SDN Slow DDoS Attack Detection and Mitigation Framework Based on MWD-CFM

Abstract

Aiming at the security risks of slow DDoS attacks faced by data layer switches in SDN, the present invention discloses an SDN slow DDoS attack detection and mitigation framework based on MWD-CFM. By deploying periodic monitoring of switches at the control layer, with the cooperation of the multi-window joint detection module, features are extracted through multiple windows respectively to jointly detect and determine whether an attack has occurred. The Fisher Score algorithm reduces the impact caused by the dimensional differences of the features themselves. The multi-window mechanism enhances the usability and effectiveness of the features. The corrected feature mitigation module first corrects the features of the flow rules to enhance the recognition of the features, and then uses a multi-layer perceptron to identify and classify each flow rule, deleting the attack flow rules belonging to the malicious type. This method can detect slow DDoS attacks at an early stage, clean up malicious attack flows, and ensure that there is enough space in the flow table of the switch to provide timely installation and processing of flow rules for legitimate normal flows.

Description

Technical Field

[0001] The present invention belongs to the field of computer network security, and particularly relates to an SDN slow DDoS attack detection and mitigation framework based on MWD-CFM. Background Art

[0002] As a new architecture designed with centralized control as the core, software-defined network (SDN) has not only attracted the attention of the academic community but also won the favor of the industrial community. Its creativity lies in decoupling the control from the processing and forwarding of data, which means that control operations can run independently in software form, rather than being mixedly processed at the hardware switch level as in traditional architectures. The advantage of SDN is that it enhances the programmability and manageability of the global network. A typical SDN architecture consists of three layers, namely the application layer, the control layer, and the data layer. Programs designed by different developers run in the application layer, and the control layer is mainly composed of controllers. The application layer and the control layer are connected and communicate through the northbound interface. The data layer consists of a large number of basic devices, such as switches and routers, responsible for forwarding data packets. The data layer and the control layer are connected through the southbound interface. Currently, SDN has been widely applied in industries such as cloud environments, vehicular ad hoc networks, and data centers to enhance network design and performance.

[0003] Although SDN brings convenience, it also provides opportunities for new threats. Although SDN is a new architecture with decoupled control operations, it still contains the basic attributes of traditional networks. Programs running in the application layer may have vulnerabilities themselves, which can be exploited by attackers, resulting in damage to the entire SDN. Attackers can monitor the control link and cause congestion and paralysis through flooding, resulting in communication interruption. Moreover, the three layers of SDN and the two communication links may all become targets of distributed denial of service (DDoS) attacks. For the control layer, attackers launch saturation attacks to make the controller busy processing a large number of meaningless false messages and unable to respond to requests from the data layer in a timely manner. For the data layer, since it still consists of a large number of switches, various attacks against traditional networks can also pose threats to it.

[0004] Among them, considering the malicious high consumption of resources and the damage to service quality, DDoS attacks have received extensive attention. Especially for the data layer, since switches in SDN are often composed of limited ternary content addressable memories (TCAMs), which are usually expensive and high-consumption devices, DDoS attacks against the limited flow table space of switches can maliciously occupy the flow table space, consume TCAM resources, cause flow table overflow, and achieve the purpose that the switch cannot provide enough space for normal legitimate flows to install flow rules and process them. Compared with traditional high-speed flooding DDoS attacks, the slow DDoS attack against the flow table space of the SDN data layer has a lower average rate. Due to its step-by-step growth, it has high concealment in the early stage and is often not easily detected. Once it accumulates and breaks out, it will cause harm to the flow table space and reduce the service quality of switches and the network. However, existing methods basically detect and mitigate high-speed flooding DDoS attacks, and these methods are not applicable to detecting slow DDoS attacks and cannot be mitigated in a timely manner in the early stage to provide sufficient flow table space for legitimate normal flows. Summary of the Invention

[0005] The present invention proposes a framework for detecting and mitigating slow DDoS attacks in SDN based on MWD-CFM to address the security risks of slow DDoS attacks faced by switches in the data layer of SDN.

[0006] The purpose of the present invention is to achieve early detection of slow DDoS attacks, adopt mitigation strategies, continuously monitor and protect the limited switch flow table space in real time, provide available flow table space for legitimate normal flows, and ensure service quality.

[0007] The framework for detecting and mitigating slow DDoS attacks in SDN based on MWD-CFM provided by the present invention is deployed in the SDN control layer to poll and protect OpenvSwitch type switches in the SDN data layer. Each switch is independently managed by a controller and runs this framework.

