. The system comprises a proxy server IP obfuscation unit, a topology obfuscation unit, and a communication quality maintenance unit. First, the proxy server IP obfuscation unit prolongs the time it takes an attacker to collect the proxy server's communication IP address. Secondly, the topology obfuscation unit adds redundant paths to the path information of the attacker's tracking flow, preventing the attacker from distinguishing between virtual paths and real communication paths. Furthermore, since the lengths of the generated virtual paths differ from the real communication paths, the attacker is prevented from distinguishing the real communication paths by analyzing the length information. Finally, a reinforcement learning-based rerouting algorithm is invoked at the initial stage of network congestion to restore network communication quality. The present invention can effectively protect a network from novel DDOS attacks while ensuring communication quality.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and further relates to a novel distributed denial of service (DDOS) attack active defense technology, specifically a novel DDOS attack defense system and method based on IP and topology confusion, which can be used to protect a network from the invasion of novel DDOS attacks. Background Art

[0002] New DDOS attacks involve organizing numerous botnets to send large amounts of low-speed traffic to proxy servers surrounding a target server, thereby blocking critical links connecting legitimate users to the target server. Generally speaking, these new DDOS attacks involve four steps: First, the attacker uses scanning tools such as NMAP to collect IP information about proxy servers surrounding the target server. Second, the attacker uses tracking tools to instruct the controlled botnet to send traceroute packets to the target server and proxy servers to infer the network topology and construct a link map from the botnet to the server. Third, the attacker analyzes the resulting link map to identify key links. Fourth, the attacker directs the botnet to send attack packets to the proxy servers. Compared to traditional DDOS attacks, these new DDOS attacks are more destructive and harmful, making them more difficult to detect and prevent. Research has shown that the Internet is a scale-free network with severely uneven link connectivity. A small number of key links play a dominant role in the operation of a scale-free network. Once these key links are destroyed, connectivity across the entire network is compromised. Therefore, designing a defense against these new DDOS attacks is crucial for network operation.

[0003] In 2022, Jinwoo Kim et al. published a new active defense solution for DDOS attacks based on topology obfuscation in the Proceedings of the USENIX NDSS. However, since this topology obfuscation technology is limited to responding to the attacker's traceroute data packets with real communication paths and virtual paths of the same length as the real communication paths, it has the following disadvantages. On the one hand, since there are only real communication paths and virtual paths, if a switch leaks its real IP, the attacker can easily infer which is the real communication path, thereby obtaining the overall topology of the network and finally analyzing the key links; on the other hand, since the nodes on the virtual path correspond one-to-one with the nodes on the real communication path, it is easy for the attacker to divide the routing information responded by the Traceroute data packet according to the path length information, thereby leaking the network topology and threatening network security; finally, due to the lack of a post-network congestion processing solution, this solution cannot resist blind new DDOS attacks. Blind new DDOS attacks refer to attackers launching attacks directly on proxy servers around the target server based on the existing network information without inferring the exact information of the key links, thereby blocking the network.

[0004] Invention Solution

[0005] The present invention aims to overcome the shortcomings of the aforementioned technologies and proposes a novel DDOS attack defense system based on IP and topology obfuscation. The system comprises a proxy server IP obfuscation unit, a topology obfuscation unit, and a communication quality maintenance unit. First, the proxy server IP obfuscation unit prolongs the time an attacker has to collect proxy server communication IP addresses, thereby reducing the attacker's attack intent. Second, if a large number of traceroute packets appear in the network, indicating that the attacker has collected sufficient proxy server communication IP addresses, the system activates the topology obfuscation unit. This obfuscation unit prevents the attacker from distinguishing key network links by analyzing the traceroute response stream. Because this solution adds redundant paths to the virtual topology generated by the virtual topology generation module of the topology obfuscation unit, it overcomes the drawbacks caused by a switch leaking its real IP address. Furthermore, the nodes on the virtual path of the present invention do not correspond one-to-one with the nodes on the real communication path. Instead, a virtual network is created on the nodes on the real communication path, preventing attackers from partitioning the routing information in the traceroute response based on path length information. Finally, the present invention protects the network from new blind DDOS attacks by invoking a reinforcement learning-based rerouting algorithm at the initial stage of network congestion.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A new DDOS attack defense system based on IP and topology obfuscation, including: a proxy server IP obfuscation unit, a topology obfuscation unit, and a communication quality maintenance unit;

[0008] The proxy server IP obfuscation unit includes an IP allocation module and an IP obfuscation module; wherein the IP allocation module allocates long-term IP and short-term IP to all proxy servers in the network, records the long-term IP as LIP and the short-term IP as SIP, and uses the allocation status as input to the IP obfuscation module; the IP obfuscation module is used to realize the communication requirements between the host and the proxy server using the LIP and SIP allocated by the IP allocation module;

[0009] The topology obfuscation unit is composed of an original topology acquisition module, a virtual topology generation module, and a virtual topology deployment module, and is used to prevent attackers from distinguishing key network links by analyzing traceroute response streams. The original topology acquisition module uses the network topology discovery principle of the SDN controller to obtain the network topology, which is recorded as the original topology, and uses the original topology as input to the virtual topology generation module. The virtual topology generation module generates a virtual topology based on the original topology with a given parameter set {x, y} as input, and then uses the virtual topology as input to the virtual topology deployment module. The virtual topology deployment module is used to deploy the network based on the input virtual topology.

[0010] The communication quality maintenance unit is composed of a link monitoring module combined with a reinforcement learning-based rerouting algorithm; wherein the link monitoring module is used to monitor the network communication quality in real time, and when the communication quality is less than a preset threshold, the reinforcement learning-based rerouting algorithm is called to reselect the communication path for the data packet to restore network communication.

[0011] Furthermore, the IP allocation module allocates long-term and short-term IP addresses to all proxy servers in the network. Specifically, a LIP and a SIP are allocated to a specified number K of proxy servers in a network with N proxy servers, and a LIP is allocated to the remaining NK proxy servers. The IP obfuscation module modifies the flow table of the SDN switch through the SDN controller to meet the communication requirements between the host and the proxy server using the LIP and SIP allocated by the IP allocation module, thereby increasing the difficulty for attackers to collect the IP information of the proxy server.

[0012] Furthermore, the virtual topology generation module generates a virtual topology for the input original topology according to the given parameter set {x, y}, which is implemented as follows:

[0013] Consider each switch in the original topology as a node, and record the node set consisting of all switches as {N1, N2, ..., Nn}, where n is the total number of nodes. Create x virtual networks for all SDN switches in the original topology, where the number of nodes on any virtual network is not fixed, and obtain the virtual network set: in represents the xth virtual network created for the nth node Nn; assuming that any two nodes Ni and Nj are linked in the original topology, where i,j∈1,2,..n, and i≠j, there are x pairs of virtual networks A one-to-one virtual link is created between nodes Ni and Nj to obtain x virtual links. For any two nodes Ni and Nj, the virtual topology generation module randomly selects y redundant paths from Ni to Nj in the original topology. The real communication path from Ni to Nj in the original topology is recorded as the original path. The path composed of virtual links between virtual networks created for nodes on the original path is called a virtual path. The original path, the x virtual paths created from Ni to Nj, and the randomly selected y redundant paths are called the virtual topology from Ni to Nj.

[0014] Furthermore, the above-mentioned virtual topology deployment module achieves the purpose of deploying the virtual topology into the network by simultaneously modifying the TTL value of the traceroute data packet and the IP address of the response packet or rerouting the data packet to a redundant path; the link monitoring module runs throughout the entire life cycle of the system operation and monitors the network communication quality in real time through the Iperf tool, and the monitoring content includes at least link delay, link utilization and port rate.

[0015] A new DDOS attack defense method based on IP and topology confusion includes the following steps:

[0016] (1) In a network with N proxy servers, K proxy servers are selected as designated proxy servers based on the defender's defense capability;

[0017] (2) Using the IP allocation module to allocate a long-term IP and a short-term IP to a designated proxy server, the long-term IP is referred to as LIP and the short-term IP is referred to as SIP. Only LIP is allocated to the remaining proxy servers. The LIP remains unchanged for a long time. The system gives a parameter t and re-allocates SIP to the designated proxy server every t. The LIP of a proxy server is used as the communication IP of the proxy server, and the allocation result is input into the IP obfuscation module.

[0018] (3) The IP obfuscation module modifies the flow table of the SDN switch through the SDN controller, so that the data packets are forwarded between the various SDN switches in the network by matching the modified flow table. The implementation is as follows:

[0019] (3.1) When an IP packet is sent from an external user to a proxy server, the IP packet is first sent to the SDN switch connected to the external user, where the SDN switch connected to the external user is recorded as the ingress switch, and the SDN switch connected to the proxy server is recorded as the egress switch. The ingress switch sends the IP packet to the SDN controller, which determines whether the destination IP address of the IP packet belongs to the LIP of a proxy server. If so, the flow table is sent to the ingress switch and the egress switch according to the flow table sending rules adopted by the SDN controller without the deployed proxy server IP obfuscation unit. If not, the process goes to step (3.2).