[0008] Its detection object is the slow DDoS attack against the SDN switch, which can cause the limited flow table space in the SDN switch to become saturated and overflow, making it unable to provide enough space for normal legitimate flows to install and process flow rules.

[0009] MWD refers to multi-window joint collaborative detection, and CFM refers to correction-based feature mitigation. The switches mentioned in the present invention all refer to OpenvSwitch type SDN switches.

[0010] The SDN slow DDoS attack detection and mitigation framework based on MWD-CFM includes a monitoring and extraction module, a multi-window joint detection module, and a corrected feature mitigation module.

[0011] Specifically, it includes the following steps:

[0012] Monitoring and extraction module:

[0013] S1. The monitoring and extraction module extracts the flow table occupancy and specific flow rule information of the switch through an execution script based on the ovs-ofctl command according to the set polling period. At the same time, based on the event records of the controller, it records the packet in messages and the traffic information flowing through the input ports of the switch, and passes the extracted information to the multi-window joint detection module.

[0014] Multi-window joint detection module:

[0015] S2. The multi-window joint detection module first divides multiple detection windows according to the idle timeout. The lengths of the detection windows are all less than the idle timeout and form an arithmetic progression. Each window extracts features respectively according to the information obtained in S1.

[0016] S3. In each detection window, the traffic byte count, the number of packet in messages, the IP, and the total len field values of all the incoming ports of the switch are extracted respectively to obtain four-element original features.

[0017] S4. Based on the four-element original features obtained in S3, each detection window calculates the mean occupancy rate, variance, and coefficient of variation of the traffic byte count of the incoming ports of the switch within its own window, the mean and variance of the number of packet in messages, the entropy value of the IP, and the mean, variance, and coefficient of variation of the total len respectively to obtain nine-element detection features.

[0018] S5. For all the nine-element detection features obtained in S4, in order to reduce the influence caused by the dimensional difference of the features themselves, the Fisher Score algorithm is used to score the nine-element detection features to obtain the feature importance scores.

[0019] S6. In each detection window, based on the set empirical threshold and sensitivity coefficient, the nine-element detection features are judged. The specific judgment method is that if the feature value is greater than or equal to the product of the threshold and the sensitivity coefficient, the feature is considered abnormal, and the importance scores of all the abnormal features among the nine detection features are accumulated to obtain the detection window score.

[0020] S7. For each detected window score obtained in S6, based on the assigned detection window weight, sum up the scores of all detection windows to obtain a combined total score. If the combined total score is greater than the set threshold, it is considered that the switch has been under a slow DDoS attack.

[0021] S8. After the multi-window joint detection module detects the occurrence of a slow DDoS attack, it transmits the flow rule information obtained in S1 to the correction feature mitigation module, and the mitigation program starts to run. If no attack is detected, repeat steps S1 to S7.

[0022] Correction feature mitigation module:

[0023] S9. Based on the information fed back by the multi-window joint detection module, the correction feature mitigation module first extracts the number of packets, the number of bytes, and the duration of each flow rule to obtain three-element original features.

[0024] S10. Based on the three-element original features obtained in S9, calculate the average packet byte count and the average packet duration, and correct the average packet duration to obtain two-element mitigation features.

[0025] S11. Input the two-element mitigation features obtained in S10 into the trained multi-layer perceptron classifier for determination. If the output result is positive, it means that this flow rule is considered a malicious flow rule, and based on the ovs-ofctl command, this flow rule is deleted from the switch. If the classifier output result is negative, this flow rule is retained. When all flow rules are identified, the correction mitigation module enters a silent state and waits for the next information feedback from the multi-window joint detection module.

[0026] Beneficial effects

[0027] This SDN slow DDoS attack detection and mitigation framework based on MWD-CFM provided by the present invention is deployed in the control layer. According to the monitoring extraction module, it periodically obtains the switch flow table information and the traffic information flowing through the switch. With the cooperation of the multi-window joint detection module, it extracts features through multiple windows respectively and jointly conducts detection to determine whether an attack has occurred. The Fisher Score algorithm reduces the influence caused by the dimensionality difference of the features themselves. The multi-window mechanism enhances the availability and effectiveness of the features. The correction feature mitigation module first corrects the features of the flow rules to enhance the recognition of the features, and then uses a multi-layer perceptron to identify and classify the features of each flow rule, and deletes the flow rules belonging to the malicious attack flow type from the SDN switch to achieve the mitigation purpose. This method can detect the slow DDoS attack in the early stage and clean up the malicious attack flows, ensuring that the flow table of the switch has enough space to provide timely flow rule installation and processing for legitimate normal flows. Description of the drawings

[0028] Figure 1 It is a schematic diagram of the overall structure of the present invention.