[0020] (3.2) The SDN controller determines whether the destination address belongs to the current SIP of a specified proxy server. If so, the proxy server is called the hit server and the process goes to step (3.3). If not, the flow table is sent to the ingress switch and the egress switch according to the flow table sending rules adopted by the SDN controller without the deployed proxy server IP obfuscation unit.

[0021] (3.3) The SDN controller adds a new flow entry to the ingress switch's flow table, sets the destination IP in the match field of the flow entry to the SIP of the hit server, sets the action field of the flow entry to modify the destination IP address of the packet to the LIP of the hit server and forward it, and sets the expiration time of the flow entry to t; The SDN controller adds a new flow entry to the egress switch's flow table, sets the source IP in the match field of the flow entry to the LIP of the hit server, sets the action field of the flow entry to modify the source IP address of the packet to the SIP of the hit server and forward it, and sets the expiration time of the flow entry to t;

[0022] (4) The virtual topology generation module generates x virtual paths between any two nodes Ni and Nj in the original topology according to the system given parameters {x, y} and randomly selects y redundant paths in the network to obtain the virtual topology;

[0023] (5) The virtual topology deployment module deploys the virtual topology into the network, making the attacker believe that the detection flow between any two nodes Ni and Nj will be forwarded with equal probability along the x virtual paths from Ni to Nj, the y randomly selected redundant paths, and the original path. This makes it impossible for the attacker to distinguish the key links of the network by analyzing the traceroute response flow.

[0024] (6) During the entire life cycle of the system, the link monitoring module monitors the quality of network communication in real time. The quality evaluation criteria include at least link delay, link utilization, and port rate. If the network communication quality is found to be lower than the threshold set in advance by the system, a reinforcement learning-based rerouting algorithm is executed to achieve link protection.

[0025] Compared with the prior art, the present invention has the following advantages:

[0026] First, the proxy server IP obfuscation unit of the present invention can extend the time an attacker has to collect proxy server communication IP addresses, thereby reducing the attacker's attack intent. This is because, assuming an attacker needs to collect M proxy server communication IP addresses before launching an attack, if the M IP addresses collected by the attacker through NMAP network segment scanning contain a large number of SIP addresses, just as the attacker thinks they have collected enough proxy server communication IP addresses to launch an attack, the SIP addresses will quickly expire, preventing the attack from proceeding normally. The attacker is forced to continue collecting IP addresses, effectively extending the attack preparation time and thus reducing the attacker's attack intent.

[0027] Second, the topology obfuscation unit of the present invention adds redundant paths to the path information of the response attacker tracking flow in the virtual topology generation module to prevent the attacker from distinguishing the virtual path from the real communication path due to the leakage of its real IP address by a certain switch; in addition, since the virtual path of the present invention is composed of a virtual network and the number of nodes in the virtual network is not fixed, the length of the generated virtual path is different from the length of the real communication path, thereby preventing the attacker from distinguishing the real communication path, redundant path and virtual path through length information.

[0028] Third, the link monitoring module of the communication quality maintenance unit of the present invention monitors the network communication quality in real time throughout the entire life cycle of the system operation, and calls the reinforcement learning-based rerouting algorithm in the early stage of network congestion to restore the network communication quality in time to protect the network from blind new DDOS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is the overall block diagram of the system of the present invention;

[0030] Figure 2 Flowchart for realizing the method of the present invention;

[0031] Figure 3 A schematic diagram for generating a virtual topology in the present invention;

[0032] Figure 4 This is a schematic diagram of the deployment of the virtual topology deployment module in the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of this application clearer, the present invention is further described clearly and completely below in conjunction with specific embodiments.

[0034] Example 1: Reference Figure 1,The present invention proposes a new DDOS attack defense system based on IP and topology obfuscation, including: a proxy server IP obfuscation unit, a topology obfuscation unit, and a communication quality maintenance unit;

[0035] The proxy server IP obfuscation unit includes an IP allocation module and an IP obfuscation module. The IP allocation module allocates long-term and short-term IP addresses to all proxy servers in the network, recording the long-term IP address as a LIP and the short-term IP address as a SIP, and uses the allocation information as input to the IP obfuscation module. The IP obfuscation module is used to meet the requirements for LIP and SIP communication between hosts and proxy servers. The IP allocation module allocates long-term and short-term IP addresses to all proxy servers in the network. Specifically, a LIP and a SIP are allocated to a specified number K of proxy servers in a network with N proxy servers, and LIPs are allocated to the remaining NK proxy servers. The IP obfuscation module modifies the flow table of the SDN switch through the SDN controller to meet the requirements for LIP and SIP communication between hosts and proxy servers using the IP allocation module, thereby increasing the difficulty for attackers to collect proxy server IP information.

[0036] The topology obfuscation unit consists of an original topology acquisition module, a virtual topology generation module, and a virtual topology deployment module, designed to prevent attackers from distinguishing key network links by analyzing traceroute response streams. The original topology acquisition module utilizes the SDN controller's network topology discovery principles to obtain the network topology, referred to as the original topology, and uses the original topology as input for the virtual topology generation module. The virtual topology generation module generates a virtual topology based on the original topology with a given parameter set {x, y} as input, and then uses the virtual topology as input for the virtual topology deployment module, which deploys the network based on the input virtual topology.

[0037] The virtual topology generation module generates a virtual topology based on the input original topology according to the given parameter set {x, y}. The implementation is as follows: each switch in the original topology is regarded as a node, and the node set composed of all switches is recorded as {N1, N2, ..., Nn}, where n is the total number of nodes; x virtual networks are created for all SDN switches in the original topology, where the number of nodes on any virtual network is not fixed, to obtain the virtual network set: in represents the xth virtual network created for the nth node Nn; assuming that any two nodes Ni and Nj have links in the original topology, where i,j∈1,2,..n and i≠j, there are x pairs of virtual networks A one-to-one virtual link is created between nodes Ni and Nj to obtain x virtual links. For any two nodes Ni and Nj, the virtual topology generation module randomly selects y redundant paths from Ni to Nj in the original topology. The real communication path from Ni to Nj in the original topology is recorded as the original path. The path composed of virtual links between virtual networks created for nodes on the original path is called a virtual path. The original path, the x virtual paths created from Ni to Nj, and the randomly selected y redundant paths are called the virtual topology from Ni to Nj.

[0038] The virtual topology deployment module achieves the purpose of deploying the virtual topology into the network by simultaneously modifying the TTL value of the traceroute data packet and the IP address of the response packet or rerouting the data packet to a redundant path; the link monitoring module runs throughout the entire life cycle of the system and monitors the network communication quality in real time through the Iperf tool, and the monitoring content includes at least link delay, link utilization and port rate.

[0039] The communication quality maintenance unit is composed of a link monitoring module combined with a reinforcement learning-based rerouting algorithm; wherein the link monitoring module is used to monitor the network communication quality in real time, and when the communication quality is less than a preset threshold, the reinforcement learning-based rerouting algorithm is called to reselect the communication path for the data packet to restore network communication.

[0040] Example 2: Reference Figure 2 The present invention provides a novel DDOS attack defense method based on long and short IP and topology confusion, which specifically includes the following steps:

[0041] Step 1: In a network with N proxy servers, select K proxy servers as designated proxy servers based on the defender's defense requirements. The number K is determined as follows:

[0042]

[0043] N represents the total number of proxy servers in the network, M represents the number of proxy servers that the attacker needs to collect, and the system sets the parameter p based on its own defense requirements. That is, the system expects the attacker to collect M LIPs at a time through NMAP network segment scanning with a small probability p.

[0044] Step 2: Use the IP allocation module to allocate a long-term IP and a short-term IP to the designated proxy server. The long-term IP is called LIP and the short-term IP is called SIP. Only LIP is allocated to the remaining proxy servers. The LIP remains unchanged for a long time. The system gives a parameter t and re-allocates SIP to the designated proxy server every t. The LIP of a proxy server is used as the communication IP of the proxy server, and the allocation result is input into the IP obfuscation module.

[0045] The IP allocation module is used to allocate SIP and LIP to the proxy server. The allocation of SIP and LIP needs to meet the following requirements:

[0046] (a) The LIPs of each proxy server are different. Let the LIPs assigned to all proxy servers be {LIP1, LIP2, ..., LIP N}, each designated proxy server's SIP does not belong to {LIP1, LIP2, ..., LIP N}, and at the same time, the SIPs of any two designated proxy servers are different;

[0047] (b) The current SIP of any proxy server and its LIP are in the same network segment;

[0048] (c) The system gives a time T, during which the same SIP cannot be assigned multiple times. This is to prevent the SIP scanned by NMAP from being continuously available within T. For example, in the first t, the SIP belongs to proxy server 1 and in the second t it is assigned to proxy server 2. Then the attacker can receive IP response packets in both t times.