[0029] Figure 2 It is a schematic diagram for distinguishing features extracted within the detection window.

[0030] Figure 3 It is the importance score obtained by calculating the samples within the detection window using the Fisher Score algorithm.

[0031] Figure 4 It is a schematic diagram of the average packet duration and the corrected average packet duration features of the legal normal flow rules and the flow rules belonging to the slow DDoS attack type.

[0032] Figure 5 It is a schematic diagram of the average packet byte count and the corrected average packet duration features.

[0033] Figure 6 It is a graph showing the change in the number of flow rules in the switch flow table space after applying the framework of the present invention.

[0034] Figure 7 It is a graph showing the change in the proportion of legal normal flow rules in the switch flow table space after applying the framework of the present invention.

[0035] Figure 8 It is a graph showing the change in the number of TableFull messages sent by the switch received by the controller after applying the framework of the present invention. Detailed implementation manner

[0036] The method of the present invention will be further described below with reference to the accompanying drawings.

[0037] As Figure 1 shown is a schematic diagram of the overall structure of the present invention: The SDN slow DDoS attack detection and mitigation framework based on MWD-CFM provided by the present invention includes a monitoring and extraction module, a multi-window joint detection module, and a corrected feature mitigation module, and specifically includes the following steps:

[0038] Monitoring and extraction module:

[0039] S1. The monitoring and extraction module extracts the occupancy of the switch flow table and specific flow rule information by using an execution script based on the ovs-ofctl command according to the set polling period, and at the same time records the packet in message and the traffic information flowing through the switch input port based on the event of the controller, and transmits the extracted information to the multi-window joint detection module.

[0040] Multi-window joint detection module:

[0041] S2. The multi-window joint detection module first divides multiple detection windows according to the idle timeout. The lengths of the detection windows are all less than the idle timeout and form an arithmetic sequence. Each window extracts features respectively based on the information obtained in S1.

[0042] The idle timeout is a soft timeout parameter configured by the SDN controller.

[0043] S3. Within each detection window, the traffic byte count, the number of packet in messages, the IP, and the total len field value of all the incoming ports of the switch are extracted respectively to obtain the four-element original features.

[0044] The definition of total len in S3 is obtained from the OpenFlow protocol and is specifically the full length of the data packet frame.

[0045] S4. Based on the four-element original features obtained in S3, each detection window calculates the mean occupancy rate, variance, and coefficient of variation of the traffic byte count of the incoming ports of the switch within its own window, the mean and variance of the number of packet in messages, the entropy value of the IP, and the mean, variance, and coefficient of variation of total len respectively to obtain the nine-element detection features.

[0046] As Figure 2 shown, the nine-element features all show a certain degree of discriminability.

[0047] Among them, the formula for calculating the occupancy rate EIOR of the traffic byte count of the incoming ports of the switch is:

[0048]

[0049]

[0050] Among them, n is the number of ports, and port i is the number of bytes of port i.

[0051] S5. For all the nine-element detection features obtained in S4, to reduce the influence caused by the dimensional difference of the features themselves, the Fisher Score algorithm is used to score the nine-element detection features to obtain the feature importance scores.

[0052] The formula for obtaining the importance score IPT of the k-th feature for the sample x using the Fisher Score algorithm is: k as follows:

[0053]

[0054]

[0055]

[0056] Among them, c represents the number of categories, and c i represents belonging to category i, n is the number of sample groups, and n i represents the number of sample groups belonging to category i, and f (k) represents the k-th eigenvalue on sample x, and F i (k) represents the mean of all the k-th eigenvalues on sample x belonging to category i, and F (k) represents the mean of the k-th eigenvalues on sample x belonging to all categories, and the value range of k is [1, 9].

[0057] As Figure 3 shown, after using the Fisher Score algorithm for scoring, the importance scores of features are scaled down to the range of 0 to 2, reducing the impact caused by the dimensional differences of the features themselves and enhancing the universality for various complex network environments.

[0058] S6. Within each detection window, based on the set empirical threshold and sensitivity coefficient, judge the nine-element detection features. The specific judgment method is that if the eigenvalue is greater than or equal to the product of the threshold and the sensitivity coefficient, the feature is considered abnormal, and the importance scores of all abnormal features among the nine detection features are accumulated to obtain the detection window score.