[0049] Step 3: The IP obfuscation module modifies the flow table of the SDN switch through the SDN controller so that the data packets are forwarded between the various SDN switches in the network by matching the modified flow table. This is achieved as follows:

[0050] (3.1) When an IP packet is sent from an external user to a proxy server, the IP packet is first sent to the SDN switch connected to the external user, where the SDN switch connected to the external user is recorded as the ingress switch, and the SDN switch connected to the proxy server is recorded as the egress switch. The ingress switch sends the IP packet to the SDN controller, which determines whether the destination IP address of the IP packet belongs to the LIP of a proxy server. If so, the flow table is sent to the ingress switch and the egress switch according to the flow table sending rules adopted by the SDN controller without the deployed proxy server IP obfuscation unit. If not, the process goes to step (3.2).

[0051] (3.2) The SDN controller determines whether the destination address belongs to the current SIP of a specified proxy server. If so, the proxy server is called the hit server and the process goes to step (3.3). If not, the flow table is sent to the ingress switch and the egress switch according to the flow table sending rules adopted by the SDN controller without the deployed proxy server IP obfuscation unit.

[0052] (3.3) The SDN controller adds a new flow entry to the flow table of the ingress switch, sets the destination IP in the match field of the flow entry to the SIP of the hit server, sets the action field of the flow entry to modify the destination IP address of the data packet to the LIP of the hit server and forward it, and sets the expiration time of the flow entry to t; The SDN controller adds a new flow entry to the flow table of the egress switch, sets the source IP in the match field of the flow entry to the LIP of the hit server, sets the action field of the flow entry to modify the source IP address of the data packet to the SIP of the hit server and forward it, and sets the expiration time of the flow entry to t.

[0053] Step 4: The virtual topology generation module generates x virtual paths between any two nodes Ni and Nj in the original topology according to the system given parameters {x, y} and randomly selects y redundant paths in the network to obtain the virtual topology;

[0054] Step 5: The virtual topology deployment module deploys the virtual topology into the network, making the attacker believe that the probe flow between any two nodes Ni and Nj will be forwarded with equal probability along the x virtual paths from Ni to Nj, the y randomly selected redundant paths, and the original path. This makes it impossible for the attacker to distinguish the key links of the network by analyzing the Traceroute response flow.

[0055] Step 6: During the entire life cycle of the system, the link monitoring module monitors the network communication quality in real time. The quality evaluation criteria include at least link delay, link utilization, and port rate. If the network communication quality is found to be lower than the threshold set in advance by the system, a reinforcement learning-based rerouting algorithm is executed to achieve link protection.

[0056] Example 3: Reference Figure 3 The DDOS attack defense method in this embodiment has the same overall implementation steps as the second embodiment. The virtual topology generation module is now further described:

[0057] like Figure 3 As shown, N1-N2-N3-N4-N5 is the real communication path from N1 to N5, that is, the original path, and N1-N6-N7-N8-N5 is the redundant path from N1 to N5 in the original topology. In this embodiment, we assume that the input parameters x is 2 and y is 1, then and There are two virtual networks created on N1. and There are two virtual networks created at N2, N3, N4, and N5, and so on. The virtual path from N1 to N5 consists of two: and N1-N6-N7-N8-N5 is the redundant path selected for N1 to N5, so the generated virtual topology is as follows Figure 3 shown.

[0058] Example 4: Reference Figure 4 The DDOS attack defense method in this embodiment has the same overall implementation steps as the second embodiment. The virtual topology deployment module is now further described:

[0059] The virtual topology deployment module modifies the TTL value of traceroute packets and the IP address of response packets, or reroutes packets to redundant paths. This tricks attackers into believing that the probe flow is equally likely to be forwarded along the virtual path, redundant path, and critical path. This prevents attackers from identifying the critical path by analyzing the traceroute response flow.

[0060] (5.1) To prevent attackers from distinguishing nodes on the real communication path from nodes on the virtual network by observing IP addresses, the IP addresses assigned to nodes on the virtual network should be public IP addresses. In addition, the assigned IP addresses should be in the same subnet as the corresponding nodes on the real communication path, and it is also necessary to avoid using already assigned IP addresses.

[0061] (5.2) The SDN controller modifies the TTL value of the traceroute packet and instructs the switch to respond to the trace message with its real IP address or fake IP address or reroute the packet to a redundant path. 1 / 3 of the traceroute packets are modified to return the virtual path view to the attacker, 1 / 3 of the traceroute packets are modified to return the redundant path view to the attacker, and the remaining 1 / 3 of the packets are forwarded normally. Figure 4S is the attacker, D is the proxy server, and A is a node on the original path. In this example, we assume that a virtual path is generated for this node and a redundant path is selected. BC is a virtual network created on node A, and SED is a randomly selected redundant path. To return the virtual path view to the attacker, when switch A receives a traceroute command with a TTL of 1, the SDN controller creates a flow table rule to modify the source IP address of the ICMP time exceeded response message to B. When receiving a packet with a TTL of 2, the TTL value is decremented by 2 to trick the attacker into believing switch C exists, causing the packet to expire at switch A. The SDN controller then creates a flow table rule to modify the source IP address of the ICMP time exceeded response message to C. When receiving a packet with a TTL of 3, the TTL value is decremented by 2 to trick the attacker into believing switch C exists. This allows the packet to reach proxy server D, allowing the attacker to obtain the virtual path response from SBCD. To return the redundant path view to the attacker, the SDN controller can issue a flow table rule to reroute the packet to E, allowing the attacker to obtain the topology view of SED.

[0062] Example 5: The DDOS attack defense method in this example has the same overall implementation steps as Example 2. The rerouting algorithm based on reinforcement learning is now further described and implemented as follows:

[0063] (6.1) The link relationship of the SDN switches in the original topology is expressed as a matrix Indicates that the element l ij 、l ji Both represent the link relationship between Ni and Nj in the original topology. If there is a link between the two, then l in the matrix L ij 、l ji is 1, otherwise 0;

[0064] (6.2) Based on all nodes {N1, N2, ...Nn}, the state space and action space of the agent are designed. The state of the agent when the data packet is at the i-th node Ni is represented as Ni', and the action of the agent when the data packet chooses the next route Nj is represented as Nj';

[0065] (6.3) The agent selects action Nj' in state Ni', and its reward is obtained in the following cases:

[0066] Case 1: l in L ij is 0, reward R = r0, r0 represents its punishment;

[0067] Case 2: l in L ij is 1, and Nj is not a node connected to the proxy server, the reward R = λ1BW ij+λ2LTR ij +λ3DL ij +λ4JI ij +λ5Loss ij ;

[0068] Case 3: l in L ij is 1, and Nj is the node connected to the proxy server, the reward is R = λ1BW ij +λ2LTR ij +λ3DL ij +λ4JI ij +λ5Loss ij +r3, where r3 represents the reward for reaching the destination address;

[0069] Among them BW ij represents the remaining bandwidth of the link between nodes Ni and Nj, LTR ij represents the link throughput between nodes Ni and Nj, DL ij represents the link delay between nodes Ni and Nj, JI ij Indicates the link jitter between nodes Ni and Nj, Loss ij represents the packet loss rate of the link between nodes Ni and Nj, λi is the weight of the reward function, where λ1,λ2∈[0,1],λ3,λ4,λ5∈[-1,0], and the value of λ1->λ5 can be determined through experiments, that is, the parameters λ1,λ2,λ3,λ4,λ5 that make the agent obtain the highest reward are selected as the weight of the reward function;

[0070] (6.4) Based on the designed state space, action space and reward function, Q learning is used to train the Q table. After the training, the data packet is forwarded according to the Q table. For example, when the agent is in state Ni', it is equivalent to the data packet being in the i-th node Ni. The agent selects the action Nj' with the largest reward based on the Q table, which is equivalent to the data packet selecting the j-th node Nj as the next route.

[0071] Parts of the present invention that are not described in detail belong to common knowledge among those skilled in the art.

[0072] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Obviously, for professionals in this field, after understanding the content and principles of the present invention, they may make various modifications and changes in form and details without departing from the principles and structure of the present invention. However, these modifications and changes based on the ideas of the present invention are still within the scope of protection of the claims of the present invention.