[0059] The empirical threshold is calculated from the dataset recorded in the real network data center, and the value of the sensitivity coefficient is 1.2.

[0060] S7. According to the score of each detection window obtained in S6, based on the assigned detection window weight, sum the scores of all detection windows to obtain the combined total score. If the combined total score is greater than the set threshold, it is considered that the switch has been under a slow DDoS attack.

[0061] The detection window weight and threshold are jointly determined by the real network dataset and malicious attack traffic.

[0062] S8. After the multi-window joint detection module detects the occurrence of a slow DDoS attack, it transmits the flow rule information obtained in S1 to the correction feature mitigation module, and the mitigation program starts to run. If no attack is detected, repeat steps S1 to S7.

[0063] Correction feature mitigation module:

[0064] S9. Based on the information fed back by the multi-window joint detection module, the correction feature mitigation module first extracts the number of packets, the number of bytes, and the duration of each flow rule to obtain the three-element original features.

[0065] S10. Obtain ternary original features based on S9, calculate the average packet byte count and average packet duration, and correct the average packet duration to obtain binary mitigation features.

[0066] As Figure 4 shown, whether for legitimate normal flows or malicious attack flows, the corrected average packet duration feature is more concentrated, enhancing the distinctiveness of the feature.

[0067] The calculation formulas for the average packet byte count APB, average packet duration API, and corrected average packet duration CVAPI are respectively;

[0068]

[0069]

[0070]

[0071] where bytes represents the number of bytes of this flow rule, packets represents the number of packets of this flow rule, duration represents the duration of this flow rule, and api represents the mean of a sequence of APIs.

[0072] S11. Input the binary mitigation features obtained in S10 into the trained multi-layer perceptron classifier for determination. If the output result is positive, it means that this flow rule is considered a malicious flow rule, and based on the ovs-ofctl command, this flow rule is deleted from the switch. If the classifier output result is negative, this flow rule is retained. When all flow rules are recognized, the correction mitigation module enters a silent state and waits for the information feedback from the next multi-window joint detection module.

[0073] As Figure 5 shown, the features input into the multi-layer perceptron for classification and recognition are the average packet byte count and the corrected average packet duration, and the features of legitimate normal flow rules and malicious flow rules show differences.

[0074] The multi-layer perceptron used is a pre-trained classifier. The training set consists of a real network data set and malicious attack flows, specifically including the average packet byte count and corrected average packet duration belonging to the malicious attack flow category, and the average packet byte count and corrected average packet duration belonging to the normal legitimate flow category.

[0075] As Figure 6 shown, compared with the switch flow table without using this method, after applying the framework of the present invention to protect the SDN switch flow table, slow DDoS attacks can be detected in the early stage, and at the same time, malicious flow rules in the switch are also deleted in a timely manner.

[0076] As Figure 7 shown, compared with the switch flow table without using this method, after applying the framework of the present invention to protect the SDN switch flow table, the proportion of legitimate normal flows can gradually recover and always maintain a normal level, which means that the switch flow table can provide timely flow rule installation and processing for legitimate normal flows.

[0077] As Figure 8 shown, compared with the switch flow table without using this method, after applying the framework of the present invention to protect the SDN switch flow table, the SDN switch overflows significantly less, specifically manifested as a significant reduction in the TableFull messages received by the controller. The framework of the present invention not only protects the limited switch flow table space but also reduces the TableFull messages, alleviating the burden on the communication link between the controller and the switch.

[0078] The slow DDoS attack detection and mitigation framework for SDN based on MWD-CFM provided by the present invention, by being deployed in the control layer, periodically obtains switch flow table information and traffic information flowing through the switch, extracts features through multiple windows respectively and jointly detects to determine whether a slow DDoS attack against the limited flow table space of the SDN switch occurs. The Fisher Score algorithm used reduces the influence caused by the dimensional difference of the features themselves. The multi-window mechanism enhances the availability and effectiveness of the features. The calibration feature mitigation module calibrates through the features of the flow rules, enhancing the recognition of the features and improving the accuracy of the multi-layer perceptron in identifying and classifying each flow rule. This method can detect the slow DDoS attack at an early stage and clean up malicious attack flows, not only ensuring that the switch flow table has enough space to provide timely flow rule installation and processing for legitimate normal flows but also alleviating the burden on the communication link between the controller and the switch.