Claims

1. A new DDOS attack defense system based on IP and topology confusion, characterized by: include: Proxy server IP obfuscation unit, topology obfuscation unit, and communication quality maintenance unit; The proxy server IP obfuscation unit includes an IP allocation module and an IP obfuscation module; The IP allocation module allocates long-term and short-term IP addresses to all proxy servers in the network, recording the long-term IP address as LIP and the short-term IP address as SIP, and uses the allocation information as input to the IP obfuscation module. The IP obfuscation module is used to implement the communication requirements between the host and the proxy server using the LIP and SIP addresses allocated by the IP allocation module. The topology obfuscation unit is composed of an original topology acquisition module, a virtual topology generation module, and a virtual topology deployment module, and is used to prevent attackers from distinguishing key network links by analyzing traceroute response streams. The original topology acquisition module uses the network topology discovery principle of the SDN controller to obtain the network topology, which is recorded as the original topology, and uses the original topology as input to the virtual topology generation module. The virtual topology generation module generates a virtual topology based on the original topology with a given parameter set {x, y} as input, and then uses the virtual topology as input to the virtual topology deployment module. The virtual topology deployment module is used to deploy the network based on the input virtual topology. The communication quality maintenance unit is composed of a link monitoring module combined with a reinforcement learning-based rerouting algorithm; the link monitoring module is used to monitor the network communication quality in real time, and when the communication quality is less than a preset threshold, the reinforcement learning-based rerouting algorithm is called to reselect a communication path for the data packet to restore network communication.

2. The system according to claim 1, wherein: The IP allocation module allocates long-term and short-term IP addresses to all proxy servers in the network. Specifically, a LIP and a SIP are allocated to a specified number K of proxy servers in a network with N proxy servers, and LIPs are allocated to the remaining NK proxy servers. The IP obfuscation module modifies the flow table of the SDN switch through the SDN controller to meet the communication requirements between the host and the proxy server using the LIP and SIP allocated by the IP allocation module, thereby increasing the difficulty for attackers to collect proxy server IP information.

3. The system according to claim 1, wherein: The virtual topology generation module generates a virtual topology for the input original topology based on the given parameter set {x, y}. The implementation is as follows: Consider each switch in the original topology as a node, and record the node set consisting of all switches as {N1, N2, ..., Nn}, where n is the total number of nodes. Create x virtual networks for all SDN switches in the original topology, where the number of nodes on any virtual network is not fixed, and obtain the virtual network set: in represents the xth virtual network created for the nth node Nn; assuming that any two nodes Ni and Nj are linked in the original topology, where i,j∈1,2,..n, and i≠j, there are x pairs of virtual networks A one-to-one virtual link is created between nodes Ni and Nj to obtain x virtual links. For any two nodes Ni and Nj, the virtual topology generation module randomly selects y redundant paths from Ni to Nj in the original topology. The real communication path from Ni to Nj in the original topology is recorded as the original path. The path composed of virtual links between virtual networks created for nodes on the original path is called a virtual path. The original path, the x virtual paths created from Ni to Nj, and the randomly selected y redundant paths are called the virtual topology from Ni to Nj.

4. The system according to claim 1, wherein: The virtual topology deployment module achieves the purpose of deploying the virtual topology into the network by simultaneously modifying the TTL value of the traceroute data packet and the IP address of the response packet or rerouting the data packet to a redundant path; the link monitoring module runs throughout the entire life cycle of the system and monitors the network communication quality in real time through the Iperf tool, and the monitoring content includes at least link delay, link utilization and port rate.

5. A method for implementing defense according to the system of claim 1, characterized in that: The following steps are involved: (1) In a network with N proxy servers, K proxy servers are selected as designated proxy servers based on the defender's defense capability; (2) Using the IP allocation module to allocate a long-term IP and a short-term IP to a designated proxy server, the long-term IP is referred to as LIP and the short-term IP is referred to as SIP. Only LIP is allocated to the remaining proxy servers. The LIP remains unchanged for a long time. The system gives a parameter t and re-allocates SIP to the designated proxy server every t. The LIP of a proxy server is used as the communication IP of the proxy server, and the allocation result is input into the IP obfuscation module. (3) The IP obfuscation module modifies the flow table of the SDN switch through the SDN controller, so that the data packets are forwarded between the various SDN switches in the network by matching the modified flow table. The implementation is as follows: (3.1) When an IP packet is sent from an external user to a proxy server, the IP packet is first sent to the SDN switch connected to the external user, where the SDN switch connected to the external user is recorded as the ingress switch, and the SDN switch connected to the proxy server is recorded as the egress switch. The ingress switch sends the IP packet to the SDN controller, which determines whether the destination IP address of the IP packet belongs to the LIP of a proxy server. If so, the flow table is sent to the ingress switch and the egress switch according to the flow table sending rules adopted by the SDN controller without the deployed proxy server IP obfuscation unit. If not, the process goes to step (3.2). (3.2) The SDN controller determines whether the destination address belongs to the current SIP of a specified proxy server. If so, the proxy server is called the hit server and the process goes to step (3.3). If not, the flow table is sent to the ingress switch and the egress switch according to the flow table sending rules adopted by the SDN controller without the deployed proxy server IP obfuscation unit. (3.3) The SDN controller adds a new flow entry to the ingress switch's flow table, sets the destination IP in the match field of the flow entry to the SIP of the hit server, sets the action field of the flow entry to modify the destination IP address of the packet to the LIP of the hit server and forward it, and sets the expiration time of the flow entry to t; The SDN controller adds a new flow entry to the egress switch's flow table, sets the source IP in the match field of the flow entry to the LIP of the hit server, sets the action field of the flow entry to modify the source IP address of the packet to the SIP of the hit server and forward it, and sets the expiration time of the flow entry to t; (4) The virtual topology generation module generates x virtual paths between any two nodes Ni and Nj in the original topology according to the system given parameters {x, y} and randomly selects y redundant paths in the network to obtain the virtual topology; (5) The virtual topology deployment module deploys the virtual topology into the network, making the attacker believe that the detection flow between any two nodes Ni and Nj will be forwarded with equal probability along the x virtual paths from Ni to Nj, the y randomly selected redundant paths, and the original path. This makes it impossible for the attacker to distinguish the key links of the network by analyzing the traceroute response flow. (6) During the entire life cycle of the system, the link monitoring module monitors the network communication quality in real time. The quality evaluation criteria include at least link delay, link utilization, and port rate. If the network communication quality is found to be lower than the threshold preset by the system, a rerouting algorithm based on reinforcement learning will be executed to achieve link protection.

6. The method according to claim 5, characterized in that: The number K of designated proxy servers is determined as follows: N represents the total number of proxy servers in the network, M represents the number of proxy servers that the attacker needs to collect, and the system sets the parameter p based on its own defense requirements. That is, the system expects the attacker to collect M LIPs at a time through NMAP network segment scanning with a small probability p.

7. The method according to claim 5, characterized in that: The allocation of SIP and LIP in step (2) must meet the following requirements: (a) The LIPs of each proxy server are different. Let the LIPs assigned to all proxy servers be {LIP1, LIP2, ..., LIP N }, each designated proxy server's SIP does not belong to {LIP1, LIP2, ..., LIP N }, and at the same time, the SIPs of any two designated proxy servers are different; (b) The current SIP of any proxy server and its LIP are in the same network segment; (c) The system is given a time T, and the same SIP cannot be assigned multiple times within the time T.

8. The method according to claim 5, wherein: The reinforcement learning-based rerouting algorithm in step (6) is specifically to find the optimal next route for the data packet at Ni, and the implementation steps are as follows: (6.1) The link relationship of the SDN switches in the original topology is expressed as a matrix Represents that the element l ij 、l ji Both represent the link relationship between Ni and Nj in the original topology. If there is a link between the two, then l in the matrix L ij 、l ji is 1, otherwise 0; (6.2) Based on all nodes {N1, N2, ...Nn}, the state space and action space of the agent are designed. The state of the agent when the data packet is at the i-th node Ni is represented as Ni', and the action of the agent when the data packet chooses the next route Nj is represented as Nj'; (6.3) The agent selects action Nj' in state Ni', and its reward is obtained in the following cases: Case 1: l in L ij is 0, reward R = r0, r0 represents its punishment; Case 2: l in L ij is 1, and Nj is not a node connected to the proxy server, the reward R = λ1BW ij +λ2LTR ij +λ3DL ij +λ4JI ij +λ5Loss ij ; Case 3: l in L ij is 1, and Nj is the node connected to the proxy server, the reward is R = λ1BW ij +λ2LTR ij +λ3DL ij +λ4JI ij +λ5Loss ij +r3, where r3 represents the reward for reaching the destination address; Among them BW ij represents the remaining bandwidth of the link between nodes Ni and Nj, LTR ij represents the link throughput between nodes Ni and Nj, DL ij represents the link delay between nodes Ni and Nj, JI ij Indicates the link jitter between nodes Ni and Nj, Loss ij represents the packet loss rate of the link between nodes Ni and Nj, λi is the weight of the reward function, where λ1,λ2∈[0,1],λ3,λ4,λ5∈[-1,0], and the value of λ1->λ5 can be determined through experiments, that is, the parameters λ1,λ2,λ3,λ4,λ5 that make the agent obtain the highest reward are selected as the weight of the reward function; (6.4) Based on the designed state space, action space, and reward function, Q-table is trained using Q-learning. After the training, data packets are forwarded according to the Q-table.

Images