Claims

1. MWD-CFM-based SDN Slow DDoS Attack Detection and Mitigation Method. This method is deployed in the SDN control layer to poll and protect OpenvSwitch-type switches in the SDN data layer. Each switch is independently managed by a controller and runs this method. Its detection object is the slow DDoS attack against the SDN switch, which can cause the saturation and overflow of the limited flow table space in the SDN switch, making it unable to provide enough space for normal legitimate flows to install and process flow rules. MWD refers to Multi-Window Joint Collaborative Detection, and CFM refers to Correction-based Feature Mitigation. The method includes a monitoring and extraction module, a multi-window joint detection module, and a correction feature mitigation module. All switches mentioned here refer to OpenvSwitch-type SDN switches. The specific steps are as follows: Monitoring and Extraction Module: S1. The monitoring and extraction module extracts the flow table occupancy and specific flow rule information of the switch according to the set polling period by using an execution script based on the ovs-ofctl command. At the same time, based on the controller's event records, packet in messages, and traffic information flowing through the switch's input port, the extracted information is passed to the multi-window joint detection module; Multi-Window Joint Detection Module: S2. The multi-window joint detection module first divides multiple detection windows according to the idle timeout. The length of each detection window is less than the idle timeout and forms an arithmetic sequence. Each window extracts features respectively according to the information obtained in S1; S3. In each detection window, the traffic byte count, the number of packet in messages, IP, and the total len field value of all the switch's incoming ports are extracted respectively to obtain a four-element raw feature; S4. Based on the four-element raw feature obtained in S3, each detection window calculates the mean occupancy rate, variance, and coefficient of variation of the traffic byte count of the switch's incoming ports within its own window, the mean and variance of the number of packet in messages, the entropy value of IP, and the mean, variance, and coefficient of variation of total len respectively to obtain a nine-element detection feature; S5. For all the nine-element detection features obtained in S4, to reduce the impact caused by the dimensional difference of the features themselves, the Fisher Score algorithm is used to score the nine-element detection features to obtain the feature importance scores; S6. In each detection window, based on the set empirical threshold and sensitivity coefficient, the nine-element detection features are judged. The specific judgment method is that if the feature value is greater than or equal to the product of the threshold and the sensitivity coefficient, the feature is considered abnormal, and the importance scores of all abnormal features among the nine detection features are accumulated to obtain the detection window score; S7. According to each detection window score obtained in S6, based on the given detection window weight, the scores of all detection windows are summed to obtain the combined total score. If the combined total score is greater than the set threshold, it is considered that the switch has been under a slow DDoS attack; After the multi-window joint detection module detects a slow DDoS attack, it passes the flow rule information obtained from S1 to the correction feature mitigation module, and the mitigation program starts to run. If no attack is detected, steps S1 to S7 are repeated; Correction feature mitigation module: S9. Based on the information fed back by the multi-window joint detection module, the correction feature mitigation module first extracts the number of packets, the number of bytes, and the duration of each flow rule to obtain three-element original features; S10. Based on the three-element original features obtained in S9, calculate the average packet byte count and the average packet duration, and correct the average packet duration to obtain two-element mitigation features; S11. Input the two-element mitigation features obtained in S10 into the trained multi-layer perceptron classifier for determination. If the output result is positive, it means that this flow rule is considered a malicious flow rule, and this flow rule is deleted from the switch based on the ovs-ofctl command. If the classifier output result is negative, this flow rule is retained. When all flow rules are recognized, the correction mitigation module enters a silent state and waits for the information feedback from the multi-window joint detection module next time; The idle timeout in S2 is a soft timeout parameter configured by the SDN controller, and the total len in S3 is the full length of the data packet frame; 2. The MWD-CFM-based SDN slow DDoS attack detection and mitigation method according to claim 1, characterized in that The calculation formula for the importance score IPTk of the k-th feature obtained for the sample x using the Fisher Score algorithm in S5 is:

3. The method for detecting and mitigating slow DDoS attacks in SDN based on MWD-CFM according to claim 1, characterized in that The empirical threshold in S6 is calculated from the data set recorded by the real network data center. The value of the sensitivity coefficient in S6 is 1.2, and the detection window weights and thresholds in S7 are jointly determined by the real network data set and malicious attack flows.

4. The method for detecting and mitigating slow DDoS attacks in SDN based on MWD-CFM according to claim 1, characterized in that The multi-layer perceptron used in S11 is a pre-trained classifier. The training set consists of the real network data set and malicious attack flows, specifically including the average packet byte count and the corrected average packet duration belonging to the malicious attack flow category, and the average packet byte count and the corrected average packet duration belonging to the normal legitimate flow category.

Images